I have been researching the AD vs SharePoint group question and have found many conflicting answers. We are beginning a SharePoint 2013 on-prem implementation for an intranet serving about 4000 users and I am trying to determine the best way to set Access Controls. Currently, we are using WSS 3.0 and the permissions are handled completely through AD by our IT department. We don't see any necessity for exposing users to other departments and will likely continue to go through IT to make permission changes. Given this information, I wasn't able to find a definitive answer for the following questions:
I read that while possible, it is not a recommended practice to assign permission directly to AD groups without invoking SharePoint groups. Why is this?
Nesting AD groups within SharePoint groups limits visibility of users that have access to a particular site. Given that we likely do not want other departments to change permissions, is there any other functionality we would lose out on by using this model?
I read that there are some collaborative tools that we will not be able to use, such as people picker, Lync presence, something about mySite, but I wasn't able to find a definitive answer. What are these tools that require adding users explicitly within SharePoint Groups?
Any help will be much appreciated.
Thanks.