1

The organization that I work for has about 2400 employees who we will want to allow access to a site collection. However, only about 150 of those will have Office 365 licenses.

We would like to set this up using our AD Security Groups, but not sure if this is possible considering each non-licensed user would have to create some sort of microsoft account to login.

Has anyone dealt with a situation similar to this with a large organization, and how did you automate the process to add and remove users as needed.

Improve this question
2
  • How do you do that? we have added yesterday our security groups OU to be synced and they're all in the office 365 portal now. how do we add a specific AD-SEC-group as owner for a SP web site?
    – Thiago Beier
    Commented Jun 27, 2017 at 15:20
  • If the AD groups are listed in Office 365, you should be able to add them to your specific SharePoint site by going to the Permissions tab under Site Settings. You can remove the parental inheritance and use unique permissions for your site if you need permissions different than your parent site. Add the group into a default group or simply add and grant their unique permissions directly. Hope this helps.
    – cbbrown
    Commented Jun 27, 2017 at 17:58

1 Answer 1

Reset to default
2

AD Security groups can be synced to Office 365 and used in permissioning SharePoint sites. We do it all over the place. To handle changes, you have to update your on prem groups, allow them to replicate through out your domain and the changes will be synced up the next time Azure AD Connect runs.

Our IT Security team handles the management of these groups through service requests that are submitted.

If the users don't have licenses, they won't have access however. If they somehow do have access without licenses, you'd most likely be in violation of licensing terms, but you'd want to speak with your Microsoft TAM about this.

Improve this answer
2
  • Do you have any specifics on how to configure the groups to be sync'd with Azure AD Connect? We have our currently licensed AD users sync'd but I'm being told that syncing groups is not possible and I haven't been able to find any information on how to proceed with this without having to sync all AD users and manually create Office 365 Groups. Our ultimate goal being able to run all groups from one source, (Active Directory).
    – cbbrown
    Commented Oct 12, 2016 at 19:46
  • 1
    You have to make sure they aren't filtered out in your AADC rules and need to have a mail address, I believe that is enough (I don't manage this so it is all second hand info)
    – Eric Alexander
    Commented Oct 12, 2016 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.