Using Active Directory groups instead of SP groups

Question

A site collection should have more than 10.000 sp groups which is a problem for Sharepoint. One solution is to use A.D. groups instead of SP groups - the A.D groups will be used for permissions on items.

What are the cons for this approach?

Thank you

Updated: One of the cons in using AD groups is that if you give direct permissions to a list item, Sharepoint also gives "limited access" to this group and if you delete this permission, limited access remains.

Answer 1

The cons is obviously that you won't be able to add users to a group in SharePoint, and you have to manage AD-groups instead. If you already have 10'000 SharePoint groups in your environment, you may have to rethink how granular you're setting permissions.

But it's true that above 10'000 groups per site collection there are performance issues:

Above 10,000 groups, the time to execute operations is increased significantly. This is especially true of adding a user to an existing group, creating a new group, and rendering group views.

Ref: Software boundaries and limits for SharePoint 2013

But if you only have one Site Collection, that's the real issue here, not the number of groups.

Security Token Caching Problem

In case you haven’t already guessed, “check security” is based on the external security token. Knowing that it can be 24 hours before the external security is refreshed immediately suggests one obvious cause for any permission mismatches. If a user hasn’t physically logged into SharePoint within 24 hours then we won’t see any changes in actual security in AD until up-to 24 hours later.

Solutions:

Reduce the validation period that external tokens are valid for (see below).

1. Give permissions based on SharePoint groups.
2. The second option is preferable as there’s no time-delay in change –> authorisation effect.

Ref: Why SharePoint Check Permissions Can Give Wrong Results for AD Groups

More to read:

• SharePoint Security Groups - Don't Take Any Risks