Tell me more ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.
up vote 1 down vote favorite

We are planing to apply Item level Permission on document library and want share point experts advise...are we going right way or we will fall in performance issue or others..

What We Have :

1- We have approx 100 SharePoint Groups with with 1000 or more users assigned to those groups.

2- We have single document library (where users will add approx 60 documents per day)

Requirement :

SP Group X create a document, SP Group X can share it with SP Group Y and Z (by a workflow)...so SP Group X,Y,Z can view this document and rest group will not be able to view it.

What we are doing :

We are assigning share-point groups per Document Library Items by breaking inheritance depending on our Requirement.

Question

1- Is this right Approach ? any better way please help ?

2- We heard 50,000 is a hard limit when we assign SP groups per a Document library items, after 50,000 items we are planing to move them in archive ...is this right ?

share|improve this question

3 Answers

up vote 1 down vote accepted

In terms of Capacity the theoretical limit is 50 millions per Document Library, SP2010. Besides there is no practical limit to how many items per Container (e.g. Folder), but there are recommendations, up to 5000 (default configured as Threshold in CA for each Web Application). More on this, considering the amount of traffic estimated and groups, you would break inheritance quite a lot - not recommended honestly.

A rather easier, safer approach is to use Sub-Sites with Unique permissions given to SP Groups - long term that is the best strategy and it avoid maintenance headaches. This avoids to break inheritance and as well give opportunity for more types of content, while complying with security. People tend to forget that SP2010 is after all a Site provisioning engine and you could go up to 250k sites per Site Collection, but a lot easier to navigate, set Ownership, etc.

You also have a recommendation of about 1500 ACL limit for unique Security per User, with the amount estimated, and considering your security rules, probably you'll reach it in some months. Every time you configure inheritance there is also a performance penalty because permissions are kind of duplicated.

You can talk more on this, but I would suggest not to break inheritance considering your constraints - will be a hell to maintain that.

share|improve this answer
I think Salman Aziz is talking about the 50,000 limit on items with Unique Permissions in a list, rather than absolute capacity. And it does appear that is a hard limit, with a somewhat lower recommended limit. – Andy Burns May 10 '12 at 8:35
Thank you Marius it helps allot in why not break inheritance, and yes Andy...i was taking about max unique scopes allowed in a document library. – Salman Aziz May 10 '12 at 8:50
up vote 2 down vote

You can download this document Best practices for using fine-grained permissions (SharePoint Products and Technologies): http://www.microsoft.com/en-us/download/details.aspx?id=9030

T.s

share|improve this answer
Thanks allot its nice one i read the document one important line i need further clarification is "The number of uniquely scoped children is not a significant issue, and can scale to large numbers, but the number of principles that will be added as limited access up the chain of scopes to the first uniquely permissioned Web will be a limiting factor. " .....in our case i am not using inheritance chain from top to child level we are breaking inheritance at each level – Salman Aziz May 10 '12 at 9:47
in our case we are assigning by max 100 SPGroups to each doc lib item ..how can we avoid this chain of scopes problem ? – Salman Aziz May 10 '12 at 9:55
@SalmanAziz if that's nice one, you should upvote. That's what votes are - to emphasize more useful answers. – Janis Veinbergs May 15 '12 at 8:56
@Janis Veinbergs, your right..but first u need u to increase my reputation :) as i don't have 15 reputation to upvote someone =D.. – Salman Aziz May 18 '12 at 9:15
up vote 0 down vote

Another alternative would be to use the content organizer where everyone submits documents to. Then the documents get routed based on the rules defined in the content organizer to specific document libraries that are permissioned as needed.

A couple useful links, from MSDN, from a TechNet blog.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.