I am using sharepoint 2013. I have 1 webapplication and 2 site collections. I would like to give an AD group contributor permissions to one of these 2 site collections. What is the best practice to implement this? I dont want to add all the users manual to the sharepoint permisions. Can I add this AD group to the permissions and give it contributor permissions?


You can add AD group to your site collection and assign whatever permission you want.

Best practice is depend upon your number of users in AD group. Some time it is useful to adding the AD users into SharePoint groups, and some time adding user directly into the SharePoint groups.

Pros of AD Group:

  • Managed by IT
  • May contain multiple groups (nested)
  • Great for large groups


  • Can’t see users
  • Can’t use with Person/Group column
  • Sometimes not kept up to date

check this link for more Pros & Cons of this:



  • thank you for the answer. what do you mean with "Can’t use with Person/Group column" ? Do you mean the status icon color? – Ola Aug 14 '14 at 13:16
  • SharePoint can’t open AD Groups. When using a Person/Group column, under Additional Column Settings we can allow people to select from all users or only users in a selected Group – Waqas Sarwar MVP Aug 14 '14 at 13:44

You can add AD groups to site collections with contributor permission. Concerning best practice, it comes down to how the security is controlled in your organization.

Maintaining users AD group is done by the AD administrator where as maintaining users inside groups in SharePoint is maintained by the sharepoint administrator. Your choice of using AD Groups with contributor permissions removes the overhead from the sharepoint admin and puts it to the AD admin for the maintenance of users.

If you create a SharePoint group and give that a contributor permission to your sites, the maintenance overhead will lie with the SharePoint admin.


A caveat to the answers provided, note that the AD group must be a security group and not a distribution list.

Also I prefer to have them be email enabled security groups so they can be viewed and managed in Outlook easily by the group owner(s).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.