Deep Dive: SharePoint Server-Side Object Model (SSOM)

A complete guide for Developers, Architects, and Interview Preppers

Introduction

Imagine you are working on a SharePoint on-premises project where you need to create hundreds of lists, manage permissions automatically, or run heavy background jobs that client-side scripts simply cannot handle. JavaScript feels limited, REST APIs are slow for bulk operations, and security requirements are strict.

This is where SSOM (Server-Side Object Model) becomes extremely important.

As a SharePoint developer, I have personally used SSOM in real enterprise projects where performance, full control, and server-level access were required. In this article, I’ll explain what SSOM is, why we use it, and when it is the right choice.

This guide is written for:

Beginners learning SharePoint development
Working professionals maintaining legacy/on-prem systems
Developers preparing for SharePoint interviews

What Is SSOM in SharePoint?

In Microsoft SharePoint, SSOM stands for Server-Side Object Model. It is a programming model that allows developers to access, manage, and manipulate SharePoint data directly from the server using managed code.

"SSOM lets you control SharePoint from inside the server itself."

Key Features:

🔹 Strongly typed classes
🔹 Direct access to SharePoint farm, web applications, sites, lists, users, and permissions
🔹 High performance for large operations

SSOM code runs only on the SharePoint server, uses .NET languages (C# or VB.NET), and requires full trust permissions.

Why SSOM Is Important

SSOM exists because not every SharePoint task can be safely or efficiently done from the client side. We use it when:

We need full access to SharePoint internals.
Operations are resource-intensive.
Code must run with elevated privileges.
Background or scheduled jobs are required.

Where SSOM Can Be Used

Console AppsASP.NET Web AppsEvent ReceiversTimer JobsPowerShell Scripts

⚠️ Important: SSOM cannot be used in SharePoint Online.

Core SSOM Classes

These classes form a hierarchical object model:

SPFarm – Represents the entire SharePoint farm
SPWebApplication – Web applications in the farm
SPSite – Site Collection
SPWeb – Site (Web)
SPList – List or Document Library
SPUser – Users

SSOM vs CSOM vs REST API

Feature	SSOM	CSOM	REST API
Runs on Server	✅ Yes	❌ No	❌ No
SharePoint Online	❌ No	✅ Yes	✅ Yes
Performance (Bulk)	⭐⭐⭐⭐⭐	⭐⭐⭐	⭐⭐
Language	C#, VB.NET	JS, .NET	Any

Real-World Example: Creating a List

Scenario: You want to create a custom list automatically on a site.

using (SPSite site = new SPSite("http://sharepointsite"))
{
    using (SPWeb web = site.OpenWeb())
    {
        SPListCollection lists = web.Lists;
        Guid listId = lists.Add(
            "My Custom List",
            "List created using SSOM",
            SPListTemplateType.GenericList
        );

        SPList list = web.Lists[listId];
        list.OnQuickLaunch = true;
        list.Update();
    }
}

Example: Read All Lists

using (SPSite site = new SPSite("http://sharepointsite"))
{
    using (SPWeb web = site.OpenWeb())
    {
        foreach (SPList list in web.Lists)
        {
            Console.WriteLine(list.Title);
        }
    }
}

Common Mistakes & Best Practices

❌ Common Mistakes

Forgetting to dispose SPSite and SPWeb.
Running heavy logic in UI threads.
Using SSOM in SharePoint Online.
Ignoring security implications.

✅ Best Practices

Always use using blocks.
Prefer Timer Jobs for heavy tasks.
Log errors properly (ULS Logs).
Test in lower environments first.

What is SSOM in SharePoint?

Server-Side Object Model Interview Guide

In SharePoint, SSOM stands for Server-Side Object Model. It is the core programming model that allows developers to access and manipulate the data and functionality of a SharePoint farm from the server itself. Unlike CSOM or REST, SSOM code (C# or VB.NET) runs directly on the SharePoint server context, offering full access to the internal API (SPSite, SPWeb, etc.).

Section 1: SSOM Core Objects & Hierarchy

1. What is the difference between SPSite and SPWeb?

SPSite: Represents a Site Collection (a container for multiple websites). It manages top-level administration, quotas, and content databases.
SPWeb: Represents a single website (sub-site) within a Site Collection. It contains lists, libraries, and pages.

2. What is the SPFarm object?

It is the highest object in the SharePoint hierarchy.
It represents the physical server farm, including config databases and all installed servers.
You need Farm Administrator privileges to manipulate this object programmatically.

3. Why is the SPContext class important?

It provides access to the current HTTP context of the request.
SPContext.Current.Web allows you to access the current web without explicitly instantiating new objects.
It prevents the need for manual disposal of objects it manages.

4. What is the purpose of SPWebApplication?

It represents the IIS Website that hosts SharePoint.
It acts as a container for Site Collections (SPSite).
It manages authentication settings (Claims, Windows) and web.config settings.

5. How do you delete a list item using SSOM?

Get the SPList object.
Retrieve the SPListItem by ID.
Call the item.Delete() method.
Note: You do not need to call Update() after Delete().

6. What happens if you don't dispose of SPSite or SPWeb objects?

It causes memory leaks on the server.
The .NET Garbage Collector does not immediately clean up unmanaged resources used by these objects.
This can crash the w3wp.exe process or degrade server performance significantly.

7. When should you NOT dispose of SPWeb or SPSite?

When accessing them via SPContext.Current.Site or SPContext.Current.Web.
These are managed by the SharePoint framework and disposing them will break the page lifecycle.

8. What is the SPUser object?

Represents a user or a domain group in SharePoint.
Can be accessed via SPWeb.CurrentUser.
Contains properties like Email, LoginName, and Permissions.

9. Can SSOM be used in SharePoint Online?

No. SSOM requires access to the physical server registry and IIS.
SharePoint Online only supports CSOM, REST API, or Microsoft Graph.

10. How do you check if a user is a Site Collection Admin?

Check the SPUser.IsSiteAdmin property.
If true, the user has full control over the entire Site Collection.

Section 2: CAML & Data Operations

11. What is CAML and why use it in SSOM?

Collaborative Application Markup Language (XML-based).
Used to query lists efficiently via SPQuery.
Faster than iterating through SPList.Items which loads all data into memory.

12. Difference between SPQuery and SPSiteDataQuery?

SPQuery: Used to query data from a single list or library.
SPSiteDataQuery: Used to query data across multiple lists in the same site collection (Cross-site query).

13. What is the ViewFields property in SPQuery?

It allows you to specify exactly which columns/fields to retrieve from the database.
Significantly improves performance by reducing the amount of data transferred (SQL to Web Server).

14. How do you update a list item without changing the 'Modified By' field?

Use SystemUpdate(false) or SystemUpdate() instead of Update().
This updates the item but does not trigger the modified date or version history increment.

15. What is the SPList.GetItems method?

It is the method used to execute an SPQuery.
Returns an SPListItemCollection based on the query filter.

16. How do you handle Large Lists (Throttling) in SSOM?

Use SPQuery with ContentIterator to fetch items in batches.
Ensure the query fields are indexed.
Set SPQuery.RowLimit to manage page size.

17. What is Batch Update in SSOM?

Using SPWeb.ProcessBatchData to insert, update, or delete multiple items in one go.
More efficient than looping through items and calling Update() individually.

18. How to retrieve attachments from a list item?

Access the SPListItem.Attachments collection.
Loop through the collection to get the file names and URLs.

19. What is SPFolder?

Represents a folder within a list or library.
You can query items specifically inside a folder using SPQuery.Folder.

20. How do you create a new List programmatically?

Use SPWeb.Lists.Add(title, description, template).
It returns a GUID which can be used to retrieve the new list instance immediately.

Section 3: Security & Advanced Topics

21. What is RunWithElevatedPrivileges?

A delegate method that executes code under the Application Pool Identity (System Account).
Used to perform actions the current logged-in user doesn't have permission to do.

22. What implies creating a new SPSite inside RunWithElevatedPrivileges?

You must instantiate a new SPSite and SPWeb object inside the delegate block.
Using existing objects (like SPContext) inside the block will still use the original user's context.

23. How do you break permission inheritance on a list item?

Call item.BreakRoleInheritance(true/false).
Passing 'true' copies existing permissions; 'false' starts with unique/empty permissions.

24. What is AllowUnsafeUpdates?

A security property on SPWeb.
Must be set to true when performing updates via GET requests or without a security validation form digest (though not recommended for production).

25. What is an Event Receiver in SSOM?

A class that inherits from SPItemEventReceiver.
Allows you to trigger code when items are added, updated, or deleted (Synchronous or Asynchronous).

26. Difference between ItemAdding and ItemAdded?

ItemAdding: Synchronous (runs before the save). Can be cancelled to stop the user action.
ItemAdded: Asynchronous (runs after the save). Cannot be cancelled; used for post-processing.

27. What is a Timer Job?

A scheduled background process run by the SharePoint Timer Service.
Developers create custom jobs by inheriting from SPJobDefinition.

28. How do you deploy SSOM code?

Using WSP (Solution Packages).
Farm Solutions are deployed to the GAC (Global Assembly Cache) or Bin folder via PowerShell (Add-SPSolution).

29. What is SPQueryThrottledException?

An exception thrown when a query exceeds the List View Threshold (typically 5,000 items).
It prevents a single query from locking the entire SQL table.

30. What is the role of web.config in SSOM?

Controls application-level settings like SafeControls, DependentAssembly redirects, and SessionState.
Modifications should be done via SPWebConfigModification class, not manually editing the file.

Mastering these 30 SSOM questions will solidify your understanding of SharePoint Server Side Architecture.

What Is SSOM in SharePoint and Why We Use It? A Complete Developer Guide