SharePoint Online Permissions/Office 365 Security Groups

%3CLINGO-SUB%20id%3D%22lingo-sub-1562782%22%20slang%3D%22en-US%22%3ESharePoint%20Online%20Permissions%2FOffice%20365%20Security%20Groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1562782%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20posting%20to%20try%20to%20get%20an%20idea%20of%20how%20other%20people%20are%20approaching%20the%20problem%20of%20assigning%20permissions%20in%20the%20Modern%20SharePoint%20Online%20world.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESince%20we%20now%20aim%20to%20build%20sites%20composed%20of%20many%20site%20collections%20(rather%20than%20subsites)%2C%20managing%20permissions%20needs%20to%20be%20centralised%20in%20Office%20365%2C%20otherwise%20we%20end%20up%20managing%20permissions%20across%20many%20site%20collections.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%2C%20the%20approach%20we've%20been%20taking%20is%20to%20create%20Office%20365%20security%20groups%20and%20add%20these%20groups%20to%20SharePoint%20permission%20groups.%20Sometimes%2C%20the%20security%20groups%20are%20nested.%20So%20far%20so%20good.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHowever%2C%20I'm%20running%20into%20real%20problems%20with%20the%20reliability%20of%20this%20approach.%20For%20a%20start%2C%20there's%20a%20long%20delay%20on%20adding%20users%20to%20the%20Office%20365%20security%20groups%20and%20the%20user%20getting%20access%20to%20SharePoint%20-%20presumably%20some%20timed%20sync%20happening%20behind%20the%20scenes.%20Secondly%2C%20the%20%22Check%20Permissions%22%20function%20in%20SharePoint%20is%20either%20massively%20unreliable%20or%20some%20permissions%20are%20not%20getting%20added%20at%20all.%20No%20matter%20how%20long%20I%20leave%20it%2C%20some%20users%20added%20through%20security%20groups%20never%20show%20up%20as%20having%20permissions.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20leads%20to%20users%20being%20temporarily%20dropped%20directly%20into%20SharePoint%20groups%2C%20and%20hence%20security%20governance%20takes%20a%20hit.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHas%20anyone%20else%20encountered%20this%3F%20Do%20you%20have%20any%20advice%20to%20give%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1562782%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EPermissions%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESharePoint%20Online%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1562830%22%20slang%3D%22en-US%22%3ERe%3A%20SharePoint%20Online%20Permissions%2FOffice%20365%20Security%20Groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1562830%22%20slang%3D%22en-US%22%3EHello%20Dave%2C%3CBR%20%2F%3EI%20faced%20the%20same%20issue.%20It%20happens%20for%20both%20Office%20365%20and%20Mail%20enabled%20security%20group%20and%20this%20is%20nothing%20to%20do%20with%20check%20permission.%20I%20tried%20to%20find%20the%20root%20cause%20for%20the%20reason.%20Unfortunately%2C%20there%20is%20no%20Microsoft%20documentation%20that%20specifies%20how%20long%20it%20takes%20to%20add%20user%20to%20SharePoint%20that%20are%20added%20via%20O365%20group%20or%20Mail%20enabled%20group.%20In%20my%20finding%2C%20it%20doesn't%20took%20more%20than%203%20hours.%20Adding%20users%20to%20SharePoint%20group%20is%20more%20effective.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1562851%22%20slang%3D%22en-US%22%3ERe%3A%20SharePoint%20Online%20Permissions%2FOffice%20365%20Security%20Groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1562851%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F31742%22%20target%3D%22_blank%22%3E%40Dave%20Tansley%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAll%20our%20customers%20use%20security%20groups%20in%20Azure%20AD%20rather%20than%20Microsoft(Office)%20365%20groups.%20Never%20had%20a%20problem%20using%20AD%20security%20groups%20as%20you%20mention.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1562860%22%20slang%3D%22en-US%22%3ERe%3A%20SharePoint%20Online%20Permissions%2FOffice%20365%20Security%20Groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1562860%22%20slang%3D%22en-US%22%3EAs%20I%20understand%20it%2C%20Office%20365%20security%20groups%20(which%20we're%20using)%20and%20Azure%20AD%20security%20groups%20are%20the%20same%20thing%20under%20the%20hood.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1562886%22%20slang%3D%22en-US%22%3ERe%3A%20SharePoint%20Online%20Permissions%2FOffice%20365%20Security%20Groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1562886%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F31742%22%20target%3D%22_blank%22%3E%40Dave%20Tansley%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhat%20you%20talking%20about%20is%20the%20same%20thing%2C%20terminology%20Microsoft%20now%20use%20is%20Security%20Groups%20and%20Microsoft%20365%20Groups.%20Both%20of%20which%20can%20be%20created%20in%20the%20Microsoft%20365%20Admin%20portal%20or%20Azure%20AD%20Portal.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDo%20you%20have%20an%20on-premises%20AD%20that%20is%20synced%20to%20Azure%20AD%3F%26nbsp%3B%20Where%2Fhow%20are%20you%20adding%20the%20users%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1562898%22%20slang%3D%22en-US%22%3ERe%3A%20SharePoint%20Online%20Permissions%2FOffice%20365%20Security%20Groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1562898%22%20slang%3D%22en-US%22%3ENo%20sync'd%20on%20premise%20AD.%20Users%20are%20added%20directly%20into%20either%20Office%20365%20Admin%20(groups)%20or%20Azure%20AD%20admin.%3CBR%20%2F%3E%3CBR%20%2F%3EThe%20weirdest%20thing%20is%20that%20for%20two%20users%20added%20into%20a%20group%20at%20the%20same%20time%2C%20one%20user%20will%20show%20up%20as%20having%20permissions%20on%20the%20desired%20SharePoint%20site%20(after%20a%20short%20delay)%2C%20while%20the%20other%20one%20will%20not.%3C%2FLINGO-BODY%3E
New Contributor

Hi,

 

I'm posting to try to get an idea of how other people are approaching the problem of assigning permissions in the Modern SharePoint Online world.

 

Since we now aim to build sites composed of many site collections (rather than subsites), managing permissions needs to be centralised in Office 365, otherwise we end up managing permissions across many site collections.

 

So, the approach we've been taking is to create Office 365 security groups and add these groups to SharePoint permission groups. Sometimes, the security groups are nested. So far so good.

 

However, I'm running into real problems with the reliability of this approach. For a start, there's a long delay on adding users to the Office 365 security groups and the user getting access to SharePoint - presumably some timed sync happening behind the scenes. Secondly, the "Check Permissions" function in SharePoint is either massively unreliable or some permissions are not getting added at all. No matter how long I leave it, some users added through security groups never show up as having permissions.

 

This leads to users being temporarily dropped directly into SharePoint groups, and hence security governance takes a hit.

 

Has anyone else encountered this? Do you have any advice to give?

5 Replies
Hello Dave,
I faced the same issue. It happens for both Office 365 and Mail enabled security group and this is nothing to do with check permission. I tried to find the root cause for the reason. Unfortunately, there is no Microsoft documentation that specifies how long it takes to add user to SharePoint that are added via O365 group or Mail enabled group. In my finding, it doesn't took more than 3 hours. Adding users to SharePoint group is more effective.

@Dave Tansley 

 

All our customers use security groups in Azure AD rather than Microsoft(Office) 365 groups. Never had a problem using AD security groups as you mention. 

 

EDIT: Re-read your question, in Azure AD or Microsoft 365 Admin portal you can create a Microsoft 365 group or a security group, assume you are creating Microsoft 365 groups, if so, try Security group. 

As I understand it, Office 365 security groups (which we're using) and Azure AD security groups are the same thing under the hood.

@Dave Tansley 

 

What you talking about is the same thing, terminology Microsoft now use is Security Groups and Microsoft 365 Groups. Both of which can be created in the Microsoft 365 Admin portal or Azure AD Portal. 

 

Do you have an on-premises AD that is synced to Azure AD?  Where/how are you adding the users?

 

 

No sync'd on premise AD. Users are added directly into either Office 365 Admin (groups) or Azure AD admin.

The weirdest thing is that for two users added into a group at the same time, one user will show up as having permissions on the desired SharePoint site (after a short delay), while the other one will not.