Questions about syncing Hub Site with Associated Sites

Question

We set up our departmental SharePoint site around 2 years ago - we have one Hub site with 18 "spokes" for each team. When I was building all of these sites out I was told that permissions for each site were independent of the Hub. So I then proceeded to create almost identical visitor groups for the Hub and Team Sites. This became a nightmare to manage and I recently learned about syncing a Hub Visitor's group to the associated sites. However, I have a few questions about this before I take any action and break the sites.

I also want to use best practices so the site is not too complicated to maintain and I did see a few blogs that had somewhat negative thoughts on syncing a Hub Visitors group.

1. If I sync the Visitors group, can I then remove those users from each of the Visitors groups in the associated Team Sites?
2. Do I have to sync all of the Team sites or can I set it for most, but leave a couple off?
3. What are the potential pitfalls?

susanhanley · Answer

Jean5288&nbsp;The hub visitors group is "additive" to the associated sites - it effectively adds an additional permission group to the site - Visitors, Members, Owners + Hub Visitors. Not all associated sites need to "accept" the additional hub visitors group. You can have some associates sites that use it and others that do not. You probably don't want to remove the members of the Visitors group from associated sites because if you remove that site from the hub, there will be no Visitors on the site. In other words, since Hub Visitors are added the ADD readers to the associated sites. If those sites leave the hub, the additional visitors lose their access and only the "local" visitors for the site have access. If your goal is to share read permissions for multiple sites, you may want to use an Active Directory Group, which can be added to any of the SharePoint Groups in more than one SharePoint site. Learn more:&nbsp;https://support.microsoft.com/en-us/office/set-up-your-sharepoint-hub-site-e2daed64-658c-4462-aeaf-7d1a92eba098#bkmk_managesiteassociationapprovals.
&nbsp;

jean5288 · Answer

So where/how do I get the Active Directory groups?

susanhanley · Answer

Jean5288&nbsp;You can work with your AD Admin to create them. If you have existing Microsoft Teams, you can use the Members group for the Team as well.

jean5288 · Answer

SusanHanley&nbsp;neither of those options will work with how the sites are organized.&nbsp; Is there any way to make syncing the Hub Visitors to a majority of the team sites work?

susanhanley · Answer

For each team site, the site owner can opt-in to sync Hub Visitors permissions - so as I said before, you can opt-in for some but not all associated sites. You can associate sites to a hub in "bulk" from the SharePoint Admin Center. From what I can see, you will need to manually opt-in to add the Hub Visitors to each associated site where you want to add the Hub Visitors group - though maybe you can do this with PowerShell. I think that before you go too far with this planning, you want to make sure that you have established the right type of site for each purpose. You can double check with this guide: https://docs.microsoft.com/en-us/microsoft-365/community/team-site-or-communication-site. Assuming that you have private team sites where you want to give READ access to an additional set of users, adding Hub Visitors to each site is a great way to do that. If the team sites are associated to Microsoft Teams, this gives Hub Visitors access to the files and lists on the site without giving them access to the Team chat and other resources associated with the Microsoft 365 Group for the Team.

Forum Discussion

Questions about syncing Hub Site with Associated Sites

6 Replies

Resources