Page properties permissions-> Edit Closed User Group

[neo-silicon]

Hi ,

Added some admin group to "Edit Closed User Group" In page properties permissions of specific page . Due to that that page and child pages not accessible to end user. Due to that permission CUG the page is giving 404 to end user however that page persists in publisher. I am curious this config is there long time and we use to do content update on that page, why this page breaks all of sudden. Kindly suggest

AEM env: AEM as cloud service.  

[Harwinder-singh]

@neo-silicon Is your end-user part of this admin group? if not, shouldn't this be expected?

[neo-silicon]

we dont have any CUG users for our end website

[HrishikeshKagne]

Hi @neo-silicon ,

That 404 is expected - adding a group under Edit Closed User Group (CUG) restricts access to that page and its subtree. End users outside the group will get 404, even though the page is published.

If it worked before, most likely:

• The CUG group mapping changed (users lost membership).

• Dispatcher/cache rules were masking it earlier but now enforce auth.

• Recent AEMaaCS updates made CUG enforcement stricter.

Remove or adjust the CUG config in page properties, or make sure the right groups/users are included. Best practice: use publish-side permissions / IMS groups, not legacy CUG, for external-facing pages.

[SantoshSai]

Hi @neo-silicon,

You added an admin group in Edit Closed User Group (CUG) on that page. On publish, a CUG blocks everyone not in the listed principals and (by design) returns 404 to anonymous users - even if the page is published. That’s expected behavior. 

https://experienceleague.adobe.com/en/docs/experience-manager-cloud-service/content/sites/authoring/...

The CUG entry (or group membership/replication) changed recently, so publish started enforcing it. (If the group doesn’t exist on publish, effectively no one qualifies.) Check this: https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/closed-user-group-cug-not-...

Here are options you can choose to fix:

• If it's for Public page: Remove the CUG entirely: Page Properties - Permissions - Edit Closed User Group - clear the group/disable CUG - republish & flush cache.

• If you want private areaa:  Keep the CUG but ensure only the intended restricted subtree uses it and that valid publish-side principals are assigned.

• Best practice for external sites: Prefer CDN/edge or SSO-based auth over page-level CUGs for public content; reserve CUGs for truly gated sections.