8Bit File

With all the publicity surrounding SharePoint 2010’s new features, there’s an important feature that’s often undersold: sandboxed solutions. Sandboxed solutions, sometimes called user solutions, are a big deal, especially for SharePoint administrators. Put simply, they allow custom enhancements to be easily and safely deployed into your SharePoint environment. In this article, I’ll explain what sandboxed solutions are, help you recognize their advantages and disadvantages, and make sure you understand how to deploy and manage them. Before I get too far, though, I’ll clarify what a solution is in the context of SharePoint.

In addition to being a powerful product, SharePoint is also platform where custom applications can be developed to make SharePoint a better fit for specific needs. For example, you can develop new web parts, workflow, master pages, and many other customizations. The term solution, in this context, refers to the packaging of these customizations into something called a solution package or WSP.

Solution packages were introduced in SharePoint 2007 and are the preferred way of packaging and deploying all types of custom code enhancements. Traditional solution packages from previous versions are now called farm solutions, because they’re added into the farm. Farm solutions are deployed into the file system of your SharePoint web servers. Sandboxed solutions are also based on WSP packages, but are deployed into a site collection and are executed very differently.

Advantages and Drawbacks

The biggest problem with SharePoint’s custom enhancements is the support burden they add. Custom code is the number one root cause for SharePoint support problems, and when it causes problems, it’s usually the SharePoint administrator who’s implicated, not the developer. A troublesome web part, for example, can crash pages where it’s used, and depending on the severity, can take down an application pool and the web application with it. Sandboxed solutions, conversely, aren’t able to destabilize the farm.

Another advantage of sandboxed solutions is their ease of deployment. The SharePoint farm administrator should first review and then must deploy farm solutions. There’s not much guidance out there on how to review, and it really boils down to whether the solution is trusted or not. With sandboxed solutions, there’s no need for a review. They’re simply uploaded and deployed at the site collection level, which gives you the option of empowering site collection administrators with this responsibility. This is better for admins and better for business.

If your SharePoint system is hosted in the cloud, such as with SharePoint Online, you’re probably not able to take advantage of farm solutions. Sandboxed solutions, because they’re safe, can be deployed and used in both hosted and on-premise installations.

There are some limitations to sandboxed solutions, however. Safety features restrict the types of customizations that can be deployed as sandboxed solutions. There are two main ways that sandboxed solutions are controlled: a code access security (CAS) policy and a subset of SharePoint API calls that aren’t allowed. For example, a custom workflow developed with Visual Studio can’t be deployed as a sandboxed solution. To ensure its safety, all code originating from sandboxed solutions is restricted from performing functions outside the sandbox. This includes accessing the file system, registry, and network resources. So there’s no calling into external web services or accessing your ERP databases.

Some developers will lament these limitations, saying they’re too restrictive. As a developer myself, I understand. Sandboxed solutions won’t be the way to deploy all forms of custom code, but they’re certainly valid for a percentage of them. For organizations with hosted SharePoint, these solutions bring a much welcomed degree of flexibility. Also, sandboxed solutions support calling into separate, trusted code running outside the sandbox. This is called full-trust proxy and is a way of working around these limitations.