Different Site Permission Levels showing for different site collection - When User from AD group which is mapped in both Site Collection

Question

I have two different site collection A and B.
We are using AD user groups inside the SharePoint Groups.
But, while checking the site permission for the particular user, it is behaving different in both site collection.
Example:
| Site Collection A | Site Collection B| |-------------------|------------------| |AD group named "ADMember" is mapped to SP group "SPMember"| Same AD group named "ADMember" is mapped to SP group "SPMember"| | When checking the permission on Site Collection A, It is showing User having permission through SP group "SPMember"| When checking the permission on Site Collection B, It is not showing User having permission through SP group "SPMember"|

But the user comes from AD could access both site collection without any access issue. The only thing is while accessing rest api through workflow it says "unauthorized". After that issue, I came to know that the site level permission checking for the user not showing the proper groups the user listed.

Checked the below:
User Profile sync service - Working
Service Managed Accounts in central admin - Valid account is there
IIS Security Service token application pool - account has permission on DB

Any help?

Answer 1

Site collections do not share groups: each SharePoint site collection has its own authorizations and groups configuration. If you want users in the same AD group have "Members permissions" on different site collections you have to add that AD group to the Members SharePoint group on each site collection. In case of error persists, you can check which permissions a user have on current site collection visiting "Site Settings > Site Permissions" page and using the "Check permissions" button in the ribbon.

Answer 2

For using AD user groups inside the SharePoint Groups, I assume you mean add AD group to SharePoint groups. In SharePoint site collections, they don't share groups. So the SP members in Site Collection A and Site Collection B are in fact two different groups. In your scenario, the one in A has the AD group, and the one in B don't.

You can directly grant AD group permission in SharePoint site collections. There are discussions about pros and cons concerning using AD group or SharePoint group. Have a check.

Check Permission will display all the permissions granted for the user in that site collection. So check the AD members directly and get the source of the permission.

For accessing rest api via workflow, it could be a problem concerning elevated permissions. You need to allow a workflow to use add-in permissions on a SharePoint site. Check the tutorial here.