Security boundary update for sandbox solutions in SharePoint Server 2010, 2013, and 2016

The sandbox solutions framework provides a mechanism for executing user-provided code outside the IIS worker process. Sandbox solutions are not supported as a security boundary with user code, especially code of unknown origin. We advise against executing sandbox solutions of unknown origins.

Code-based sandbox solutions were deprecated in SharePoint Online in January 2014. We have implemented processes to manage the execution of sandbox solutions in SharePoint Online.

For on-premises customers, code-based sandbox solutions were deprecated in SharePoint Server 2013. To help you govern the activation of code-based sandbox solutions, Microsoft introduced the Managed Solutions Gallery. To learn more about the Managed Solutions Gallery, see How to use the Managed Solutions Gallery

For more information about sandbox solutions, see Sandboxed Solutions. For information about moving sandbox solutions to the add-in model or alternative solutions, see Sandbox solutions transformation guidance.

Article ID: 3192601 - Last Review: Oct 18, 2016 - Revision: 1

Microsoft SharePoint Server 2010, Microsoft SharePoint Server 2016, Microsoft SharePoint Server 2013