Today in an effort to clean up our SharePoint permissions and centrally manage things a little more efficiently, we compared our Active Directory groups (OUs) to our groups in SharePoint.
I created a security group for every department/OU that we have, and I added the distribution list for the respective department into the security group.
My hopes were that upon new employee creation, we could add the user into the distribution list, which would effectively add that user into the security group therefore granting access to all of the appropriate site collections in SharePoint.
Previously we've had it where we need to add the individual into multiple different site groups, and it became a mess to manage. For instance -- there is a document library and a few custom lists on the Sales subsite that needs to be accessed by the project mgmt team. We'd find ourselves adding that individual into sometimes up to 5 different site groups.
After setting up the security groups and applying those groups appropriately in SharePoint, I did some testing, and it did not go well. None of the permissions carried over like I had hoped, and people couldn't access the sites they needed to.
I assumed that I had misunderstood how security groups work, so I did some troubleshooting. Instead of adding distribution lists to the security groups, I added individuals to see if there was an issue with having a DL inside of a security group. That did not fix anything either.
I signed into an account from a new user that hasn't started yet, and added them individually into the sales members group to verify that I was setting the permissions in the proper location. After verifying that I was adding the user to the right group, I removed the individual and replaced it with the security group, which contains that individual, and the site is no longer available for that user.
What could I be doing wrong? It seems like a simple concept that we would benefit greatly from, but I'm having nothing but issues. Any assistance would be greatly appreciated.
TL;DR: Instead of adding an individual into multiple site groups, we're creating security groups and adding those security groups to multiple site groups, so that individuals will only have to be added to one group to get the permissions they need. It is not working -- removing individuals from the site group and replacing it with the security group that the user is a member of is causing the sites to disappear, and access is denied. Any help would be greatly appreciated.
