**** Update ***
There has been a change to the project site user sync since 2013 was released, see the post from Brian below that explains the change and the change that is coming: http://blogs.technet.com/b/projectsupport/archive/2015/02/03/project-server-2013-project-now-controls-the-visitors-group-on-project-sites.aspx
***************
Just a quick post to make you aware of a design change in the Project Server 2013 project site sync when in Project Server permission mode. The only issue is that you may find project team members without assignments are granted edit access to the associated project site rather than read access – this is now by design.
In Project Server 2010 if a user / resource was added to the project team but not assigned to any tasks they were added to the Readers (Microsoft Project Server) SharePoint group on the associated project site. This is different in Project Server 2013, when the users / resources are added to the project team but not assigned to tasks they are added to the Team Members (Project Web App Synchronized) SharePoint group rather than an equivalent Readers (Microsoft Project Web App) group. This is working as designed as there are now only two SharePoint groups on the Project Sites used in the permission sync:
Project Managers (Project Web App Synchronized)
Users who have published this project or who have Save Project permission in Microsoft Project Web App.
Team Members (Project Web App Synchronized)
Users who have assignments in this project in Microsoft Project Web App.
This could be misleading if you used 2010 and also if you view the SharePoint permission level descriptions. The Project Server 2013 Project Site permission levels can be seen below:
The “Readers (Microsoft Project Web App)” states “Users who have been added to this project in Microsoft Project Web App, but not assigned to tasks.”
Also the “Team Members (Project Web App Synchronized)” SharePoint group permission description is not quite accurate as it should states that it also includes project team members without assignments:
“Users who have assignments in this project in Microsoft Project Web App”
Hope that helps.
Modern Work Management - Project and the Power Platform blog 
Hi, I’m following your blog with great interest, so thank you for the effort in doing this.
I do have a specific question and this highlights my lack of underdstanding on Project Server 2013 and Sharepoint 2013 Security and how the two tie together…
Everytime I create a new Enterprise Project I see that there are three project groups created.
When I delete the project, the groups remain. So after a while the number of groups are building up.
NB: I’m running in Project Server Security Mode and when I delete an enterprise project, I also check the box to delete the associated project site.
Thank you
Regards
Mark
Hi Mark,
Thank you for the feedback, glad to hear you find it useful!
I feel your pain with the permission groups, this is known “feature” and currently the only option is to delete the groups manually after you remove the projects / project sites.
Paul
Hi Paul,
Thanks for the quick reply. That’s clear.
Are you aware of any script or utility which would be able to match the security groups back to the list of Enterprise Projects and then remove the groups which were no longer valid?
Regards
Mark
Hi Mark, I am not aware of any script. I guess a script could be created but I haven’t seen one. I will add it to the list of script ideas for the future. Paul