5

What appear to be outdated blog posts everywhere tell you to not exceed 1,000 security scopes per list. Some even provide hard evidence as to why this is a bad idea. What they seem to have in common, however, is that they are (now) misquoting Microsoft.

My research of Microsoft sources indicates that the number of security scopes per list should not exceed that of the list view threshold which by default is 5,000 records.

I did find one article that used 1,000 security scopes solely as a benchmark saying that from 0 to 1000 saw a 20% degradation in performance though it does not indicate this as any sort of limit.

Has something changed over the last 4 years that 2010 now can support more than 1,000 security scopes? Was this always the case and Microsoft's documentation was just outdated from MOSS 2007? What is the real story here?

  • 2
    This is just a speed issue. Script a new 2010 deployment with 5000 random unique users. Make a list with these users each individual amounts and have a look from 100, 500, 1000 and 5000 users and take a look at the query times. You can see also in detail what happens using the sql profiler. But to explain the difference between 5000 and 1000 you are confused about I think the best article to read would be: reality-tech.com/2012/03/19/… – Hugh Wood Feb 10 '14 at 13:06
  • 1
    Slight performance enhancement for ACL in show all view for the latest 2010 CU FEB 2014. But nothing in general. – Hugh Wood Feb 13 '14 at 11:29
  • The article you link to in your first comment, is the one he links to in the beginning of his post ;) – Anders Rask Feb 16 '14 at 22:25
  • Yeah I know, I just thought it was the easiest way to highlight that, we had a discussion about it on Google+ – Hugh Wood Feb 17 '14 at 10:40
4
+50

If you need to go above 1000 unique ACL's in your list, you should rethink the way you use SharePoint! Set up unique sites for different groups of users, instead of having thousands of unique permissions on a list. It simply will not perform very well due to the way SharePoint handle this.

As mentioned in the boundaries specs for lists, the max number of unique ACLs on a list is 50.000, but a recommended max is 5.000. It also mentions that for large lists ACLs should be kept LOW.

The maximum number of unique security scopes set for a list cannot exceed 50,000. For most farms, we recommend that you consider lowering this limit to 5,000 unique scopes. For large lists, consider using a design that uses as few unique permissions as possible.

When the number of unique security scopes for a list exceeds the value of the list view threshold (set by default at 5,000 list items), additional SQL Server round trips take place when the list is viewed, which can adversely affect list view performance.

A scope is the security boundary for a securable object and any of its children that do not have a separate security boundary defined. A scope contains an Access Control List (ACL), but unlike NTFS ACLs, a scope can include security principals that are specific to SharePoint Server 2013. The members of an ACL for a scope can include Windows users, user accounts other than Windows users (such as forms-based accounts), Active Directory groups, or SharePoint groups.

Unique ACL's on a list or list item means that the user assigned this permission will need permissions all the way "up" in the hierarchy, in order to navigate to the item (unless you set AddToCurrentScopeOnly() programmatically on the securable object). SharePoint does this even if your user has already access. Copying these ACL's that grows exponentially can really slow down your system, even with less that 1000 documents in the list. And uploading new documents can grind to a hold with fewer than 1000 documents as Chakkara shows in this blog post.

Consider it a good practice to keep your unique permissions on as high a level as possible. Preferably sites or lists.

  • Great advice, though I already understand the consequences of using unique permissions. I was more specifically trying to figure out why the number 1,000 seemed to be a limit in all bloggers eyes and why when they quote Microsoft, their quote is outdated per the Boundaries and Limits page they link back to / are quoting. I only see 1,000 as a benchmark provided by MS and nothing more. I want to know why it was previously a recommended threshold / limit and now that is no longer the case. – SpartanDonut Feb 17 '14 at 12:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.