diff --git a/LiamWorkflowActivities/C4IT.LIAM.WorkflowactivityBase.cs b/LiamWorkflowActivities/C4IT.LIAM.WorkflowactivityBase.cs
index 1660056..12573a9 100644
--- a/LiamWorkflowActivities/C4IT.LIAM.WorkflowactivityBase.cs
+++ b/LiamWorkflowActivities/C4IT.LIAM.WorkflowactivityBase.cs
@@ -93,6 +93,19 @@ namespace LiamWorkflowActivities
                 string.IsNullOrWhiteSpace(providerMessage) ? fallbackMessage : providerMessage);
         }
 
+        protected bool IsAdditionalConfigurationEnabled(cLiamProviderBase provider, string key)
+        {
+            if (provider?.AdditionalConfiguration == null || string.IsNullOrWhiteSpace(key))
+                return false;
+
+            if (!provider.AdditionalConfiguration.TryGetValue(key, out var rawValue) || string.IsNullOrWhiteSpace(rawValue))
+                return false;
+
+            return rawValue.Equals("true", StringComparison.OrdinalIgnoreCase)
+                || rawValue.Equals("1", StringComparison.OrdinalIgnoreCase)
+                || rawValue.Equals("yes", StringComparison.OrdinalIgnoreCase);
+        }
+
         protected void Initialize(NativeActivityContext context)
         {
             try
@@ -521,6 +534,9 @@ namespace LiamWorkflowActivities
                     return new List<DataAreaEntry>();
                 }
 
+                if (!await EnsureNtfsPermissionGroupsIfConfiguredAsync(ProviderEntry, lstDataAreas))
+                    return null;
+
                 return lstDataAreas
                     .Select(DataArea =>
                     {
@@ -604,6 +620,56 @@ namespace LiamWorkflowActivities
             }
         }
 
+        private async Task<bool> EnsureNtfsPermissionGroupsIfConfiguredAsync(ProviderCacheEntry providerEntry, List<cLiamDataAreaBase> dataAreas)
+        {
+            if (!(providerEntry?.Provider is cLiamProviderNtfs ntfsProvider))
+                return true;
+
+            if (!IsAdditionalConfigurationEnabled(providerEntry.Provider, "EnsureNtfsPermissionGroups"))
+                return true;
+
+            foreach (var ntfsArea in dataAreas.OfType<cLiamNtfsPermissionDataAreaBase>())
+            {
+                var folderPath = ntfsArea.TechnicalName;
+                if (string.IsNullOrWhiteSpace(folderPath))
+                    continue;
+
+                if (!Directory.Exists(folderPath))
+                {
+                    LogEntry($"Skipping automatic NTFS permission group ensure for '{folderPath}' because the directory does not exist.", LogLevels.Warning);
+                    continue;
+                }
+
+                var result = await ntfsProvider.EnsureMissingPermissionGroupsAsync(
+                    folderPath,
+                    null,
+                    null,
+                    null,
+                    null,
+                    false);
+
+                if (result == null)
+                {
+                    SetOperationError(
+                        "WF_GET_DATAAREAS_ENSURE_NTFS_GROUPS_FAILED",
+                        $"Automatic NTFS permission group ensure failed for '{folderPath}' because the provider returned no result.");
+                    return false;
+                }
+
+                if (result.resultErrorId != 0)
+                {
+                    SetOperationError(
+                        "WF_GET_DATAAREAS_ENSURE_NTFS_GROUPS_FAILED",
+                        $"Automatic NTFS permission group ensure failed for '{folderPath}': {result.resultMessage}");
+                    return false;
+                }
+
+                await ntfsArea.ResolvePermissionGroupsAsync(folderPath);
+            }
+
+            return true;
+        }
+
 
         private async Task<cLiamDataAreaBase> getDataAreaFromUID(string UID)
         {