Permission & Access Issues

How to Add an Azure AD Group to a SharePoint List with CSOM

Amos Gikunda Oct 14, 2026 869 views

Question details

The user needs to programmatically assign permissions to an Azure Active Directory (Microsoft Entra ID) group for a specific SharePoint list using the Client-Side Object Model (CSOM).

How to Add an Azure AD Group to a SharePoint List with CSOM

Product: SharePoint
Device & OS: not provided
Scenario: Automating role assignments and granting specific permissions (like Read access) to a domain group on a SharePoint list.
Observed behavior: The user needs the correct method to resolve the Azure AD group as a recognized SharePoint principal so it can be added to the list's RoleAssignments collection, and requires guidance on missing CSOM methods like GetItemByEffectiveUserName.

Before you start

Ensure you have the latest Microsoft.SharePoint.Client (CSOM) library installed and possess the necessary site collection administrator permissions to modify list role assignments.

Solution 1Recommended

Resolve the Group as a Principal and Add to Role Assignments

Use SharePoint's principal-resolution APIs to identify the Azure AD group and grant it the desired permission level on the list.

Before assigning roles, SharePoint must recognize the Azure Active Directory (Microsoft Entra ID) group. This requires resolving the group's name or login name to a valid SharePoint principal.

Once resolved, you can define the permission level (e.g., Read) and apply it to the list's RoleAssignments collection.

Check CSOM Library Compatibility

Verify that your current CSOM DLLs support the required principal resolution methods. If methods like GetItemByEffectiveUserName are missing, update your CSOM NuGet packages to the latest version.

Resolve the Azure AD Group

Use SiteUserInfoList.GetItemByEffectiveUserName (or a supported login-name resolution alternative) with the group's name and tenant name to locate and load the group as a valid SharePoint principal.

Define the Role Assignment

Retrieve the target permission level (such as the 'Read' role) from the site's RoleDefinitions collection to create a RoleDefinitionBindingCollection.

Update the List RoleAssignments

Add the loaded principal and the role bindings to the target SharePoint list's RoleAssignments collection. Finally, call ExecuteQuery on your ClientContext to apply the changes.

Resolve the Group as a Principal and Add to Role Assignments

Principal Resolution Fallbacks: If SiteUserInfoList.GetItemByEffectiveUserName is unavailable in your environment, use Web.EnsureUser with the correct group login name format (claims prefix) to resolve the principal.

Free Microsoft Office alternative

Looking for a Lightweight Alternative for Daily Office Tasks?

While SharePoint and CSOM handle complex backend data and permission management, WPS Office provides a free, lightweight, and highly compatible suite for managing your everyday documents, spreadsheets, and presentations without the heavy overhead.

Completely free and lightweight office suiteFully compatible with Microsoft Word, Excel, and PowerPoint formatsFamiliar tabbed interface for seamless migration and productivityBuilt-in PDF editing and format conversion tools

microsoft office alternative - wps office

Frequently Asked Questions

Why can I not find the GetItemByEffectiveUserName function in my project?

This method may not be available in older versions of the SharePoint Client-Side Object Model (CSOM) DLLs. Updating to the latest version of the Microsoft.SharePoint.Client package via NuGet usually resolves this issue.

Do I need to add the Azure AD group to a SharePoint group first?

No, you can assign permissions directly to an Azure AD group by resolving it as a principal and adding it straight to the list's RoleAssignments collection. However, grouping them within native SharePoint groups is often recommended as a best practice for easier long-term management.

How do I resolve a group if I only have its Object ID?

In SharePoint Online, Azure AD groups are often resolved using their claims-based login name, which incorporates the tenant ID and the group's Object ID (e.g., c:0t.c|tenant|objectid). Using Web.EnsureUser with this specifically formatted login string will add the group to the site principal list.

Document & File Issues