Why do users get intermittent “Access Denied” errors in SharePoint Online despite correct permissions?

Hi @Dauchier

Have you tried log out and log in again? Or using an incognito website? If incognito web works, try clearing browser data.

Check for broken inheritance: The list or library may have broken permission inheritance from the parent site, which is blocking access. You can reset inheritance on the list or library. If the user lacks the required permissions, grant them the appropriate access level.

Remove and Re-add User: If the issue persists, remove the user from the site collection. Re-add the user and grant them the appropriate permissions.

An article that might also help: Access Denied or You need permission errors in SharePoint Online and OneDrive - SharePoint | Micros…

Please try and let me know if it works for you. I look forward for your reply.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Intermittent “Access Denied” in SharePoint Online, even when permissions look correct, typically occurs due to one of these causes:

1. User permissions not actually effective on the target item
   Even if the user appears to have the right role or group membership, the effective permission on a specific site, library, folder, or file may differ because of unique permissions or inheritance breaks. To verify and fix:
   1. Determine what permission level the user should have on the site (for example, Read, Edit, or Contribute).
   2. On the affected site, select Settings > Site permissions (or for OneDrive: Settings > Site Settings > Site permissions).
   3. Use Check Permissions:
      • Select Check Permissions in the ribbon.
      • Enter the user in User/Group, then select Check Now.
      • Review the permissions and any security groups that grant access.
   4. If the user does not have the expected permissions, explicitly grant access to the specific site or file as needed.
   5. If issues persist, remove the user from the site and then re‑grant permissions.
2. Account mismatch when using shared links
   A user may open a sharing link while signed in with a different account than the one the invitation was sent to. In that case, SharePoint shows errors such as:
   • “This link is not available to you. Sorry, you are currently signed in as … but that account is not on the list of people this is secured to.”
   Resolution: ensure the user signs out and reopens the link with the correct account that the sharing invitation was sent to.
3. Site user ID mismatch after account recreation or directory changes
   If a user account was deleted in the Microsoft 365 admin center and then recreated with the same UPN, or if directory synchronization moved the user to a different OU after they had already accessed SharePoint, the new account gets a different internal ID. SharePoint may then treat it as a different user and deny access even though the UPN and assigned permissions look correct. In this case, follow the guidance in the site user ID mismatch article referenced in the context to realign the user identity with SharePoint.
4. Limited-access user permission lockdown mode blocking shared folders
   When a folder is shared with a user who does not have access to the parent site or library, SharePoint uses Limited Access on parent items so the user can reach that folder. If the Limited-access user permission lockdown mode site collection feature is enabled, this mechanism can break and cause “Access Denied” or “You need permission to access this resource” when the user tries to access the shared folder. Workarounds:
   • Share individual files instead of folders, or
   • Share a whole site collection or subsite, or
   • If not required for other features, disable Limited-access user permission lockdown mode at the site collection level.
5. General access issues despite apparently correct permissions
   For tenants where multiple users experience intermittent access problems, Microsoft 365 administrators can run the Check User Access diagnostic from the Microsoft 365 admin center. This diagnostic runs a broad set of checks for both internal and guest users and can surface configuration or identity issues that are not obvious from the UI.

In practice, resolving intermittent “Access Denied” usually involves:

1. Confirming effective permissions with Check Permissions on the exact site or item.
2. Ensuring the user is signed in with the correct account for any shared links.
3. Investigating possible user ID mismatch scenarios if the account was deleted/recreated or moved in directory sync.
4. Reviewing whether Limited-access user permission lockdown mode is interfering with folder sharing.
5. Using the Check User Access diagnostic for deeper tenant-level checks.

References:

• Access Denied or You need permission errors in SharePoint Online and OneDrive
• Unable to access SharePoint Online
• "Access Denied" error when trying to access a shared folder