SharePoint Audience Targeting in 2026: What to Target, How to Test It, and What It Won’t Secure

The problem we are solving

If you have ever targeted an intranet news post to one department and then been asked, “Does that mean nobody else can open it?”, you know where this gets awkward.

Audience targeting changes what SharePoint promotes or shows to different groups. It does not change who is allowed to open the underlying page, file or destination.

That distinction matters. Targeting is useful for reducing noise: HR can see HR news, managers can see manager links, and one region can see its local events. It is the wrong control for confidential content.

The safest approach is to start with one low-risk communication site, use an existing Microsoft Entra ID group with a named owner, and test the result with real member and non-member accounts before using the pattern more widely.

The short answer

Use audience targeting when all three statements are true:

1. The content is safe for everyone who already has permission to the site or item.
2. A supported SharePoint surface can promote it to a more relevant group.
3. Someone owns the audience group and will keep its membership accurate.

Use permissions, sensitivity controls or a separate restricted site when access itself must be limited.

Do not let a hidden navigation link become your security plan. A person who has permission may still reach targeted content through search or a direct link.

What SharePoint supports now

Microsoft’s current guidance lists these modern audience-targeting surfaces:

The current Microsoft audience-targeting guidance does not list the Hero web part. Do not design a rollout that depends on targeting Hero tiles unless Microsoft adds documented support and you confirm it in your tenant.

Choose the audience group before you configure the page

Modern audience targeting uses Microsoft Entra ID groups—the current name for Azure Active Directory groups. Microsoft’s guidance supports Microsoft 365 groups and security groups. It also mentions dynamic groups, but Microsoft’s navigation guidance is more cautious about their support.

For a predictable first rollout:

• Use a Microsoft 365 group when the audience already matches an owned team, department or project group.
• Use a security group when IT needs an admin-managed audience without creating the other collaboration resources that come with a Microsoft 365 group.
• Treat a dynamic group as a tenant-specific option. Confirm that it resolves in the exact SharePoint control you plan to use before depending on it.
• Do not assume a SharePoint site group such as Visitors or Members will appear in the modern audience picker.

Record the group’s owner as well as its name. “HR audience” is not maintainable if nobody knows who approves membership changes.

Decide whether this is targeting or security

Use this quick test before touching SharePoint:

The sentence to use with a content owner is:

Run one safe pilot

Pick one low-risk use case, such as regional news or a department-specific navigation link. Avoid policy documents, employee cases, financial information or anything else where accidental discovery would matter.

1. Write the expected result

Create a small targeting record before you configure anything:

This record is more useful than a screenshot of a toggle. It tells the next admin what was intended and who owns each moving part.

2. Check access separately

Open the page, file or destination and confirm its real permissions. Decide whether a non-member who receives the direct URL should be allowed to open it.

If the answer is no, stop here. Audience targeting cannot solve that requirement.

3. Enable the correct SharePoint surface

For a page or news post:

1. Open Settings > Site contents > Site Pages.
2. Open the library settings and select Audience targeting settings.
3. Enable audience targeting.
4. Select the page or news post, open Details, and set the Audience property.
5. Publish or republish the item.
6. Edit the page containing the News or Highlighted Content web part and enable audience targeting in that web part too.
7. Republish the containing page.

For navigation:

1. Edit the communication-site or hub navigation.
2. Turn on Enable site navigation audience targeting and save.
3. Edit the link and add the required Microsoft 365 or security group.
4. Save the navigation.

For Quick Links or Events, enable audience targeting on the relevant web part and set the audience on the individual link or event. Confirm the underlying link destination or event permissions separately.

4. Test as people, not just as the editor

Use at least three checks:

• A member of the target group sees the promoted item.
• A non-member does not see the promoted item in the targeted surface.
• A non-member’s direct-link result matches the permissions decision you recorded earlier.

If one person belongs to several target groups, include that overlap in the test. It is an easy way to discover that a supposedly clean audience design is not clean at all.

SharePoint Pages and News Preview mode is useful for checking desktop, mobile and eligible email layouts. It is not documented as an audience-impersonation tool. Do not use it as proof that targeting works for a particular group.

5. Allow for group changes

Microsoft warns that a newly created or recently changed audience group may take time to apply. Microsoft does not publish a precise timing promise in the audience-targeting guidance.

If a test fails immediately after a membership change:

1. Confirm the correct group and item were selected.
2. Confirm the item and containing page were republished.
3. Confirm targeting is enabled on both the source and the displaying web part where required.
4. Wait and retest before rebuilding the configuration.
5. Record when the group changed and when the result became visible.

Troubleshoot the failures that matter

Keep the rollout maintainable

Before you call the pilot complete, save:

• the targeting record
• the exact group used and its owner
• the content owner
• member and non-member test results
• confirmation that direct-link access is acceptable
• the date of the last membership check
• the next review date
• a rollback note explaining how to remove the audience or turn targeting off

Review targeting when departments reorganise, group ownership changes or content moves between sites. A perfect configuration can become misleading when the group behind it goes stale.

Why this is a 2026 update

This article replaces the build instructions from the original Collab365 workshop, Targeting Your Audience in SharePoint Communication Sites.

The workshop remains useful background for the communication problem and the original SharePoint approach. You do not need to watch it to use this article. The supported modern surfaces, group behaviour and current interface guidance above have been checked afresh against Microsoft documentation.

Evidence notes

Use Microsoft’s documentation to trust what the SharePoint controls are designed to do. Do not treat documentation as proof that your tenant, groups or permissions are correct.

• Microsoft documents audience targeting as a way to prioritise or promote relevant content through supported surfaces. It does not turn targeting into a security boundary.
• Microsoft documents Microsoft 365 groups, security groups and some dynamic-group support. Because its navigation pages describe dynamic-group support differently, verify dynamic groups in the exact control and tenant before rollout.
• Microsoft documents publication or republication as necessary for targeting changes to take effect.
• Microsoft warns that recently created or changed groups may take time to apply, but it does not provide a precise service-level timing promise.
• Microsoft’s current supported-web-part list does not include Hero.
• SharePoint Pages and News Preview mode documents device and email layouts, not impersonation of a selected audience.
• Microsoft’s pages may change gradually across tenants. If a label or control differs, verify the behaviour in a low-risk pilot rather than forcing an outdated click path.

This evidence proves the current documented mechanism. Your pilot proves whether the chosen groups, permissions and publishing process work in your tenant.