We are using SharePoint Online. Our on-premise AD is synced to the Azure AD. I have a problem with nested (A)AD groups and permissions. In my SP site I created a SP group. In this group I added an (A)AD group as a member. The (A)AD group holds several other nested (A)AD groups. This is something we have successfully done with other SP sites many times before.

In this particular case though, none of the members of the (A)AD groups get access to the SP site. Only if I add someone to the SP group directly they get access to the site.

I have queried Microsoft Graph to check if the sync from our AD to AAD works well. This is the case. The members of the AD group are all transitive members of the above mentioned root AAD group. So syncing works well.

What can be the cause of this issue?

1 Answer 1


After looking into this problem for two days I decided to post the above question here. As life goes... 10 minutes later I found the answer. So, for anyone else struggling with this problem, this is what I found:

The members of the (nested) groups that didn't get access were members of a Distribution list, not a Security group. All members of (nested) Security groups did have access to the site.

Hope this helps you to avoid loosing a lot of time. Greetings Henk

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.