I have been advising all my users to use mail enabled security groups for permissions and sharing content in SharePoint. I know for permissions, best practice is to use mail enabled security groups in SharePoint groups. And this works for mail enabled security groups that are synced from On Prem AD > AAD (a typical hybrid scenario).

However, I came across a case where a few users were not able to share (using the share button in SPO) to mail enabled security groups. I thought this might be a permissions issue or a bug. I raised this request with Microsoft support after doing some troubleshooting and was told this is the intended design. Mail Enabled security groups do not sync with SPO directory.

What is the recommended method of sharing content content from SharePoint? I was advised to create security groups in AAD which would work.

Thank you

1 Answer 1


Stop using security groups period. Yes, it is (possibly, sometimes, not always) good advice for on-prem due to Search performance, but for online, that isn't your responsibility and the search architecture is extremely different anyways.

The only exception to this is when you need to use dynamic groups. For non-Team sites (or Team sites where you need to add a large group of users to the Visitors group), use Azure AD Dynamic Groups. Otherwise, use Office 365 Groups set to dynamic.

  • So what is the recommended practice for sharing in SharePoint Online? We have a hybrid set up.
    – Krishant L
    Commented May 18, 2020 at 17:58
  • Strong recommendation is let site owners manage permissions -- or if IT is doing it, add directly to the individuals to O365 Group/SharePoint Group.
    – user6024
    Commented May 18, 2020 at 19:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.