When to use Deprecated. Therefore, Best practice. Create Create it’s unadvisable to apps whenever you farm build new sandboxed can. solutions solutions. when you can’t do it in an app. See for more info. Server-side code Runs under a strict No SharePoint Can run CAS policy and is When apps are full trust limited in what it can hosted in an isolated code or do. SharePoint site, no run under server-code whatsoever fine is allowed. grained custom CAS policies. Resource throttling Run under an advanced Apps run isolated from a Can impact resource management SharePoint farm, but can SharePoint system that allows have an indirect impact resource point by leveraging the client allocation and automatic object model. stability shutdown for directly. troublesome solutions. Runs cross-domain No, and no need Yes, which provides a No, and to since code runs very interesting way to there’s no within the SharePoint distribute server loads. need to farm. since code runs within the SharePoint farm. Efficiency/Performance Runs on the server farm, Apps hosted on separate Very but in a dedicated app servers (even efficient. isolated process. The or in the cloud sandbox architecture may cause considerable provides overhead. overhead. Safety Very safe. Apps rely on OAuth 2.0. Can be very The OAuth 2.0 standard safe, but is surrounded by some this controversy (for requires example, check out what additional OAuth lead author Eran testing, Hammer has to say about validation it here: . In fact, some and SharePoint experts have potential gone on the record monitoring.
When to use Deprecated. Therefore, it’s unadvisable to build new sandboxed solutions. Best practice. Create apps whenever you can. Create farm solutions when you can’t do it in an app. See for more info. Server-side code Runs under a strict CAS policy and is limited in what it can do. No SharePoint When apps are hosted in an isolated SharePoint site, no server-code whatsoever is allowed. Can run full trust code or run under fine grained custom CAS policies. Resource throttling Run under an advanced resource management system that allows resource point allocation and automatic shutdown for troublesome solutions. Apps run isolated from a SharePoint farm, but can have an indirect impact by leveraging the client object model. Can impact SharePoint stability directly. Runs cross-domain No, and no need to since code runs within the SharePoint farm. Yes, which provides a very interesting way to distribute server loads. No, and there’s no need to since code runs within the SharePoint farm. Efficiency/Performance Runs on the server farm, but in a dedicated isolated process. The sandbox architecture provides overhead. Apps hosted on separate app servers (even or in the cloud may cause considerable overhead. Very efficient. Safety Very safe. Apps rely on OAuth 2.0. The OAuth 2.0 standard is surrounded by some controversy (for example, check out what OAuth lead author Eran Hammer has to say about it here: . In fact, some SharePoint experts have gone on the record Can be very safe, but this requires additional testing, validation and potential monitoring.