O365 - Sharepoint & AD Security groups

[CapnPugwash]

Hi,

 

In AD we have several mail enabled security groups.

 

I've set up a team site with three layers of access. These layers of access use three of the AD security groups.

 

AllStaffGroup

SubSetofStaffGroupA

SubSetofStaffGroupB

 

I'm doing this by creating a Sharepoint group and adding the relevant AD Security Group as a member.

 

I have a folder set up that can be accessed by members of AllStaffGroup

I have a folder set up that can be accessed by members of SubSetofStaffGroupA

I have a folder set up that can be accessed by members of SubSetofStaffGroupB

 

I have inheritance turned off, so each folder has unique permissions

 

This works great (or seems to!) for the SubSetofStaffGroupA and SubSetofStaffGroupB folders

 

For the AllStaffGroup folder, it seems like everyone in AllStaffGroup can access it... except for people who are also members of SubSetofStaffGroupA or SubSetofStaffGroupB...

 

I'm testing this using the 'check permissions' button in Sharepoint... I'm a bit befuddled, can anyone point out where I'm going wrong?

[CapnPugwash]

Reading around, I've seen other people having similar problems (and people getting 'false' results from the 'Check permissions' button) ...

 

Slightly off topic but I'm interested to know what is the best way of managing O365/Sharepoint permissions - is it to use AD Security groups (which seems logical to me) or to create separate Security groups within O365?