I am a bit confused on what does Web.SiteUsers include in CSOM? as per the documentation it includes the users which belong to a site collection, but what does belong mean?

Does it mean users who have permission on the site, even if the permission was not granted directly to the user but through an AD group or through the "Everyone Except external" group?

I need a way to get all the users which can access the site regardless of the way they have been granted access to. Can anyone advise?

2 Answers 2


As per my understanding Web.SiteUsers returns the users from User Information List. This is a hidden list in the site collection.

When a user establishes a relationship with site (access the site/assigned with an item. etc), it will be resolved as a user item in the list.

Below is URL format for this list:

  • i also thought this is the case but i did not find an official documentation which mention this.
    – John John
    Commented Jan 13, 2021 at 17:43
  • 1
    Even when you just search a user in the people picker, it will add that user to the User Information List (Web.SiteUsers). So the Web.SiteUsers is not a good indicator of anything. You can never user it as a reliable way of determining which users have access to a site. Commented Jan 18, 2021 at 18:21

I can confirm Siteuser comes from user information hidden list.

Users are added to the User Information List when:

  • The specified user is granted permissions individually within a site collection
  • The specified user is added to a person/group field value anywhere in the site collection
  • The user is named specifically in a workflow anywhere in the site collection
  • The user is added to a SharePoint group as an individual (i.e. not when added as a member of a domain group)
  • The user is granted permissions anywhere in the site collection via a domain group membership AND subsequently visits the site (if the user is granted access via a domain group membership but never visits the content they were granted access to, they are not added to the user info list)
  • The user is passed into the SPWeb.EnsureUser() method

"Everyone Except external" is a security group instead of sharepoint group. you can find it in siteuser instead of sitegroup.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.