I'm looking to remove access to select sites in our Sharepoint intranet for a group of users in a division we're divesting. I have a "M365" type dynamic group which should include all those employees. I don't see a "deny access" permission level I can use so am wondering if there's another way without resorting to conditional access policies (which don't seem to work).

1 Answer 1


You wouldn't "deny" access as such, you simply wouldn't grant those users permissions to the site. If you've granted permissions to the site via a group that contains those users, then you'll either need to remove the users from that group or use a different group to grant access that doesn't contain those users.

  • We're tied to Azure AD and the "everyone" token includes all employees so I suppose I could create a dynamic group excluding those tied to the business unit being divested. It affects about 2k users so can't do anything manual.
    – matt
    Commented Feb 10, 2023 at 21:04
  • There's no choice. SharePoint vs File System are 2 different things when it comes to permission management, it's by design. In File System you can "deny", not with SharePoint. Commented Feb 16, 2023 at 8:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.