1

Imagine there situations:

  1. List with 6 000 items. The list has broken permission inheritance. Each item has custom permissions set. Only the author of the item has contribute permission level set. The member group has Read permission level set. The owner group has Full control permission level set.
  2. List with 6 000 items. The list has broken permission inheritance. Each item has custom permissions set. The author of the item and another user have contribute permission level set. The owner group has Full control permission level set. The custom group (Auditors) has Read permission level set.
  3. List with 60 000 items. The list has broken permission inheritance. Each item has custom permissions set. The author of the item and another user have contribute permission level set. The owner group has Full control permission level set. The custom group (Auditors) has Read permission level set.

Do you see any problems with scenario above?

1

Your design will hit two major limitations which could massively impact performance:

  • All of your lists have >5.000 items. This is what Microsoft calls a "large list". Study this excellent article and follow it's recommendations. You souldn't blindly increase the "List view Threshold"
  • Assigning permissions per item also slows things massively down. I have seen lists&libraries timing out when performing a permission change because of the excessive use of item-level permissions. This article has excellent information in section "Throttling and limits -> Unique permissions". It is written for 2010, but still valid in newer versions.

Whenever permission inheritance is broken for an item, such as a folder, it is counted as a unique permission toward this limit. Each time permissions inheritance is broken, a new scope ID is created. Each time that you query on a view, you join against the scopes table. Then, when a query is performed, each unique access control list (ACL) must be parsed and processed. A large number of unique permissions in a list will adversely affect performance and is not recommended. As the number of unique permissions in a list grows, query performance will degrade. Even though the default limit is 50,000 unique permissions, you might want to consider lowering this limit to 5,000 unique permissions.

  • Does it also apply to Item level permission - sharepointmaven.com/… – Martin P. Mar 21 '18 at 5:38
  • Sorry, i don‘t clearly understand your comment. Yes, my answer is all about item level permissions. Wasn‘t that your originate question? – MHeld Mar 21 '18 at 5:43
  • You can broke permissions on item but there is also setting in list - Advanced Settings - Item Level Permissions where I can specify Read/Write access for author or all users – Martin P. Mar 21 '18 at 5:47
  • Thank you for clarifying this - now i understand. I have never worked with that feature in large lists. However: Using this feature does not break permission-inheritance on list- or item-level. So it doesn't create a new ScopeID in "Perms"-Table of the ContentDB. Also look at this excellent post: sharepoint.stackexchange.com/questions/173845/…. If you do not break permissions on an item and only use the library-feature, you should be safe. Better test this in a Proof of Concept first! – MHeld Mar 21 '18 at 6:53
0

Sharepoint doesn't like breaking permissions. If the list will not grow above the 6k you are probably fine (I would just increase the list view threshold for that list using PowerShell to 6K - but just for the list not the whole app thorough the Central admin). The more the list grows the more perf problem you will have (you can mitigate them by throwing more resources on the farm and sql server - mainly memory for SQL and fast disks).

  • As the others said already, this is not a good approach. DONT increase the limit... You will regret it once you decide to move online or finally see the light and want to enforce those limits. Breaking permissions is another bane of SharePoint. More permissions means more cost for many operations. Increasing it past 5000 (permissions) means multiple round trips to the SQL Server and slows you down even more. Mixing large lists and item level permissions is very expensive performance wise. – Heiko Hatzfeld_MSFT Mar 20 '18 at 14:31
  • List view threshold is not a problem because users will use views which are showing only 1-50 items filtered by indexed column. – Martin P. Mar 21 '18 at 5:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.