SharePoint Online: Managing Access Requests

When a user requires access to a site that they do not have access to, what do they do? This is where the access request feature comes into play as it provides the user the option of requesting access to the site. How will the site owner know that someone is requesting access? As the site owner, one can configure the settings so that an email is sent once someone requests access to a site. Upon receipt of this email, the site owner or the delegate(s) will have the authority to approve or decline the request. In addition to approving the request, the delegate will have the opportunity to assign a specific level of permission for the user.

The access request feature also works with the Share command for sites. If someone who does not have full control for a site (a non-site owner) uses the Share command to invite other users to view the site, then an access request email will be generated and sent to the site owner. As with the access request feature, the site owner will then be able to approve or decline the request. If the site owner is approving the request, then he will have the opportunity to assign a specific level of permission to the user.

How to Change Access Request Settings

As the site owner, you will have to decide whether you would like members of your site groups to have the ability to invite non-members to access the site contents. These features can be enabled or disabled.  If you choose to disable this option of sharing, then an error message will appear if a team member tries to Share the site as the Share option remains available on the menu.

To disable or enable sharing by team members with non-team members, follow these steps:

1. Go to Settings;
2. Choose Site Permission;
3. Click on Advanced permission settings;
4. On the Permissions tab, choose Access Request Settings;
5. The Access Request Settings dialogue box will appear. In this dialogue box, you can either select or de-select Allow members to share the site and individual files or folders.
   The checkbox for Allow members to invite others to the site members group, Team Site Members, must be selected in order to enable members to share the site. Note that this will be automatically selected or deselected depending upon the option you choose; and
6. Click OK.

How to Set Up Access Requests

How will a site owner know if a user is requesting access to the site? Managing these requests can be accomplished by configuring the access request feature to send an email to the site owner when an access request is submitted.

It is simple to set this up:

1. In Settings, choose Site Permissions;
2. Click Advanced permission settings;
3. Choose Access Request Settings located on the Permissions Tab;
4. The Access Request Settings dialogue box will appear. In this box, select the check box for Allow access requests;
5. There are two different paths here to take and is dependent upon whether you are implementing SharePoint Online or SharePoint Server 2019.
   
   For SharePoint Online, you can choose access requests sent to either members of the Admin Group, the Owners group, a specific user, or a distribution list. Remember that only members of the Admin Group or Owners group can approve or decline access requests.
   
   For SharePoint Server 2019, add an email for a specific user or for a distribution list;
6. For SharePoint Online, an optional custom message can be included to show users on the access request page; and
7. Click OK.

Approving or Declining Access Requests in SharePoint Online

To approve or decline an access request in SharePoint Online, follow these steps:

1. Click on Settings;
2. Choose Site Contents;
3. Click Access requests;
4. Find the request you want to update under Pending Requests;
5. Open the menu by clicking on the three ellipses (…);
6. If the access request is being approved, assign the permission level for the user. This can be found under Permissions. To document your decision, you have an option to write a message to the person requesting access; and
7. Depending upon your decision, click either Approve or Decline.

If you want to see past access requests, click Show History.

One advantage of SharePoint Online is the ability to manage invitations to external guests who do not have an Office 365 subscription. As an Office 365 customer using SharePoint Online, the Access Requests page provides the resources to manage guest user invitations to Office 365 non-subscribers.

Managing Invitations to External Guest for SharePoint Online

If an invitation has been sent to an external user, but you would like to withdraw it before their acceptance, then follow these steps:

1. Click on Settings;
2. Choose Site Contents;
3. Click Access requests;  
4. Find the guest you would like to uninvite;
5. Open the menu by clicking on the ellipses (…);
6. The Properties window will now open; and
7. Click Withdraw to uninvite the guest.

What happens if the guest has already accepted their invitation and you want to uninvite this guest? You will not be able to uninvite them, but you can remove them from the SharePoint permissions group that you assigned them. Another workaround is to request your Office 365 Admin or SharePoint Online Admin to remove the guest from the list of users for your environment.

Resending Invitations

All invitations sent to external users expire in 90 days. Within the 90 days, the invitation can be re-sent but the expiration date is not extended. Once the 90 days have lapsed, the invitation cannot be re-sent. A new invitation will have to be sent.

To resend an invitation, simply:

1. Choose Settings;
2. Click Site Contents;
3. Click Access requests;
4. Find the invitation that you want to resend under Guest User Invitations;
5. Open the menu by clicking on the ellipses (…);
6. Confirm the selected group is the permission group you want to add the guest to under Permission. If it is a different one than from the original invitation, then you have the opportunity to change it at this point; and
7. Click Resend.

The external invitation has now been re-sent. Managing access requests in SharePoint Online is very straightforward and puts some control in the site user’s hands while providing full control to the site owner. Though site users have the capability to invite internal and external users to collaborate on sites, the site owner continues to maintain full control of who can access the site and at what level of security they are able to access the site at. The added flexibility of Office 365 and SharePoint Online is the capability to withdraw external invitations and to resend them when needed. By combining the features of the Share command and access request features, the process of managing who has access to a site and at what permission level has been greatly simplified for the site owner.