I'm try to add a domain group to a folder using EnsureUser and get the following response

The specified user GROUPNAME could not be found.

The group exists, I've found if I add this group to another item in the site and try again it succeeds. Do I need to add the group to the site and then call ensure user? This seems to occur the very first time. It's almost like it needs to be added to the site first?

If this the case how do I go about achieving this with CSOM


I've tried the following for ensureuser and still the same:

[email protected]

This is also a Office 365 Group

  • is it a security group or a mail distribution group?
    – HarryB
    Mar 14, 2017 at 15:37
  • its an Office 365 Group. You can add this group via the UI
    – Webfort
    Mar 14, 2017 at 15:43
  • 1
    O365 group is only a distribution group not a security group.
    – HarryB
    Mar 14, 2017 at 15:47
  • Is there a central point I can get a list of all groups and cross reference it before trying to apply it?
    – Webfort
    Mar 14, 2017 at 15:49
  • 1
    you will probably need to query azure AD for that
    – HarryB
    Mar 14, 2017 at 16:19

2 Answers 2


You need to call EnsureUser with the login name in the format c:0o.c|federateddirectoryclaimprovider|groupId where groupId is the id of the group in Azure AD i.e. a guid.

e.g. c:0o.c|federateddirectoryclaimprovider|629b9938-dd1b-4006-97a8-6bb9c4e84ac2

You can get this from the Microsoft or Azure Graph APIs.

  • Would this be different for security groups vs a distribution group (which is what the OP asked about)?
    – wjervis
    Oct 11, 2017 at 18:30

Use ClientPeoplePickerWebServiceInterface.ClientPeoplePickerSearchUser to look up the group id for EnsureUser.

Since the API will return all groups starting with the specified name, you might get more than one result and have to make sure you pick the right one.

If you know what type of group you're looking for, you can further restrict the result by specifying a different PrincipalType.

using Microsoft.SharePoint.Client;
using Microsoft.SharePoint.ApplicationPages.ClientPickerQuery;
using Microsoft.SharePoint.Client.Utilities;
using Newtonsoft.Json.Linq;
private string LookupGroupName(string groupName)
    ClientPeoplePickerQueryParameters query = new ClientPeoplePickerQueryParameters();
    query.AllowEmailAddresses = false;
    query.MaximumEntitySuggestions = 10;
    query.PrincipalType = PrincipalType.All;
    query.PrincipalSource = PrincipalSource.All;
    query.QueryString = groupName;
    ClientResult<String> result = ClientPeoplePickerWebServiceInterface.ClientPeoplePickerSearchUser(ctx, query);
    var pickerResult = JArray.Parse(result.Value);
    string key = String.Empty;
    foreach (var entry in pickerResult)
        if (entry["DisplayText"].Value<string>().Equals(groupName, StringComparison.InvariantCultureIgnoreCase))
            key = entry["Key"].Value<string>();
    return key;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.