SharePoint Application Model Evolution

Applications built using the new Apps for SharePoint model predominantly run code on the client device (browser or application) or on application servers run by an ISV or running in a company data center. In this illustration, the earlier two models for SharePoint extensibility are shown in contrast with the new model.

In a farm solution (left), the oldest of the three models, application code (1) runs predominantly in the SharePoint host process and may access resources anywhere in the farm. While application logic can run on external servers run by an ISP or customer, farm solutions enable SharePoint to run most application logic, so solutions often encapsulate it there. Farm solutions require full farm privileges to install and run, and they run in a highly privileged security context. As a result, this model does not lend itself to multitenant scenarios like those required for SharePoint Online or other multitenant hosts.

In sandboxed solutions (2), as the name implies, application code runs in a lesser-privileged process on the SharePoint server, and it can access only resources in the single site collection (top-level SharePoint site) where it is installed, not the entire farm. Sandboxed solutions require only site collection administrator privileges to install and run. In sandboxed solutions, application logic can run on clients or external servers as well as on SharePoint.