Large list with custom permissions

Question

Imagine there situations:

1. List with 6 000 items. The list has broken permission inheritance. Each item has custom permissions set. Only the author of the item has contribute permission level set. The member group has Read permission level set. The owner group has Full control permission level set.
2. List with 6 000 items. The list has broken permission inheritance. Each item has custom permissions set. The author of the item and another user have contribute permission level set. The owner group has Full control permission level set. The custom group (Auditors) has Read permission level set.
3. List with 60 000 items. The list has broken permission inheritance. Each item has custom permissions set. The author of the item and another user have contribute permission level set. The owner group has Full control permission level set. The custom group (Auditors) has Read permission level set.

Do you see any problems with scenario above?

Answer 1

Your design will hit two major limitations which could massively impact performance:

• All of your lists have >5.000 items. This is what Microsoft calls a "large list". Study this excellent article and follow it's recommendations. You souldn't blindly increase the "List view Threshold"
• Assigning permissions per item also slows things massively down. I have seen lists&libraries timing out when performing a permission change because of the excessive use of item-level permissions. This article has excellent information in section "Throttling and limits -> Unique permissions". It is written for 2010, but still valid in newer versions.

Whenever permission inheritance is broken for an item, such as a folder, it is counted as a unique permission toward this limit. Each time permissions inheritance is broken, a new scope ID is created. Each time that you query on a view, you join against the scopes table. Then, when a query is performed, each unique access control list (ACL) must be parsed and processed. A large number of unique permissions in a list will adversely affect performance and is not recommended. As the number of unique permissions in a list grows, query performance will degrade. Even though the default limit is 50,000 unique permissions, you might want to consider lowering this limit to 5,000 unique permissions.

Answer 2

Sharepoint doesn't like breaking permissions. If the list will not grow above the 6k you are probably fine (I would just increase the list view threshold for that list using PowerShell to 6K - but just for the list not the whole app thorough the Central admin). The more the list grows the more perf problem you will have (you can mitigate them by throwing more resources on the farm and sql server - mainly memory for SQL and fast disks).