I am using CSOM to create a site to SharePoint Online. Site is created correctly, but if I try to use CreateDefaultAssociatedGroups for that site, I get following exception

Microsoft.SharePoint.Client.ServerUnauthorizedAccessException: Access denied. You do not have permission to perform this action or access this resource.

Code is something like

Web web = ctx.Web;
Web newWeb = ctx.Web.CreateWeb("title", "leafurl", "description", "template", 1033, false);
newWeb.CreateDefaultAssociatedGroups(string.Empty, string.Empty, string.Empty);

So how come CSOM can create a site but it cannot create default associate groups for it?

(Afterwards I would associate owner group, but I cannot do that without CreateDefaultAssociatedGroups because newWeb.AssociatedOwnerGroup would be null)

EDIT: Same thing happens if I do following

Web web = ctx.Web;
Web newWeb = ctx.Web.CreateWeb("title", "leafurl", "description", "template", 1033, false);
newWeb.AssociatedVisitorGroup = null;
newWeb.AssociatedMemberGroup = null;
newWeb.AssociatedOwnerGroup = null;

EDIT2: It seems that CreateDefaultAssociatedGroups does add the groups to SharePoint. At least they are visible in _layouts/15/User.aspx but e.g. _api/web/associatedOwnerGroup returns

<d:AssociatedOwnerGroup xmlns:d="http://schemas.microsoft.com/ado/2007/08/dataservices" xmlns:m="http://schemas.microsoft.com/ado/2007/08/dataservices/metadata" xmlns:georss="http://www.georss.org/georss" xmlns:gml="http://www.opengis.net/gml" m:null="true"/>

2 Answers 2


Problem is DenyAddAndCustomizePages setting of site collection. It is automatically enabled for any site collection you create via SharePoint online by using the beautiful Create a site tool (Team site or Communication site). If you create sitecollection via https://TENANT-admin.sharepoint.com it is not enabled.

Solution is to use PowerShell and disable that property

Set-SPOSite https://TENANT.sharepoint.com/sites/sitecollection -DenyAddAndCustomizePages 0

You can check the current state of property with

$site = Get-SPOSite https://TENANT.sharepoint.com/sites/sitecollection

I found info about this from https://dannyjessee.com/blog/index.php/2017/07/sharepoint-online-modern-team-sites-are-noscript-sites-but-communication-sites-are-not/

  • Thank you so much! Stupid functionality!!! Commented Feb 12, 2019 at 14:08

Groups are created at the Site Collection level. To see this, go to a subsite, Site Settings, People and Groups, and on the left click More. All of the groups in the Site Collection will be displayed. (Or better, try to create a "Managers" group in one subsite when another site owner has already created one from their site.)

As Site Owners can create subsites, and typically create groups, there must be something odd about the top level site permissions of the account being used by the CSOM code.

So, it could either be:

  • Lack of the CSOM account's permissions for the top level site, or
  • The groups already exist. (created for another subsite)

There are other examples of what a Site Owner cannot do without at least limited permissions to the top level site. One is: subsite owner can't save a site as a template without write permissions to the Site Template Gallery in the top level site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.