I know that if a user is added to a SharePoint group, a crawl needs to run before the ACLs are updated to reflect the new user's permissions.

The question that my team is debating is whether or not those crawls are automatically kicked off by the action of adding a user to (or removing a user from) a group.

My contention is no - the crawl does need to happen, but it will happen either at the next scheduled time, or if someone goes in to the Search Service and starts one manually.

Another team member says that the crawls start automatically after a user is added or removed from a group.

Can anyone shed any light on this?

2 Answers 2


A crawl is never started by anything changing in SharePoint, neither content nor security changes.

A crawl is either started manually or according to the specified schedule.

If you're using search, then you probably have a crawl schedule set up which does incremental (and sometimes full) crawls. The full crawls with crawl everything and the incremental crawl will crawl items needing to be crawled due to content or security changes.

So the bottom line is that if you've set up a crawl schedule to index content regularly then the security changes will be caught automatically.


It does not kick off automatically. The security crawl will update when the next incremental (or full) runs. It will at that point identify the change, and apply the permission changes to each affected item.

You can validate this by simply making a change and running a search query for a protected item. If you remove a permission, the protected item will still be available in results. Run an incremental crawl, and when it completes it will no longer be available in results.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.