I'm working with a company that has 100k+ employees, contractors, and external partners who have user accounts in their Active Directory. People fall into different categories:

  • Employees (60k)
  • Contractors (20k)
  • Offshore Partners (10k)
  • Research Partner 1 (5k)
  • Research Partner 2 (5k)
  • etc

In SharePoint, read-only access is being provisioned by enabling access for All Authenticated Users. Up to now this has been OK, but there are an increasing number of external partners who should have more limited access. In essence it would be best to have a group including just employees and contractors.

It has been proposed that an Active Directory group is created containing the ~80k users, and that this is used when tighter control than all authenticated users is required. I'm concerned that there might be a performance impact.

  1. Has anyone encountered a situation like this? Is there a better way to handle this?
  2. Does SharePoint 2010 efficiently search large AD groups to identify membership?
  3. Have Microsoft published any guidance on this topic?

1 Answer 1


Definitely use Active Directory security groups!

Since one AD group only takes up one security object (no matter how many members), they are much better than assigning individual users SharePoint permissions.

You can add users individually to SharePoint groups, or you can take advantage of Active Directory by adding entire security groups (such as adding the Sales_Dept security group as members of the Sales site collection). This is a good thing from a Windows SharePoint Services administrative point of view, because Windows SharePoint Services can only handle so many security objects (otherwise known as security principals). As far as Windows SharePoint Services is concerned, both a single user account and a security group are security objects, even though the security group can contain many user accounts.

Source: Chapter 11: Users and Permissions (Part 1 of 2)

However, I would also recommend some reading on Marc Anderson's blog.

The main issue with AD groups is administration. It usually is very easy to add users to SharePoint. On the other hand, Active Directory is usually locked down to a few admins or a security team.

In your case, this probably is actually a benefit because the groups are already provisioned and you just need to use them.

I can speak from experience that when you start syncing many, many users to a site collection it does not end well (ex: site no longer can be crawled for search).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.