Capacity Management - Security limits

Limit	Maximum value	Limit type	Notes
Number of SharePoint groups a user can belong to	5,000	Supported	This is not a hard limit but it is consistent with Active Directory guidelines. There are several things that affect this number: The size of the user token The groups cache: SharePoint Server 2010 has a table that caches the number of groups a user belongs to as soon as those groups are used in access control lists (ACLs). The security check time: as the number of groups that a user is a member of increases, the time that is required for the access check increases also.
Users in a site collection	2 million per site collection	Supported	You can add millions of people to your Web site by using Microsoft Windows security groups to manage security instead of using individual users. This limit is based on manageability and ease of navigation in the user interface. When you have many entries (security groups of users) in the site collection (more than one thousand), you should use Windows PowerShell to manage users instead of the UI. This will provide a better management experience.
Active Directory Principles/Users in a SharePoint group	5,000 per SharePoint group	Supported	SharePoint Server 2010 enables you to add users or Active Directory groups to a SharePoint group. Having up to 5,000 users (or Active Directory groups or users) in a SharePoint group provides acceptable performance. The activities most affected by this limit are as follows: Fetching users to validate permissions. This operation takes incrementally longer with growth in number of users in a group. Rendering the membership of the view. This operation will always require time.
SharePoint groups	10,000 per site collection	Supported	Above 10,000 groups, the time to execute operations is increased significantly. This is especially true of adding a user to an existing group, creating a new group, and rendering group views.
Security principal: size of the Security Scope	5,000 per Access Control List (ACL)	Supported	The size of the scope affects the data that is used for a security check calculation. This calculation occurs every time that the scope changes. There is no hard limit, but the bigger the scope, the longer the calculation takes.