What Is Limited Access in SharePoint? (And Why Users Get It)

You open a site’s permissions page and find people listed with Limited Access, even though nobody ever added them to the site. It looks like a leak, and it’s one of the most common questions I get from site owners.

In this tutorial, I’ll explain limited access sharepoint entries using a real test on our SPGuides site: why they appear, how to see them, what they allow, and how to clean them up.

Here’s the short answer. Limited Access is a permission level SharePoint assigns on its own. It isn’t something you grant, and it doesn’t let anyone open other content.

This is how someone ends up with it:

1. Someone shares a file, folder or list item with a person who has no access to the site.
2. SharePoint stops inheritance on that one item and gives the person a real permission there, such as Read.
3. SharePoint then adds Limited Access on the parent library and site, so the person can reach that item, and nothing else.

You can see the result for any user with Check Permissions. For a person who only got one shared file, it returns this:

Permission levels given to Miller
Limited Access    Given directly

What does Limited Access mean in SharePoint?

Microsoft describes Limited Access as the level that lets a user browse to a site page or library to reach one specific item, when they can’t open anything else there. SharePoint uses it to render the page and show the user where they are.

It’s a side effect of breaking permission inheritance on something below the site. The real permission lives on the item; Limited Access is only the path to it.

So when you see a stranger with Limited Access on your site, the right question isn’t “who added them?” It’s “what was shared with them?”

Why does a user have Limited Access? A real example

I tested this on 10/25/2026. Miller, a Power Platform Engineer, isn’t a member of the SPGuides site. I gave him Read on one file, Website-Redesign-Brief-2026.txt, in the SPGuides Projects library under Clients > 2026 > Website Redesign.

I set the permission with PnP PowerShell, but sharing the file from the Share dialog does the same thing. If you need the same folder path for a test, here’s how to create the nested folders with PowerShell.

The file’s own permissions page now says it has unique permissions, with Miller on Read next to the site’s groups:

The library itself still inherits from the site. Only that one file broke inheritance, which is exactly the case Limited Access exists for.

How to see limited access users on a site

Go to Settings > Site permissions > Advanced permissions settings. That’s the classic page I use in checking site permissions in SharePoint Online, and by default it hides limited-access users.

After the share, a yellow banner appeared at the top: There are limited access users on this site, with a Show users link:

The list under the banner still showed only SPGuides Members, Owners, Visitors and a Test Group. Selecting Show users added the hidden entries:

Miller now appears with Limited Access. So do I and the SPGuides Owners group (Full Control, Limited Access), most likely because other items on this site already had unique permissions.

There’s also a Limited Access System Group For Web group with a GUID in its name. I’ll come back to that one below.

Check a user’s permissions to confirm it

To confirm what a person really has at site level, select Check Permissions on the same ribbon and enter the user’s name. For Miller, the result was:

Limited Access – Given directly. No group membership, no Read on the site. That’s the fingerprint of an item-level share, not a site invitation.

If people keep asking for access after a share like this, look at your SharePoint access request settings so the requests reach the right owner.

Why isn’t Limited Access in Permission Levels?

Open Permission Levels from the same ribbon and you won’t find it. On our site, the page lists only Full Control, Design, Edit, Contribute and Read:

That’s by design. Microsoft says you can’t assign Limited Access directly, and it’s one of two levels, with Full Control, that you can’t change. You can’t edit it, copy it, or give it to a group by hand.

By default it includes only a handful of permissions:

Permission	Default	Lockdown mode on
Open	Yes	Yes
Browse User Information	Yes	Yes
Use Client Integration Features	Yes	Yes
Use Remote Interfaces	Yes	No
View Application Pages	Yes	No

None of these let a user view, add or edit list items or documents. Microsoft is clear that Limited Access grants no additional permissions, so the person can’t see other content.

Web-Only Limited Access and the Limited Access System Group

Microsoft defines Web-Only Limited Access as a variant of Limited Access that gives access to the web object (the site) only.

In our test, SharePoint created a group named Limited Access System Group For Web plus a GUID, and gave it Web-Only Limited Access on the site.

It’s system-managed, so leave it alone instead of renaming or deleting it. If you list site members with PowerShell, expect it in the output.

What is limited-access user permission lockdown mode?

Lockdown mode is a site collection feature that trims the Limited Access level. With it on, limited-access users lose View Application Pages and Use Remote Interfaces, as the table above shows.

You’ll find it under Site settings > Site collection features. On our site it’s present but not active:

We left it off. Microsoft turns it on by default for publishing sites and recommends it when you need tighter security, because with it off, limited-access users (such as anonymous users) can reach certain areas of the site.

How to remove Limited Access in SharePoint

You don’t remove Limited Access directly; you remove the reason for it. Find the item that was shared, then pick the fix that matches what you want:

• The person shouldn’t have the item anymore: open the item’s permissions, select the user, and choose Remove User Permissions (or stop sharing the link).
• The item should match its library again: choose Delete unique permissions on the item to restore inheritance.
• The person needs the whole site: add them to the Members or Visitors group instead of sharing item by item.

One catch: Microsoft notes that after you unshare the item, the user can keep the Limited Access entry. It still doesn’t let them open anything. For guests, setting guest access to expire keeps these leftovers from piling up.

To find which items carry unique permissions, use the Show these items link on the site permissions page, or run a folder permissions report with PnP PowerShell.

Find Limited Access users with PnP PowerShell

On a site with hundreds of shares, clicking through pages gets old. This read-only script lists every site role assignment that includes Limited Access. It needs your own Entra app ID; see connecting to SharePoint Online with PowerShell if you don’t have one yet:

Connect-PnPOnline -Url "https://spguides.sharepoint.com/sites/SPGuides" -ClientId "<your-app-client-id>" -DeviceLogin -PersistLogin

# Read-only: lists the site's role assignments that include Limited Access
$web = Get-PnPWeb -Includes RoleAssignments
foreach ($ra in $web.RoleAssignments) {
    Get-PnPProperty -ClientObject $ra -Property Member, RoleDefinitionBindings | Out-Null
    $levels = ($ra.RoleDefinitionBindings | ForEach-Object Name) -join ", "
    if ($levels -match "Limited Access") {
        [pscustomobject]@{ Name = $ra.Member.Title; Type = $ra.Member.PrincipalType; Levels = $levels }
    }
}

I ran it in PowerShell 7 with PnP.PowerShell 3.3.0. It returned the same four entries the browser showed: SPGuides Owners, me, the Limited Access System Group (Web-Only Limited Access) and Miller:

It changes nothing, so it’s safe on a production site. More audit scripts like it are in my PnP PowerShell scripts for SharePoint collection, and the SharePoint tutorials hub covers the rest of the permissions basics.

If you’re cleaning up permissions on a site, these tutorials help with the next step:

• SharePoint Site Owner [Complete Tutorial]
• How to Get the SharePoint Site Owner Using PowerShell (Group and Non-Group Sites)
• How to Share SharePoint Site with External Users?
• Remove User From SharePoint Group Using Power Automate

Frequently Asked Questions