In SharePoint 2013, is it possible to update group permissions based on user profiles? For example, we will have 50 team sites each with group permissions that each hold 10-50 users. Rather than manually managing all the team site groups (ie: people leaving, promoted, change team, etc.) I'd like to have the group permissions updated when their user profile changes (ie: deleted, changed team, on multiple teams).


SharePoint doesn't provide a out of the box way to do this by using SharePoint Groups.

I don't know your Active Directory structure but it is likely that you have matching groups already defined there. Those groups can be added to the team sites then. If something is changed in active directory this will reflect directly to the permissions in SharePoint.

The only downside of using Active Directory Groups is that you won't see the members directly in SharePoint.

For more information you please take a look at Kirk Evans blog:

Clarifying Guidance on SharePoint Security Groups versus Active Directory Domain Services Groups

  • +1 we've implemented this with scheduled scripts that impact AD groups. SharePoint is none the wiser. You could do it with SharePoint groups (so that you can monitor membership) but it really comes down to your requirements. Scripting the User Profile queries is easy. – Matthew McDermott Jan 11 '14 at 2:28
  • Thanks. I realize I can apply always-updated AD groups to SharePoint groups, but in SharePoint you can't see the people in each group. I want to be able to show the "members" of each child-site (for contact purposes). So... I think I will resort to manually updating the sub-sites. – Ryan George Jan 20 '14 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.