Fix: “Your sign-in was successful but you don’t have permission to access this resource” in SharePoint / FYIDocs

An accounting firm reached out to us because their clients kept getting locked out of shared folders in SharePoint. The firm uses FYIDocs Collaborate to share documents securely with external clients, but every time a client clicked the link, they were met with a permission error, even though they had signed in successfully. Multiple browsers and devices made no difference. After digging into the Microsoft Entra ID configuration, we found a Conditional Access policy was quietly blocking all guest users. Here is what happened and how we fixed it.

Symptoms

• An external user clicks a SharePoint shared folder link (e.g., a FYIDocs Collaborate upload folder) and sees the error: “You cannot access this right now” with the message “Your sign-in was successful but does not meet the criteria to access this resource”
• The user has tried multiple browsers and different computers with the same result
• When creating a new shared folder for a client in FYIDocs, the process fails at the “grant access” step with: “FYI-2222: There was an error adding [email address] to Collaborate”
• Other users within the organisation can access SharePoint normally

Cause

This error occurs when a Conditional Access (CA) policy in Microsoft Entra ID is configured to block sign-ins from untrusted locations or countries, and the policy does not exclude guest or external users.

FYIDocs Collaborate works by sharing SharePoint folders with external users (guest accounts). When a guest user signs in to access the shared folder, the CA policy evaluates their sign-in. If the policy blocks sign-ins from certain countries or untrusted locations and applies to all users including guests, the guest user’s access is denied even though their authentication was successful.

This issue can also prevent FYIDocs from granting access when creating new shared folders, because the cross-tenant access settings block the guest invitation process.

Resolution

Exclude Guest Users from the Location-Based CA Policy

1. Sign in to the Microsoft Entra admin centre at entra.microsoft.com
2. Navigate to Protection → Conditional Access → Policies
3. Identify the policy that restricts sign-ins based on location (e.g., an “untrusted countries” or “block by location” policy)
4. Open the policy and go to the Users section
5. Under Exclude, add an exclusion for Guest or external users. You can:
   • Exclude all guest users from the policy using the built-in “Guest or external users” option, or
   • Create a security group for guest users and exclude that group from the policy
6. Click Save to apply the changes

Check Cross-Tenant Access Settings (If Folder Creation Also Fails)

1. In the Entra admin centre, go to External Identities → Cross-tenant access settings
2. Ensure inbound access is configured correctly for the domains your external users sign in from

Verify the Fix

1. Ask the affected external user to try accessing the SharePoint shared folder link again
2. Test creating a new FYIDocs Collaborate folder to confirm the “grant access” step completes successfully

Important Notes

• Excluding guest users from location-based CA policies is generally safe, as these users already authenticate through their own identity provider. However, review your organisation’s security requirements before making changes.
• If you only want to exclude specific external domains rather than all guests, consider using cross-tenant access settings to allow inbound access from trusted organisations.
• Changes to Conditional Access policies may take a few minutes to propagate.

Related Resources

• Microsoft Excel cannot access the file on SharePoint
• FYI Support: Error “Your sign-in was successful but you don’t have permission” when accessing a document on New Collaborate
• FYI Support: Error FYI-2222 “There was an error adding email address to Collaborate”

If you need help resolving SharePoint permission issues or configuring Conditional Access policies, get in touch with our team.