We have a SP2013 farm using windows authentication. On the AD there are 10,000 user accounts and we have no edit permission on AD. (Hence, I cannot setup any group there) As the Sharepoint admin I only have a list of 1,000 users allowed to access. There is no existing group setup to indicate these 1,000 users.

My question is, how can I allow these 1,000 user login Sharepoint while blocking the other 9,000?

According to my understanding, user profile sync is different concept with sharepoint authentication. However, can I limit only the user with an existing user profile on Sharepoint to sign in?

My concern is the 9,000 users will get their My Site self-created when he browse the My Site web application. Another concern is when they access some page without authorization, they will get a form let them asking for access. The site owner may grant access to them by mistake which we want to avoid.

Thank you.

1 Answer 1


Problem #1: If you only want to give access to the 1000 users the Mysite access then the only possible way is to sync only 1000 users to the user profile sync from AD. Which means the users should be added to an AD group and only sync them to User Profile Service. No other way to avoid the users to create Mysite. If someone is in AD and they went to my site then it automatically creates the my site site collection for them based on the my site settings. The other way would be write code to create user profiles manually for those 1000 users, so they are available in user profile store.

Question for you here: Is User Profile Store is empty today? Or all AD users are already in Sync?

Problem #2: You can still give access to 1000 users only into SharePoint site by creating a SharePoint group in your site collection level or web level. Use that group to give proper permissions wherever required.

  • The farm is not yet production so I can change. However even a user do not have user profile, when he first time reach MySite his profile will be built I believe.
    – Mark L
    Commented May 12, 2014 at 4:32
  • Is it mean I can only deny the 9000 users with Site collection permission? Also with the "self-creation" mysite setup I have no way to block the 9000 users?
    – Mark L
    Commented May 12, 2014 at 4:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.