0

I am a bit confused on how sharepoint 2013 server works with active directory Security Groups & distribution lists. now i am not expert in exchnage and active directory,, so my question is from the eyes of a sharepoint developer.

now i have created a test team site inside SP 2013, and inside the built-in SP "Members" groups i tried working with AD groups, in the following 3 approaches:-

Approach A

  1. we have an AD group named "our staff" with email address as follow "[email protected]". and this group have all our employees as members.

  2. now when i add this AD group inside the SP group "Members" group, i got the following:-

  3. all members of this group, will be granted access to the SP site. so when i check individual users permission (site setting>>site permission>>check permission), i can see that they became of the "members" group, through the AD group.

  4. when i chose to send an email to the "Members" group inside my workflow 2010 "send email" activity . the email will be sent to [email protected] and hence to all our employees. which is great.

Approach B

  1. we have a couple of security groups named for example "domainname\sg-managers".
  2. now when i add this group to our "Members" SP group.
  3. then members of this security group will be granted access (same as in appraoch A).
  4. but if i chose to send an email to the "Members" group. then the domain\sg-managers will not get any email.
  5. when i click on this group inside the SP group i noticed that there is not any email assigned to it

enter image description here

Approach C

finally we have some groups which is similar to "Our staff" group in which they have emails and members, but when i try to search for them inside the sharepoint Share dialog, i got this error

Sorry, you are not allowed to share this with external users.

enter image description here

so now i am trying to figure out what are the differences from sharepoint preservative between these 3 approaches.. now i think the first appraoch is the one i need to follow, as i am able to send email to all members + i can grant perms ion to all the group members. so can anyone adivce on how SharePoint is dealing with these different approaches? and why appraoch B & C did not work as expected?

Improve this question
5
  • 2
    A is the best, a mail enabled security group. B is a security group and it is the next best. C will never work because distribution lists have never been supported in SharePoint.
    – Eric Alexander
    Jan 19, 2017 at 3:46
  • @EricAlexander Ok thanks a lot for the info. First question, so when dealing with Active Directory groups inside SharePoint, the AD admins need to create a "mail enabled security group", otherwise sharepoint will not fully support the integration with "non-Mail enabled security groups"... is this correct ? second question, how did you realize that appraoch C is mainly a distribution list?, as to me Approach A & Approach C are both the same when i access the groups from my outlook, where in both cases the group contain members + group have email address,,
    – John John
    Jan 19, 2017 at 12:44
  • @EricAlexander .. but the from SP perspectives it can understand the group in appraoch A but not the group in approach C?
    – John John
    Jan 19, 2017 at 12:45
  • 1
    Distribution lists and mail enabled security groups look similar yes. There is really no reason to create distribution lists, they only serve exchange. Mail enabled security groups are securable objects throughout AD so they can be used for security in SP, file servers, other web applications, etc. There is no compelling reason to create a distribution list ever in my opinion.
    – Eric Alexander
    Jan 19, 2017 at 12:55
  • @EricAlexander ok thanks for the reply.. so now when i add a "mail enabled security groups" inside our sharepoint Group (let say our Members SP group) and inside my workflow 2010 and/or inside our notifications i define to send an email to our "Memebers" group,, then will sharepoint send separate email to each member inside the "mail enabled security groups"? or it will simply send a single email to the "mail enabled security groups" email address and then this will reach all the members based on the settings inside exchnage ??
    – John John
    Jan 19, 2017 at 14:17

1 Answer 1

Reset to default
1

As Eric Alexander say : the A is the best.

Explain of B :
When SharePoint ADD a Security Group from AD to your site, SharePoint will interact as if it were a user (the SharePoint Object is SPUser). Not entirely, but it will retreive all the AD properties (name, Login, Email ....).
So, if you have your Email AD property filled in your AD group, when you will add it to your Sharepoint, your group will have an Email. As an ad group is considered (almost) as a user in SharePoint, when you workflow will send email (to the field Assign To of a task for exemple) it will treat it like a user, get the Email property of your SPUser (which is a security group) and send an Email to it. By default (with the OOTB function) a workflow can't iterate thow all the user in a AD group (because for SharePoint it's a SPUser).
So that why your users in your AD group ("domainname\sg-managers") will not have an Email, you need to DEV this logic.

Explain of C :
As Eric Alexander say : the distribution lists is not supported in SharePoint, you can't use it. Thats why when you enter XXXXXStaff@xxxx, SharePoint try to retrieve a user from you AD with this Email. It does not find it, so it whant to send a symple invitation to this Email, and this feature is probably forbidden by the administrator.

Hope this help you to understand

Improve this answer
8
  • thanks a lot for your reply.. so for point B you mentioned that i need to DEV this login,, then this logic will be to loop through all the members of the AD security group and for each member to get his/her email address is this correct ? and will these info (the security group's members + the members' email address) be available inside sharepoint or i will mainly be querying the active directory using ldap for example?? for point C how did you recognize (from sharepoint perspective) that this is a distribution list ,,, is it from the error i got when i try to share it?
    – John John
    Jan 19, 2017 at 14:27
  • 1
    yes this is correct for your logic (for sending Email to a AD Group). You need to query the Active Directory using ldap or other methode like : SPUtility.GetPrincipalsInGroup And after send your Emails, you can use SPUtility.SendEmail
    – Nico
    Jan 19, 2017 at 15:55
  • 1
    For the C, i don't recognize the distribution list. It's just sharepoint logic. With the peopel picker you can enter login, email and name of user (login or name of your security AD group). With this info, SharePoint try to get your user from AD with a ldap query. You Email (xxxstaff@xxxx) is not associated to a user. So the user is not found, and sharepoint understand thant you want to "Share to external email", but this feature is surely disactivated by you Farm administrator
    – Nico
    Jan 19, 2017 at 16:02
  • You can check this link to send Email to Security group in Workflow: spdev.info/2012/11/using-security-groups-with-workflows.html OR absolute-sharepoint.com/2012/06/…
    – Nico
    Jan 19, 2017 at 16:08
  • 1
    Yes you are right ;). The 2 links talk about sending email to AD Security group not SharePoint group (but for this you need configuration)
    – Nico
    Jan 19, 2017 at 17:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.