0

I'm trying to fully understand what counts as a unique permission when working with a large library.
Library structure: Library - Document Set - Folder
Only three SP groups will have access to the library: Owners, Members and Visitors

Permissions will be set as follows:
Library (broken inheritance): Owners (Full Control), Members (Contribute), Visitors (Read)
Document set (inherited from lib.): same as library
Folder (broken inheritance): Owners (Full Control), Members (Contribute), Visitors (Contribute)

Question:
After a few years the library will have 20k+ document sets. As long as the SP groups are used to secure the objects in the library will there be any issues with hitting any security boundaries?

Related info:
This thread: Question on unique permissions count hits on some of the same points but conflicts with the documentation provided by Microsoft.

Note from Microsoft:

"Exceeds list view threshold" or "too many items with unique permissions" error when trying to share or break inheritance

This issue occurs for one of the following reasons:

When a list, library, or folder contains more than 100,000 items, you can neither break permission inheritance nor reinherit permissions on the list, library, or folder. However, you can still break inheritance on the individual items within that list, library, or folder, up to the maximum number of unique permissions.

The supported limit of unique permissions for items in a list or library is 50,000. However, the recommended general limit is 5,000. Making changes to more than 5,000 uniquely permitted items at a time takes longer. Therefore, for large lists, design the list to have as few unique permissions as possible.

Improve this question
2
  • Are you saying that the structure of the library is that the root level of the library will only hold document sets, and that all of the document sets will contain a folder? I see that you say that the document sets have the same permissions as the library, but do they inherit permissions from the library, or is permission inheritance broken, even though it has the same permission settings?
    – Dylan Cristy
    May 26, 2020 at 21:14
  • @DylanCristy Correct, the library will only hold document sets and each doc set will have one folder. Updated the post with inheritance details.
    – Taco_Buffet
    May 27, 2020 at 1:35

2 Answers 2

Reset to default
1

In your case, since the subfolders within the document sets will be breaking permission inheritance, each one of those would count as a unique permission.

So if you eventually have 20k+ document sets, you will have 20k+ unique permissions because each of those document sets contains a folder with broken inheritance.

Improve this answer
0

The number of unique permissions should be looked at the library level for the 50k supported limit (and recommended general limit 5k).

Every document set / folder / document within this library would be counted as an object with unique permission, no matter if it has inherited permission or not.

Improve this answer
2
  • do you recommend opening a ticket with o365 support to request the limit increase to 50k? Referencing this thread: sharepoint.stackexchange.com/questions/275115/…
    – Taco_Buffet
    May 28, 2020 at 14:02
  • @Taco_Buffet Of course, if you need to raise the limit for business need. But still, we also recommend keeping the number low in order to avoid performance issue.
    – Chelsea_MSFT
    May 29, 2020 at 2:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.