I'm working with a company that has 100k+ employees, contractors, and external partners who have user accounts in their Active Directory. People fall into different categories:
- Employees (60k)
- Contractors (20k)
- Offshore Partners (10k)
- Research Partner 1 (5k)
- Research Partner 2 (5k)
- etc
In SharePoint, read-only access is being provisioned by enabling access for All Authenticated Users. Up to now this has been OK, but there are an increasing number of external partners who should have more limited access. In essence it would be best to have a group including just employees and contractors.
It has been proposed that an Active Directory group is created containing the ~80k users, and that this is used when tighter control than all authenticated users is required. I'm concerned that there might be a performance impact.
- Has anyone encountered a situation like this? Is there a better way to handle this?
- Does SharePoint 2010 efficiently search large AD groups to identify membership?
- Have Microsoft published any guidance on this topic?