What has changed that the security scope limit for SharePoint 2010 is no longer 1000?

Question

What appear to be outdated blog posts everywhere tell you to not exceed 1,000 security scopes per list. Some even provide hard evidence as to why this is a bad idea. What they seem to have in common, however, is that they are (now) misquoting Microsoft.

My research of Microsoft sources indicates that the number of security scopes per list should not exceed that of the list view threshold which by default is 5,000 records.

I did find one article that used 1,000 security scopes solely as a benchmark saying that from 0 to 1000 saw a 20% degradation in performance though it does not indicate this as any sort of limit.

Has something changed over the last 4 years that 2010 now can support more than 1,000 security scopes? Was this always the case and Microsoft's documentation was just outdated from MOSS 2007? What is the real story here?

Answer 1

If you need to go above 1000 unique ACL's in your list, you should rethink the way you use SharePoint! Set up unique sites for different groups of users, instead of having thousands of unique permissions on a list. It simply will not perform very well due to the way SharePoint handle this.

As mentioned in the boundaries specs for lists, the max number of unique ACLs on a list is 50.000, but a recommended max is 5.000. It also mentions that for large lists ACLs should be kept LOW.

The maximum number of unique security scopes set for a list cannot exceed 50,000. For most farms, we recommend that you consider lowering this limit to 5,000 unique scopes. For large lists, consider using a design that uses as few unique permissions as possible.

When the number of unique security scopes for a list exceeds the value of the list view threshold (set by default at 5,000 list items), additional SQL Server round trips take place when the list is viewed, which can adversely affect list view performance.

A scope is the security boundary for a securable object and any of its children that do not have a separate security boundary defined. A scope contains an Access Control List (ACL), but unlike NTFS ACLs, a scope can include security principals that are specific to SharePoint Server 2013. The members of an ACL for a scope can include Windows users, user accounts other than Windows users (such as forms-based accounts), Active Directory groups, or SharePoint groups.

Unique ACL's on a list or list item means that the user assigned this permission will need permissions all the way "up" in the hierarchy, in order to navigate to the item (unless you set AddToCurrentScopeOnly() programmatically on the securable object). SharePoint does this even if your user has already access. Copying these ACL's that grows exponentially can really slow down your system, even with less that 1000 documents in the list. And uploading new documents can grind to a hold with fewer than 1000 documents as Chakkara shows in this blog post.

Consider it a good practice to keep your unique permissions on as high a level as possible. Preferably sites or lists.