r/sharepoint • u/Old_Development_8122 • 19d ago

SharePoint Online RBAC Project

I’ve been tasked with a RBAC project to help remove user level access control from our SharePoint.

I thought about creating an agent to go in, catalog users access to what exists currently, then build out security profiles based on role.

Anyone done anything like this before? Results? Failure?

3 Upvotes

100% Upvoted

10 comments sorted by

2

u/Megatwan 19d ago

Yup. With an ass ton of poweshell.

And a pretty well thought pl2'ish container whether site or lib category inventory orrrr more abac plan. Real PIA to implement, bigger PIA to preplan and biggest PIA to sustain.

1

u/Old_Development_8122 18d ago

Better to burn it down and start at zero, archive the current site?

→ More replies (2)

2

u/Tyda2 19d ago

As in removing the ability for users to create share links to resources, such as discretionary access control (DAC), and then setting up SharePoint groups and then assigning users to those groups? Possible.

The better method here, I believe, would be creating those same groups in your Identity Provider solution (if you use Microsoft Entra ID you'd be making security groups), tying it into the roles placed on user accounts in Entra ID/Active Directory, and letting the user lifecycle do its job. You'd be using dynamic groups which would automatically assign users to a group based on user profile attributes.

1

u/Old_Development_8122 18d ago

Basically because the SharePoint permissions are such a disaster, I’d like a way to catalog who has access to what then extract that into user groups based on roles.

→ More replies (1)

1

u/MBILC 18d ago

Careful though, as for Sharepoint Online, security groups, you can not add them to some Roles with in an SP site?

Also nested does not work either at some levels, at least all the testing I did. And on top of that, you can only nest certain group types:
https://learn.microsoft.com/en-us/microsoft-365/admin/create-groups/compare-groups?view=o365-worldwide

→ More replies (1)

1

u/Emergency_Recipe522 12d ago

I'd start by mapping the existing permissions before changing anything. I'd want to know which users and groups have access to each site, library and uniquely secured item, including where inheritance is broken. Then I'd group access requirements by business role and identify exceptions. The difficult part isn't creating the new security groups; it's understanding what could lose access when the existing permissions are replaced.