SharePoint more than 2.049 groups

Granting permissions in SharePoint sites using SharePoint groups and nested Entra ID security groups is a commonly used and recommended configuration. However, Entra ID has a limitation in this regard.

When a user receives permissions for SharePoint sites with more than 2,049 nested Entra ID groups in SharePoint groups, the assigned permissions are not applied. This results in the affected users not gaining access to any site.

The issue can be resolved by removing the involved users from Entra ID groups until the total number of nested Entra ID groups in SharePoint groups is below 2,049.

This limitation is strict, and Microsoft intends to increase it, though the timeline is not known.

In most configurations, these limits are not reached, but in environments with many SharePoint sites, this limit can be exceeded.

PortalTalk and Entra ID Groups

PortalTalk also utilizes this method for granting permissions in SharePoint sites and may encounter this limit. A fix has been developed to circumvent this situation, as follows.

The problem with the number of nested Entra ID groups in SharePoint groups can be prevented by placing the users who need permission directly into the SharePoint groups. The limits for this number of groups pose no issue, as a user can be a member of 5,000 groups per Modern SharePoint site (= classic site collection).

Solution in PortalTalk

PortalTalk has been modified in release 2.4.3 to support configurations that exceed the 2,049 group limit, essentially allowing users to be members of more than 2,049 sites.

In the central configuration of PortalTalk (PortalTalk Admin Portal), there is an option to activate this setting for each customer. This setting can only be adjusted by QS solutions, as the PortalTalk Admin portal is not accessible to customers.

This modification entails:

• In PortalTalk, no SharePoint groups with nested Entra ID groups are created for the SharePoint team site (site collection) and team sub-sites.

• SharePoint groups are still created, but the users assigned for the issued permission are directly added to the SharePoint group.

• If this setting is enabled for a specific customer, existing sites with SharePoint and nested Entra ID groups will also be adjusted. Users from Entra ID groups will be directly added to the SharePoint group.

This setting is one-time and cannot be reversed.