Fix SharePoint Access Denied for Returning Employees
Question details
A returning employee cannot access a SharePoint site and receives an access denied error, despite using their original company email address.
- Product
- Microsoft SharePoint
- Device & OS
- not provided
- Scenario
- Re-onboarding an employee who left the organization and has now returned, requiring access to previously used SharePoint workspaces.
- Observed behavior
- The system denies access because SharePoint retains cached permissions and an old unique identifier (PUID) tied to the user's previous active directory account.
Ensure you have Site Owner or Site Collection Administrator privileges for the affected SharePoint site before attempting to modify advanced user permissions.
Remove and Reassign Site Collection Permissions
Clear the user's obsolete profile from the hidden People and Groups directory to force SharePoint to recognize their newly generated account identity.
When an employee leaves and returns, their email address may remain the same, but Microsoft Entra ID assigns them a new internal Unique Identifier (PUID). SharePoint often tries to authenticate using the old, cached PUID.
By manually removing the old account from the site collection's hidden user list, you allow SharePoint to generate a fresh token when you re-invite the new account.
Navigate to the affected SharePoint site, click the gear icon in the top right corner to open Settings, and select 'Site permissions'.
Scroll to the bottom of the permissions pane and click on 'Advanced permission settings'.
Click on the 'Members' group. In your web browser's address bar, locate the number at the very end of the URL (usually a '7'). Change this number to '0' and press Enter to access the master People and Groups list.
Locate and select the returning user from the list. Click the 'Actions' dropdown menu above the list and select 'Remove Users from Site Collection'.
Return to the 'Advanced permission settings' page. Click 'Grant Permissions' in the top ribbon and enter the user's current email address to send a fresh invitation.
Discover WPS Office for Seamless Team Collaboration
If you are looking for a lightweight, cost-effective alternative to complex enterprise ecosystems, WPS Office provides powerful document editing and collaboration tools without the rigid permission hurdles.
Frequently Asked Questions
Why does a returning user get an access denied error with the exact same email?
SharePoint tracks users by a unique identifier (PUID) in the backend rather than just their visible email address. When a user is recreated in your organization's directory, they are assigned a new PUID, which creates a mismatch with the old PUID still cached in the SharePoint site.
Can I clear the user from all SharePoint sites at once?
Yes, tenant administrators can use PnP PowerShell scripts to completely remove an orphaned user from the entire tenant's UserInfo lists. However, removing them per site collection via the browser is generally safer for localized access issues.
How long does it take for new permissions to apply in SharePoint?
After clearing the old profile and granting access again, permissions usually apply within a few minutes. If there are broader synchronization delays between Microsoft Entra ID and SharePoint Online, it can occasionally take up to 24 hours.
