I am looking into restructuring our AD Groups Infrastructure and am having a hard time find the best way to reorganize.
The reason this is a unique challenge is because of our employee roles. No two individuals, even in the same dept, require the same access. Our old role had a mixture of providing individuals with direct access or putting users into generalized groups that had permissions to too many resources.
Because this isn't a typical or simple, put a user into a dept group, it leaves me with few options. I was thinking of creating security groups for all resources and adding individuals to groups for the resource they require. There's probably a lot of cons of doing things this way.
One of the cons is having too many security groups. Easily over a hundred.
Pros, easily documented in the group description and easy to find what permissions a user has access to.
What is the best practice in this instance and what have you found to work?