SharePoint and OneDrive have a handful of "you can't get in" pages that look alike but have very different causes: the wrong account, a guest who redeemed with another address, missing or broken permissions, or a policy that blocks the network or device. In this post I'll map each message to its cause, show the checks that prove which one you have, and fix it without handing out more access than needed.
Errors this guide fixes
You need permission to access this siteSharePoint or OneDrive in the browserThis link is not available to youSharing link in the browserWe're sorry, but <user> can't be found in the <tenant>.sharepoint.com directorySharePoint or OneDrive in the browserUser not found in the directorySharePoint or OneDrive in the browserDue to organizational policies, you can't access this resource from this network locationSharePoint or OneDrive in the browserDue to organizational policies, you can't access this resource from this untrusted deviceSharePoint or OneDrive in the browserYour organization policies do not allow you to share with these usersShare dialogYou can't share this item because too many items in the folderShare dialog
Symptoms#
Users opening a site, file or link see one of these:
Access Denied,You need permission to access this site,You can't access this item,You don't have permission to access this itemorYou don't have access to this file.- On a shared link:
This link is not available to you. Sorry, you are currently signed in as <account> but that account is not on the list of people this is secured to. - Guests:
User not found in the directory, orWe're sorry, but <user> can't be found in the <tenant>.sharepoint.com directory. - A policy page:
Due to organizational policies, you can't access this resource from this network locationorDue to organizational policies, you can't access this resource from this untrusted device.
People sharing content can also hit Your organization policies do not allow you to share with these users or You can't share this item because too many items in the folder.
Why it happens#
| Message | Usual cause |
|---|---|
| Access Denied, You need permission, You can't access this item | The account has no permission on the site, library, folder or file (often after inheritance was broken), or a site user ID mismatch: the account was deleted and re-created with the same UPN |
| This link is not available to you | The link was shared with specific people and the user is signed in with a different account |
| User not found in the directory / can't be found in the directory | A guest signed in with, or accepted the invitation with, a different account from the one invited |
| ... from this network location | The SharePoint network location (IP address) policy |
| ... from this untrusted device | The unmanaged devices policy |
| Due to organizational policies, you can't access this resource (no ending) | Information barriers |
| Your organization policies do not allow you to share with these users | Your external sharing settings (organization or site level, or a domain allow or block list) don't allow sharing with this recipient |
| Too many items in the folder | Sharing a folder is limited to 50,000 items inside it, including subfolders |
A Conditional Access block looks different again: the user sees a Microsoft Entra sign-in error such as AADSTS53003 before SharePoint loads (see AADSTS53000 vs AADSTS53003).
How to fix it#
1. Get the exact message and account#
Ask for a screenshot that includes the technical details at the bottom of the page (correlation ID, date and time) and the account shown as signed in. Then have the user open the link in a private browser window and sign in with the address the content was shared with. If that works, the problem was a cached personal or second work account, not permissions.
2. Check the permissions#
On the site, go to Settings › Site permissions › Advanced permissions settings, select Check Permissions, enter the user and select Check Now. The result shows each permission level and where it comes from (directly or through a group). For a library, folder or file, use Manage access. If the item has unique permissions, either grant access there or restore inheritance with Delete unique permissions, after checking who would gain or lose access. For a link shared with specific people that the user can't open, re-share it to the account they actually use.
3. Fix a guest who redeemed with the wrong account#
Find the guest object in the Microsoft Entra admin center and compare its email with the address the owner shared to. If they differ, or errors continue, Microsoft's guidance is to remove the guest completely, remove them from the site, then share again so they redeem with the right account:
Connect-SPOService -Url https://contoso-admin.sharepoint.com
$site = 'https://contoso.sharepoint.com/sites/Projects'
Get-SPOUser -Site $site | Where-Object LoginName -like '*#ext#*' # guests on the site
Remove-SPOUser -Site $site -LoginName 'jon_fabrikam.com#ext#@contoso.onmicrosoft.com'Remove the guest user in the Microsoft 365 admin center (Users › Guest users) or the Microsoft Entra admin center as well, then re-share. If the guest fails earlier, at sign-in, see B2B guest redemption errors and check cross-tenant access settings.
4. Fix a site user ID mismatch#
If an internal user was deleted and a new account created with the same UPN, sites still hold the old identity. Remove the user from each affected site with Remove-SPOUser and grant access again. If the user can't open their own OneDrive, check whether a new account replaced the original one; Microsoft's fix is to delete the new account and restore the original, or use its automated site user ID mismatch fix.
5. Check the access policies#
- Network location: in the SharePoint admin center, Policies › Access control › Network location, confirm the allowed IP ranges include the user's public address (
Get-SPOTenantshowsIPAddressEnforcementandIPAddressAllowList). Admins who locked themselves out can run Microsoft's "Access Denied due to Network Location" diagnostic in the Microsoft 365 admin center, which can turn the policy off. - Unmanaged devices: Policies › Access control › Unmanaged devices decides whether non-compliant or unjoined devices get full, limited web-only or no access. Fix the device's join or compliance state, or adjust the policy.
- Information barriers: check the barrier policies that apply to the user and the site.
6. Fix sharing dialog errors#
For "Your organization policies do not allow you to share with these users", compare the organization and site sharing levels and any domain allow or block list with the recipient's domain; the layers are explained in SharePoint and OneDrive external sharing explained. For "too many items in the folder", share a smaller folder or individual files instead.
Verify the fix#
- The user opens the original link in a private window, signed in with the intended account, without an error.
- Check Permissions shows the expected permission level for the user, granted where you intended.
- For guests,
Get-SPOUserlists a single entry for the person, matching the invited address. - For policy blocks, the Microsoft Entra sign-in log for SharePoint Online shows success from the user's device and location.
Prevent it next time#
- Grant access through groups and avoid breaking inheritance on individual items. Libraries support up to 50,000 items with unique permissions, but Microsoft's recommended general limit is 5,000.
- Tell guests to open invitations with the exact address they were invited with.
- Restore deleted accounts instead of re-creating them with the same UPN.
- Pilot network location and unmanaged device policies, and add your admin networks before you enforce them.
