A list or library above 5,000 unique permission scopes is past the recommended limit

What it decides

Rule

SPO-LIST-003

Applies to

sharepoint · list

Default severity

low

Basis

documented-guidance

On what authority

Microsoft writes "the recommended general limit is 5,000" and supports up to ten times that. Exceeding it is permitted, and the second source is explicit that the effect depends on the size of the access control lists: with small ones a list can pass 5,000 without trouble, and with large ones it can struggle before reaching it. A tenant may reasonably decide to exceed the recommendation with that in mind.

• SharePoint limits, Unique security scopes per list or library
• Manage Permission Scopes in SharePoint

What it needs to decide

• permissions.unique_scope_count

Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.

Where the evidence comes from

No published capability supplies this rule's evidence.

What a pass does not establish

A list at 4,999 scopes passes, and if its access control lists are large it may already be slower than a list at 8,000 with small ones. Microsoft says so explicitly. The count is a proxy for a cost this rule cannot measure, and a pass here is not a statement that the list performs well.

• This rule and SPO-LIST-002 read the same number and are deliberately separate. One reports a recommendation, the other a supported ceiling, and collapsing them would put a performance note and a hard limit under the same basis.

Source

The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b6@b4bf9c325233.

Generated from capability-manifest/1.0.0 at1.0.0b6@b4bf9c325233, contract1.0.0b6. Every fact on this page is the Engine's; this site publishes it and does not maintain it.