Leveraging Local AD Groups with Azure AD Connect for Sharepoint in Office 365

Question

We have an on-premise Active Directory that is using Azure Active Directory Connect to synchronize User and Group objects to Azure AD/Office 365. Our organization is interested in beginning to use SharePoint but we are struggling to figure out the best way to leverage our existing Security Groups in Active Directory as a means of controlling access to SharePoint sites.

Which of these deployment scenarios is viable:

• Create a SharePoint site that the entire organization has access to, with discrete Document Library's within the site, each of which is access controlled by AD Security Groups.
• Create a discrete SharePoint site for each AD Security Group with Document Library's within the site where access control is inherited from the site.

Alternatively, is there a better way to achieve our objective stated above?

Answer 1

both are viable. When it comes to SharePoint permissions inheriting permission is better. It's easier to maintain and audit.

Your site collections are your security boundaries. The best choice (IMO) is to have a site where libraries inherit permissions.

Next would be breaking inheritance at the library level. Sometimes this is required depending on the scenario and content is being served. I would recommend trying to avoid breaking inheritance at the item level (folders and documents) - that becomes a nightmare.

Take all that with a grain of salt as well - with SharePoint online, if you enable the sharing of content, your permissions may change dynamically depending on who is allowed to share content, that's internally and externally.