Security department in my company approached me recently saying they've audited one of our SharePoint site collections (SP2016) and there is a serious security issue. Apparently, using an account being in single SharePoint Group with Read permission assigned on the root level, they are able to use SharePoint API to get full list of users existing in the site collection:


I've tried to reproduce it on my own and it is actually true. I would rather expect that I would see only my account.

Do you guys think it's a security issue? When you have full list of accounts, you have all logins and you can potentially try bruteforce attack. It doesn't convince me, but still security department wants me to address this. Any thoughts on this or any resource I can use to convince my security department they are wrong and it's actually not security issue?


George Rosword

  • 2
    Being able to to see a list of users is not a security breach. If you want to prove your point, every Active Directory (AD) user has read permissions to AD. Using any AD browsing tool or PowerShell, you can show your Security Department any user can get a full list of all AD users in your organization without SharePoint's help.
    – willman
    Feb 10, 2020 at 12:02

1 Answer 1


That's how SharePoint works. Users are stored in a hidden user list on site collection level whenever they are granted permissions. Even using a people picker and resolving a user add's them to the hidden user list so then the people picker field would be a security concern to.

You can disable the usage of webservices by creating a custom read permission level and remove either

  • Browse User Information - View information about users of the Web site.

Or (or just use both)

  • Use Remote Interfaces - Use SOAP, Web DAV, the Client Object Model or SharePoint Designer interfaces to access the Web site.

If they're afraid of someone trying to bruteforce a password, they should problaby look into MFA and stronger password policies to begin with.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.