5

I have a scenario, where

  • Navigation link has Audience set to several AD groups (Azure AD Connect is used to sync on-premises AD up the cloud).
  • A test user is a member of those groups when Audience was configured and he sees navigation links OK.

Then

  1. I remove this user from all of the groups, leaving just as Domain Member
  2. Ensure this change is replicated to Azure AD (can see this group "delete" update going through in synchronisation log)

The result is: test user can still see links protected by Audience, even though he is no longer a member of any groups directly or indirectly.

Another point confirming group changes have replicated is access to libraries, which are protected with the same AD groups. The test user loses access to libraries as expected.

Logging user off Sharepoint doesn't change anything. Waited for more than 2 hours and logged off and on again - still can see private links.

Update: Now, after a good 4 hours or so, the test user can't see the links again, meaning everything works as intended. I am quite confident it is a cache issue, but I still don't know where to control it.

Another update: I have been working with SPO support engineer and this issue replicates on their vanilla SPO site without any content, however there is a much shorter delay before new group membership applies to navigation.

  • Are you still using DirSync or have you upgraded to AAD Connect? – Eric Alexander Aug 16 '16 at 16:30
  • Hi Eric, we're using AAD Connect. I have been working with SPO support engineer and this issue replicates on their vanilla SPO site without any content, however there is a much shorter delay before new group membership applies to navigation. – Grigory Sergeev Aug 17 '16 at 15:21
2
+25

This sounds like the caching mechanism in SecurityTokenService known from OnPremise (see here: http://blog.randomdust.com/2013/06/sharepoint-2013-claim-expiration-and-ad-sync/).

As this is a farm-setting, i don't think it can be controlled by a tenant.

  • Thanks for suggestion, I have relayed this to MS support escalation as they have hard time understanding what the problem is and try to run me through basic site settings. It does look like what I need. – Grigory Sergeev Aug 16 '16 at 7:48
3

There is a timer job that compiles the audiences. Perhaps that needs to happen more frequently. This is 2010, but perhaps the setting is still available online.

http://www.eekels.net/schedule-audience-compilation-more-often-than-once-a-day/

This also is a farm setting and may not be accessible to a tenant.

0

Go into site settings and check user permissions, see if that user still shows up in the groups.

1.Open the SharePoint site on which you want to check permissions.

2.On the Site Actions menu Button image , click Site Settings.

3.On the Site Settings page, under Users and Permissions, click Check Effective permissions.

4.On the Check Effective Permissions page, in the User/Group box, type the e-mail address of the user or distribution group for which you want to verify permissions, and then click the Check Names icon.

5.Click Check Now.

https://support.office.com/en-gb/article/Check-permissions-for-a-user-or-group-13d15c92-1dea-4aad-a665-4c3d1d377850

The user could possibly have direct permission or be in another group.


a note from Microsoft outlining what I noted above:

Security Note: Audiences are only a convenient way to deliver content to specific groups of people. The content is still available and visible to anyone with appropriate permissions

https://support.office.com/en-gb/article/Manage-SharePoint-Online-audiences-1806ec78-1d4e-4620-8a89-89d6a38c9c33

  • Thanks for your suggestion Ali, however it isn't relevant, as the only connection between the user and the navigation link Audience is AD group, no intermediaries. Now, after a good 4 hours or so, the user can't see the links again, so I am quite confident it is a cache issue, but I still don't know where to control it. Updating the question. – Grigory Sergeev Aug 13 '16 at 2:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.