0

I just came out of a session on SharePoint permissions management, and one of the topics was on the use of SharePoint groups vs. AD groups; apparently there have been issues where, when a user is a member of >100 AD groups, SharePoint can fail to recognize their membership and thus not grant access. So we've been instructed to delete any AD groups that are no longer being used in any site, and to create SharePoint groups for any new security requirements in the future, except where one group will be used in multiple site collections.
In that session, when reviewing the process to create a SharePoint group, it was stressed that "Who can view the membership of this group?" should always be set to Everyone.

This is a practice I personally agree with, but based on other questions I've seen on this site, and elsewhere on the Web, it appears that many hold the opposite opinion, that the identities of group members should generally be kept secret from some or all users.

My question is, why would I want to restrict this information? What risk is there in Joe Blow knowing who my Site Owners or my Leadership Team are?

Improve this question

2 Answers 2

Reset to default
1

What risk is there in Joe Blow knowing who my Site Owners or my Leadership Team are?

Don't know about the risk, but I know that if "Who can view the membership of this group?" will not be Everyone - there would be problems with SP Designer Workflows(if it verifies if User is assigned to group).

Improve this answer
2
  • While this is good information, it's not really an answer to my question, because it's information that supports my own view. I'm looking for information that opposes my own view - I'm trying to understand any practical benefit of setting it to "members only".
    – Dan Henderson
    Oct 2, 2015 at 17:31
  • Data isolation. By example we have SP portal for external users, where there is data owned by different companies. These companies are competitors in their market area, it is not necessary for them to know each other. Sorry, english is not native.
    – Gennady G
    Oct 3, 2015 at 7:15
0

Your Site Collection administrator will be able to see everything.

Other than that, do you really want your employees/users to know who has access to what? Since your transitioning from AD groups, would you really want users to be able to poke around AD groups to view who is part of what, even if they aren't part of the group? That may be your answer.

Depends on security policies. For small companies it could be convenient to know if John Doe is part of the admin group. For larger companies, maybe it shouldn't be so transparent.

Seems more like an organizational decision rather than a technical decision.

Here's a little more information: What does setting "Who can view the membership of the group" to everyone do when creating groups

Improve this answer
4
  • As it happens, it's a very large company, and all AD groups' memberships are available to anyone.
    – Dan Henderson
    Sep 25, 2015 at 21:35
  • @DanHenderson if that is the case, then it might be good to replicate that behavior. Worst case scenario, you have to change it from "Everyone" to "Only Members of this Group" in the future, which could probably be done via PowerShell.
    – contactmatt
    Sep 25, 2015 at 21:46
  • Right. As I said, I agree with the directive personally. I'm just trying to understand the other viewpoint, because right now I can't see any potential downside.
    – Dan Henderson
    Sep 25, 2015 at 22:01
  • would you really want users to be able to... view who is part of what...? Why wouldn't I? For larger companies, maybe it shouldn't be so transparent. Why not? That's what I'm trying to ask: Why would someone want to conceal this information?
    – Dan Henderson
    Oct 2, 2015 at 17:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.