So in Sharepoint there are 2 ways to see the groups, site settings, people and groups (I see my AD groups there twice), or site setttings permissions, I see the group there only once.

All I need is to add an AD Group into an existing SP group with the contribute permission level.

The code below works fine but the questions are the following1

Why the ad group appears 2 times in People and Groups? how can I fix that? why adding the ad group to an sp group is not enough? you still have to add a permission level to the ad group. If I dont do the ensureuser, then the roleaassignments.add fails with user not found

  string xlosgroupnamewithdomain = string.Concat(domainName, @"\", xlosgroupname);
                            SPUser adLosGroup = web.EnsureUser(xlosgroupnamewithdomain);
                            SPRoleDefinition contribute = web.RoleDefinitions.GetByType(SPRoleType.Contributor);
                            SPRoleAssignmentCollection roleAssignments = web.RoleAssignments;
                            SPRoleAssignment roleAssignment = new SPRoleAssignment(xlosgroupnamewithdomain, string.Empty, string.Empty, string.Empty);
                            SPRoleDefinitionBindingCollection roleDefBindings = roleAssignment.RoleDefinitionBindings;

When I try to do this, it says the user does not exist. in the adduser line

 string xlosgroupnamewithdomain = string.Concat(domainName, @"\", xlosgroupname);
                            var adLosGroup = web.Users[xlosgroupnamewithdomain];
  • The web.EnsureUser returns the new User object, so use that object. Jul 11, 2013 at 6:45
  • @RobertLindgren please see the first code, that was what I was already doing, and it works fine, but when I go to People and Groups, I see the group twice. Jul 11, 2013 at 6:57

2 Answers 2


I am pretty sure you are seeing two because you likely named the Sharepoint Group and the AD group the same thing. If you had different names you would notice they are different and you are seeing a user (the AD group) and the group (the SP group).

EnsureUser is a method that checks to see if the user exists and if not then it creates it, this is necessary because you cannot add a user that doesn't exist in sharepoint to a group.

I don't believe you have to add a permission level if you are adding groups at the site collection level.

Here is what I did using powershell so you could probably use a similar concept:

$w = Get-SPWeb $SiteCollectionURL
$ADGroup = $w | Get-SPUser "DOMAIN\User"
$SPGroup = $w.SiteGroups["Sharepoint Group"]

The problem was this line:

SPRoleAssignment roleAssignment = new SPRoleAssignment(xlosgroupnamewithdomain, string.Empty, string.Empty, string.Empty);

I should use in the SPRoleAssignment constructor the SPGroup used before. and not the groupname string. Then it works fine

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.