How to allow only part of AD users sign in sharepoint?

Question

We have a SP2013 farm using windows authentication. On the AD there are 10,000 user accounts and we have no edit permission on AD. (Hence, I cannot setup any group there) As the Sharepoint admin I only have a list of 1,000 users allowed to access. There is no existing group setup to indicate these 1,000 users.

My question is, how can I allow these 1,000 user login Sharepoint while blocking the other 9,000?

According to my understanding, user profile sync is different concept with sharepoint authentication. However, can I limit only the user with an existing user profile on Sharepoint to sign in?

My concern is the 9,000 users will get their My Site self-created when he browse the My Site web application. Another concern is when they access some page without authorization, they will get a form let them asking for access. The site owner may grant access to them by mistake which we want to avoid.

Thank you.

Answer 1

Problem #1: If you only want to give access to the 1000 users the Mysite access then the only possible way is to sync only 1000 users to the user profile sync from AD. Which means the users should be added to an AD group and only sync them to User Profile Service. No other way to avoid the users to create Mysite. If someone is in AD and they went to my site then it automatically creates the my site site collection for them based on the my site settings. The other way would be write code to create user profiles manually for those 1000 users, so they are available in user profile store.

Question for you here: Is User Profile Store is empty today? Or all AD users are already in Sync?

Problem #2: You can still give access to 1000 users only into SharePoint site by creating a SharePoint group in your site collection level or web level. Use that group to give proper permissions wherever required.