I am currently facing an issue with a requirement that was presented to me, and i would like to ask you guys on possible ways of solving it. The requirement is to enable External/Guest users to have the ability to add/remove users from their organization (other external accounts) into and out of some sharepoint groups or o365 groups.

As a first step, i created an SPFx app, deployed it on a SP Page in order to see if the External/Guest user can list user of the AAD by utilizing the Graph API endpoint /users.

Unfortunately, i am getting 403 Forbidden exception on my External/Guest Account and it seems that there is no way around this exception.

I was thinking of keeping the solution as simple as possible and downsize it to the abovementioned SPFx app and that is why I am trying to access the Graph API with the Guest User's context.

Has anyone ever faced and overcame this kind of problem?

1 Answer 1


Guest users have restricted directory permissions. They can manage their own profile, change their own password and retrieve some information about other users, groups and apps, however, they cannot read all directory information. For example, guest users cannot enumerate the list of all users, groups and other directory objects. Guests can be added to administrator roles, which grant them full read and write permissions contained in the role.

Or you can also try to set: Guest users have the same access as members (most inclusive), grants all member user permissions to guest users by default.

enter image description here

If the answer is helpful, please click "Accept Answer" and kindly upvote it.

  • Is there anything else I can help with regarding this issue? You can comment us at any time and we will continue to follow up. Thanks, Carl Zhao
    – carl zhao
    May 20, 2022 at 7:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.