I made a rest call to list site my users have access :

url: '/services/_api/web/webs/?$select=title,ServerRelativeUrl,effectivebasepermissions&$filter=effectivebasepermissions/high%20gt%2032',

I made a test user to check if the call works for non admin users and I get odd results.

When I throw this request on a user that should have 0 access to any sites, I get 2 sites with this result :


When I got to those two sites, I get an access denied.

When I check the effective permission with the users and group tool, it return : Style Ressource Reader, Limited Access.

When I check on other sites for that same user, I dont have Style Ressource Reader, Limited Access.

I tried to check if some componends had disabled inheritence, but it doesnt seem to be the case.

How can I make sure that the users doesnt get listed with that level of permissions. My request should return only a list of sites that the user should have access to.

1 Answer 1


Finally I had to remove style ressource reader from the site and add it again. I guess the permission provisionning was bugged.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.