Brijesh's Blog

July 31, 2008

AD Groups and SharePoint Groups

Filed under: Uncategorized — brij28 @ 6:48 pm

Choosing between AD Groups and SharePoint Groups. What is the best approach for assigning permission levels in SharePoint?

Here are some guidelines:

A general rule of thumb is the less security principals you have, the more scalable your security design will be.  In other words, it is easier to assign permission levels to 1 group than 100 users.

Avoid assigning permission levels directly to user accounts—use either an Active Directory (AD) group or a SharePoint group to contain the users.  If there is a one-to-one mapping between an AD group and a SharePoint permission level, you could assign permissions to the AD Group rather than creating a SharePoint group, but if you always use a SharePoint group, you have a clean way to add more users/groups later if you need to.

Use SharePoint groups over AD security groups.   You can delegate control of SharePoint groups to site administrators.  If you use AD groups, there could be a bottleneck getting users added/removed from them since only a select few in the organization have permissions.  Another issue with AD groups is you cannot view the members in SharePoint, making it difficult to determine who has access to what.

Difference between SharePoint Groups and AD Groups:

Domain Groups

  •       Normally created and maintained by the IT department
  •       Can be used across different SharePoint sites and site collections
  •       Organizations may already have good AD group structures that map well to your SharePoint implementation
  •       Groups can be nested – e.g. you can add another AD Group as a member to an existing AD group
  •       No features for users to submit a request to join a group

SharePoint Groups

  •       The creation of groups can be done by business users
  •       When a group is being created, you can define who "owns" the group
  •       Can allow users to submit a request to join a group
  •       Can determine who has permissions to see the users within groups
  •       Groups are created within a particular Site Collection – cannot be used in other site collections
  •       You cannot add a SharePoint Group as a member of another SharePoint group (no nesting)
  •       SharePoint Groups cannot be used in other systems (e.g. network Shares)
  •       The SharePoint Groups are separate from Active Directory – so you can go wild with the SharePoint Groups without upsetting your AD administrator



Leave a Comment »

No comments yet.

RSS feed for comments on this post. TrackBack URI

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Blog at

%d bloggers like this: