Code-based sandbox solutions were deprecated in SharePoint Server 2013 and in SharePoint Online in January of 2014. We began removing code-based sandbox solutions from SharePoint Online in recent months, and as another step in that journey we’re updating our guidance for code-based sandbox solutions in SharePoint Server on premises. In addition, we’re releasing a new capability to help you manage code-based sandbox solutions in running SharePoint 2010, 2013 and 2016.
What are sandbox solutions?
Sandbox solutions are a model for extending SharePoint that was introduced in SharePoint 2010. They provide a way for site collection administrators to add functionality without the intervention of farm administrators. A site collection administrator uploads a sandbox solution (a “.wsp” file) to the solutions gallery, activates it, and new functionality provided by the sandbox solution becomes available.
There are two types of sandbox solutions: declarative and code-based. Declarative sandbox solutions contain no code, so they’re often referred to as “no code sandbox solutions”. Instead, they add functionality through XML configuration and assets. When you save a site as a template, or save a design package with Design Manager, you create a declarative sandbox solution. You can also create a declarative sandbox solution using Visual Studio. Declarative sandbox solutions are fully supported, and there is no change or update related to declarative sandbox solutions.
Code-based sandbox solutions include a custom assembly—custom code—and are used to add functionality that isn’t available in declarative sandbox solutions. Developers create sandbox solutions to create custom web parts, custom workflow actions, event receivers, feature receivers, and more. Some InfoPath forms include code as well, to connect with data sources or to perform custom validation logic, for example. When InfoPath forms contain code, they are a type of code-based sandbox solution.
What guidance has changed regarding code-based sandbox solutions?
Code-based sandbox solutions were deprecated in SharePoint Server 2013. Deprecation is a notification, so on-premises customers running SharePoint 2013 and SharePoint 2016 are aware that the feature will be removed in a future version of SharePoint Server. Code-based sandbox solutions were deprecated in SharePoint Online in January of 2014. We began taking steps to remove code-based sandbox solutions from SharePoint Online in recent months. Customers with code-based sandbox solutions in SharePoint Online have been notified via the message center of updates to the service.
As technology evolves and features are introduced or deprecated, we regularly evaluate our product guidance for how features are used. Previously, code-based sandbox solutions were supported as “security boundaries”, meaning that code in a sandbox solution had limited scope and could not reach beyond a set of defined capabilities. We’re no longer supporting such a security boundary with code-based sandbox solutions, so we’ve updated our guidance, and are letting customers know that they should allow only known and trusted code-based sandbox solutions to execute in their on-premises SharePoint farms. We advise against executing sandbox solutions with code of unknown or untrusted origins.
How can I govern code-based sandbox solutions in light of these changes?
To help customers improve their governance of code-based sandbox solutions and prepare for their removal, we’ve released the Managed Solutions Gallery in the October update for SharePoint Server 2010, 2013 and 2016.
The Managed Solutions Gallery creates a document library that defines known and trusted code-based sandbox solutions. Administrators with permissions to the library (Farm Administrators or delegated admins that have been granted Contribute permission to the library) upload code-based sandbox solutions (“.wsp” files) and, by doing so, approve the solutions for activation in the Web application. When a site collection administrator attempts to activate a solution in his or her site collection, activation is allowed only if the same solution—and the same version of the solution—exists in the Managed Solutions Gallery. This ensures that site collection administrators introduce, activate, and execute only the code-based sandbox that have been approved by administrators.
Note: If you want to implement the Managed Solutions Gallery and you have InfoPath forms with custom code that are viewed by users in the browser (rather than the InfoPath 2013 client application), please read the article listed in the Resources section.
We encourage you to continue migrating sandbox solutions to alternative models. We’ve published documentation to MSDN to facilitate the transition. In that effort, use the tools documented in the MSDN documentation to inventory code-based sandbox solutions in your environment.
Consider implementing the Managed Solutions Gallery, which enables you to centrally manage code-based sandbox solutions so that only trusted code is activated and executed.
As you improve the governance of code-based sandbox solutions, you can increase your understanding of how they are used and establish a dialog and roadmap for migration with business owners of the solutions.
Documentation and tools on MSDN
Managed Solutions Gallery for SharePoint 2010, 2013 and 2016
Updated guidance regarding support of code-based sandbox solutions
Guidance regarding the interaction of the Managed Solutions Gallery and InfoPath forms with code tha...