1

I have a few users in my tenant for whom I have disabled SharePoint, OneDrive and Office Online. But the users are still able to go to SharePoint sites and upload/download documents, edit lists etc. They can still navigate to OneDrive for Busines but cannot get teh upload/download/sync menu.

I tried revoking licenses from UI and with powershell too I can see they do not have those licenses. Any more steps to take? One user was not assigned these licenses at the time of creating his account but still can access SharePoint.

  • 3
    The users are likely members of an AD group where they get the permissions despite excluding them individually from the Office tools. Have a look at your AD on one of the users part of your description. Alternatively, on SP, you can check what permissions each user has on a site using the Check Permissions -tool, which should lead to conclusions about the users' group memberships. – moe Jun 27 '17 at 6:08
  • @Moe, The user is not part of any active directory group since this is a new user. But whereever we used everyone except external users group, this user gets permissiosn. Shouldn't the permissions be goverened by licenses first and then go to SharePoint? – Ashish Jun 27 '17 at 6:38
  • Everyone covers your AD users and external users, so even if you wouldn't have the user in your AD, but your environment would allow external users, they can access the site after receiving an invitation. Also, even if the user only exists in AD, but doesn't belong into any group, the user is by default part of this coverage. Using SharePoint doesn't require an Office license. – moe Jun 27 '17 at 6:44
3

The users are likely members of an AD, from where they get the permissions despite excluding them individually from the Office tools. Have a look at your AD on one of the users part of your description.

Alternatively, on SP, you can check what permissions each user has on a site using the Check Permissions -tool, which should lead to conclusions about the users' group memberships.

When using the built-in Everyone group, the group covers your AD users and external users, so even if you wouldn't have the user in your AD, but your environment would allow external users, they can access the site after receiving an invitation. Also, even if the user only exists in AD, but doesn't belong into any group, the user is by default part of this coverage. Using SharePoint doesn't require an Office license.

2

Not assigning a license to an individual user will not physically prevent them from accessing a SharePoint site

What you have to do is to manage the permissions for the SharePoint Online sites. Managing permissions will work for you.

Additionally, you have to consider the comments from @moe

  • 1
    Managing permissions may not be possible at site level because user gets permissions wherever the group Everyone except external users group has permissions. – Ashish Jun 27 '17 at 6:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.