Bob's Identity Management Blog

"Anyone can hold the helm when the sea is calm." – Syrus Publilius

I had a customer ask me if there was any way ActiveRoles could help them manage the Active Directory groups that were used to control user access to organization’s SharePoint sites. The problem the customer was having is that some SharePoint owners in the organization had not always used AD groups; more often they had placed AD users directly into SharePoint groups. Further, the customer estimated that 60% of the SharePoint sites were in this “AD un-managed” state and there was a growing fear that some of the sites would have information that could cause their auditors to go nuts.

The answer is yes, we will shortly release a plug-in application for ActiveRoles that will automate the process of converting SharePoint sites so they use AD groups to control access. The snap-in application will provide several automated workflow stages that can be run over time or all at once in a big bang approach. This flexibility to run in separate phases allows for a phased approach so that projects have distinct achievable milestones that are organizationally and politically acceptable. (More on this later). The Automated phases are: Attestation, co-existence and finally AD Integrated Access with more and more ActiveRoles automation functionality can be utilized as each phase is completed.

I spoke with my college Doug Davis who manages the SharePoint products for Quest about the solution and he pointed out how well this will complement Quest’s SharePoint Site Administrator and Site Discovery. Doug also mentioned that this is a common problem that has continued to cause problems for customers and that he frequently gets requests for a solution such as this.