I've been working on a application that will read data from a number of site collections in SharePoint 2016. At present I've been adding the user to each site collection as a site collection administrator but noticed that I can add the user on the web application under 'Manage Web Applications' selecting the web application and clicking on 'User Policy' and adding the user with 'Full Control'. There is a warning about adding a policy, should this be avoided? Or is it ok to do this if the user/policy is not repeatedly added/removed?

Adding or updating Web application policy with new users or groups will trigger a SharePoint Search crawl over all content covered by that policy. This can reduce search crawl freshness and increase crawl load. Consider using security groups at the policy level and add/remove users from security groups to avoid this.

2 Answers 2


This is a quite common technique, and I haven't found any performance issues while doing so. It's a quite common technique where you don't have to add the user as a site collection admin in every site collection. But you shouldn't do this for real users, only service accounts consuming other resources. Just to keep user access separate from service account access, and know what goes where.

But if you do administrative work on web apps with a large number of site collections, using User Policy temporarily for admin users is OK, as long as you remove access when you're done.

  • Benny what are your thoughts to Wagas is answer. Thanks
    – Webfort
    Commented Mar 7, 2017 at 14:28
  • @Webfort It all comes down to volume. And it affects the service app, not the users.
    – Benny Skogberg
    Commented Mar 7, 2017 at 16:25
  • So if I was to do this in a production environment it would not affect the users?
    – Webfort
    Commented Mar 7, 2017 at 16:26
  • Not if there's enough resources on the crawl- and indexserver(s)
    – Benny Skogberg
    Commented Mar 7, 2017 at 16:27

if you are doing in your development or test farms then you will be fine. But if you are planning to do the same-thing in production then you have to plan it.

When you add a user in the policy of web application, it will force the index to calculate the permissions for that object in the policy. When index will do the calculation then it will cause performance issues. Let's if you have millions of items in your web application then index have to calculate the permission on all objects.

if not too many site collections, then i would do it at site collection level rather web application level.

Check this blog post, it will clear the concept.Clarifying Guidance on SharePoint Security Groups versus Active Directory Domain Services Groups

  • At what point does it force the index to calculate the permissions. When clicking on 'Ok'. I've looked at one application where it adds the user to the policy, adds the user as a site collection administrator and then removes the policy. Would this still trigger the index?
    – Webfort
    Commented Mar 7, 2017 at 14:18
  • Is it the number of site collections or is it the number of items in a list. Say if I had a single web application with one site but this site contains 10000 documents. Would this cause issues?
    – Webfort
    Commented Mar 7, 2017 at 14:20
  • Yes, when you click the Ok, then it will trigger that and it will do on both action ( adding & removing). It depend upon what's in the index, more items mean more work for indexer, which cause performance. If you read the blog, he clear the concept really good way
    – Waqas Sarwar MVP
    Commented Mar 7, 2017 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.