In our company, users logon their desktop with AD and access Sharepoint using Windows authentication. Our users frequency changing teams. After they changed team, their access to old Sharepoint team site should be removed. Sharepoint allow granting permission to an AD security group. Hence, the best way to manage permission is grant Team A's site to Team A security group.
However, our AD maintenance team refuse to setup Security groups for each team because the maintenance effort is too large (users keep switching team). Is FIM a solution allow users, or their supervisor, or HR department, to manage the security group change?
Beside FIM, any other solution? Thanks!