|
| 1 | +--- |
| 2 | +title: "SPO Migration API: Sharing" |
| 3 | +ms.author: jhendr |
| 4 | +author: JoanneHendrickson |
| 5 | +manager: pamgreen |
| 6 | +ms.date: 6/10/2018 |
| 7 | +ms.audience: ITPro |
| 8 | +ms.topic: article |
| 9 | +ms.prod: sharepoint-server-itpro |
| 10 | +localization_priority: Priority |
| 11 | +ms.collection: |
| 12 | +- IT_Sharepoint_Server_Top |
| 13 | +ms.custom: |
| 14 | +ms.assetid: |
| 15 | +description: "The per user sharing model in SharePoint relies on both permissions and Shared With data references for an object to be considered shared with an individual." |
| 16 | +--- |
| 17 | + |
| 18 | +# SPO Migration API: Sharing |
| 19 | + |
| 20 | +## Details on sharing and permissions |
| 21 | + |
| 22 | +The per user sharing model in SharePoint relies on both permissions and “Shared With” data references for an object to be considered shared with an individual. If a user has access to content, but no “Shared With” references, they will not see the content show up in their *Shared With Me* view within their OneDrive For Business site. |
| 23 | + |
| 24 | +However, if they are indicated in “Shared With” references but do not have any access to the content, they will either never see the content show up in their *Shared With Me* view within their OneDrive For Business site or when they try to use a link from there it will be denied access. To preserve sharing information, both the permissions and “Shared With” references will need to be correctly set. The permissions can be set at different levels of the content hierarchy using scopes (unique ACLs), that apply to that object and any of its children unless they themselves have unique permissions. |
| 25 | + |
| 26 | +Using PRIME, content can be migrated in using SPFile/SPFolder objects with a document library followed by SPListItem objects that reference the imported File/Folder objects. During the ListItem import, the “Shared With” references data can be imported, and then the security can be applied afterward within the same migration package, by setting up scopes (ACLs) and role assignments (ACEs) for the content hierarchy as needed. Permissions migration is performed using the DeploymentRoleAssignments object with RoleAssignment entries representing specific scopes and Assignment entries representing assignments of specific roles to specific principals. Since this code ends up breaking inheritance for content and applying the specified role assignments, it has the same limitations as using other object model approaches to setting permissions in SharePoint. |
| 27 | + |
| 28 | +> [!NOTE] |
| 29 | +> As you enumerate the security information on the source, you need to assess if you are at risk of hitting the SharePoint limits for ACL sizing (5000 max ACEs with recommendation of below 500 ACEs) and the maximum number of scopes -- unique ACLs.(There is a hard limit of 50,000 unique ACLs with a recommendation of below 5000 unique ACLs per document library). If you are close to reaching these limits, we recommend that the permission model be simplified on the source before migration. |
| 30 | + |
| 31 | +### SharedWithUser column: |
| 32 | + |
| 33 | +SharedWithUsers column (not SharedWithMe) is not created during list creation. It is created during a share event which causes the specific columns to be ensured. If you share an item on a team site or ODB, you should see it get created. It is technically possible that the column could be explicitly created by code in advance of the migration (or in the migration package if we are allowing list column additions, which we may not be currently supporting), but we recommend against that in the case the SharedWithUsers column is not created correctly. For reference purposes, the SharedWithUsers column has a universal hard coded ID and is exported as the following information (note the SourceID value is the web’s ID): |
| 34 | + |
| 35 | +``` |
| 36 | +<Field ID="{ef991a83-108d-4407-8ee5-ccc0c3d836b9}" Type="UserMulti" DisplayName="$Resources:core,SharedWithFieldDisplayName;" Mult="TRUE" Name="SharedWithUsers" StaticName="SharedWithUsers" Group="_Hidden" Sealed="TRUE" AllowDeletion="FALSE" ReadOnly="TRUE" ShowInDisplayForm="FALSE" ShowInEditForm="FALSE" ShowInListSettings="FALSE" Viewable="FALSE" SourceID="{a785ad58-1d57-4f8a-aa71-77170459bd0d}" Version="1" ColName="int1" RowOrdinal="0"/> |
| 37 | +``` |
| 38 | + It may be simpler to try sharing a single test item to someone from the target list before importing the rest of the migration package. This way the column is set up before you attempt to import the rest of the data. It is likely that you will need to verify some data on the target site first, so this could just be an additional preparation step. |
| 39 | + |
| 40 | +**Example:** |
| 41 | + |
| 42 | +Shared to single person<br> |
| 43 | +In the case of a file shared to a single person, the following data structure highlighted in yellow would be seen. Note that the bolded values have different values depending on the field/property in question, and although their additional formatting is different between then, that you must ensure the data is consistent between the three fields/properties: |
| 44 | + |
| 45 | +``` |
| 46 | +<SPObject …> |
| 47 | + <File …> |
| 48 | + <Properties> |
| 49 | + <Property Name="SharedWithUsers" Type="String" Access="ReadWrite" Value="140;#user1" /> |
| 50 | + <Property Name="display_urn:schemas-microsoft-com:office:office#SharedWithUsers" Type="String" Access="ReadWrite" Value="user1" /> |
| 51 | + </Properties> |
| 52 | + </File> |
| 53 | +</SPObject> |
| 54 | +<SPObject …> |
| 55 | + <ListItem …> |
| 56 | + <Fields> |
| 57 | + <Field Name="SharedWithUsers" Value="140;# ;UserInfo" FieldId="ef991a83-108d-4407-8ee5-ccc0c3d836b9" /> |
| 58 | + </Fields> |
| 59 | + </ListItem> |
| 60 | +</SPObject> |
| 61 | +``` |
| 62 | + |
| 63 | +Shared to multiple people<br> |
| 64 | + |
| 65 | +In the case of sharing with multiple people, note that for the main SharedWithUsers property and field the separator value (“;#”) is used not only between the user identifier and user’s title but also between the individual users, whereas for the display url field, only a semicolon is used to separate the display names. |
| 66 | +``` |
| 67 | +<SPObject …> |
| 68 | + <File …> |
| 69 | + <Properties> |
| 70 | + <Property Name="SharedWithUsers" Type="String" Access="ReadWrite" Value="140;#user1;#10;#Tenant Admin User" /> |
| 71 | + <Property Name="display_urn:schemas-microsoft-com:office:office#SharedWithUsers" Type="String" Access="ReadWrite" Value="user1;Tenant Admin User" /> |
| 72 | + </Properties> |
| 73 | + </File> |
| 74 | +</SPObject> |
| 75 | +<SPObject …> |
| 76 | + <ListItem …> |
| 77 | + <Fields> |
| 78 | + <Field Name="SharedWithUsers" Value="140;# ;#10;# ;UserInfo" FieldId="ef991a83-108d-4407-8ee5-ccc0c3d836b9" /> |
| 79 | + </Fields> |
| 80 | + </ListItem> |
| 81 | +</SPObject> |
| 82 | +``` |
0 commit comments