Deferred Sharing Maintenance

In addition to all the technical concerns administrators must manage to perform a major realignment, they must also coordinate closely with the business to ensure that end users aren’t adversely affected when access rights are being adjusted. In an enterprise environment in which multiple systems are continually processing updates, it can be difficult to schedule an organization or sharing rule change that can take substantial time to complete. Deferred sharing maintenance can help with increasing the predictability of these kinds of updates.

Here’s how deferred sharing maintenance works.

1. Based on requests from the business, an administrator identifies a number of changes to the role hierarchy and group membership, or updates to sharing rules.
2. Given best estimates of the remaining overall work, the administrator negotiates a maintenance window for completing the processing.

   This window should be modeled in a full copy sandbox to get the best estimate possible.

   Tip

3. Instead of processing each separate update and waiting for it to complete, the administrator prepares all the information required to perform all updates ahead of the planned maintenance window.
4. At the start of the maintenance window, the administrator uses the deferral feature to essentially “turn off” processing of group maintenance operations, and then makes all the desired changes to role and group membership at the same time.

   Sharing rule processing is also deferred at this time so the administrator can perform all sharing rule updates.

   Note

5. After the changes have completed, the administrator resumes processing group maintenance, and the system performs a recalculation to make all the role and group changes take effect.
6. At this point, the system is in a state that requires a full recalculation of all sharing rules for user access rights to be complete and accurate. The administrator can resume sharing rule processing immediately or wait to start the process at a later time. After the sharing rule recalculation has completed, all the access changes take effect.

When using the deferred sharing features, it's especially important to test the whole process in a full copy sandbox. This practice helps benchmark how long the overall recalculation is likely to take in production and smooth out any kinks in orchestrating deferred sharing maintenance. The full copy sandbox should mimic your current product environment as closely as possible. We recommend using a sandbox refreshed within the last 30 days that reflects all major changes.