Update Set-SPOTenantPreAuthSettings.md by nellymo · Pull Request #1215 · MicrosoftDocs/OfficeDocs-SharePoint-PowerShell

Neil Hodgkinson (nellymo) · 2026-09-15T18:45:19Z

Submitted via Learn Editor.

github-actions · 2026-09-15T18:47:06Z

sachin-lalwani
You've been added as a reviewer to this pull request because you're listed as a Content Lead for the product area or feature covered by one or more articles in this PR.

Before this PR can be merged, a Content Lead needs to add the Sign off label to it. Only one of the listed reviewers needs to add the Sign off label. Before you sign off a PR, confirm the following:

The PR is not in draft state. When the changes in this PR are ready to be published, select the Ready to merge button at the bottom of the page.
Article content has been checked for technical accuracy.
There are no errors or warnings in build validation.
There are no severity 1 or 2 PoliCheck issues.
All required PR checks at the bottom of the PR are passing.

After you've confirmed the above, do the following to sign off:

Select the gear next to Labels.
Select Sign off from the label list.
Click away from the label list.

After you've signed off, our operations (PubOps) team will review the PR for issues that may impact formatting and the customer experience. If any changes are needed, they will return
the PR to the submitter with required changes. After they've completed those changes, you need to sign off again.

When the PR passes PubOps review, they'll merge the PR. If the PR is merged into the main branch, changes will go live within the next couple hours.

If you think you were incorrectly added as a reviewer, have questions about this process, or need help signing off on this PR, post a message to https://aka.ms/tcphelp.

learn-build-service-prod · 2026-09-15T18:47:24Z

Learn Build status updates of commit 128a761:

✅ Validation status: passed

File	Status	Preview URL	Details
sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOTenantPreAuthSettings.md	✅Succeeded	View (sharepoint-ps)

For more details, please refer to the build report.

learn-build-service-prod · 2026-09-15T18:47:31Z

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.

learn-build-service-prod · 2026-09-15T18:49:31Z

Learn Build status updates of commit de09450:

✅ Validation status: passed

File	Status	Preview URL	Details
sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOTenantPreAuthSettings.md	✅Succeeded	View (sharepoint-ps)

For more details, please refer to the build report.

Neil Hodgkinson (nellymo)

Updated documentation to include additional tempauth deprecation mcdlets

lw-msft · 2026-09-15T23:04:02Z

 | WebRendering         | Scenarios for rendering previews of files in browser.                    |                                                                                                            |
 | WebRenderingEmbed    | Embed SharePoint files in another application. 3rd party application and some 1st party applications may be broken | [Embed Web Part](https://support.microsoft.com/office/add-content-to-your-page-using-the-embed-web-part-721f3b2f-437f-45ef-ac4e-df29dba74de8) |
 | Whiteboard           | Teams integration with Whiteboard app will be broken for anonymous and guest users. | [Use Whiteboard in a Teams meeting - Microsoft Support](https://support.microsoft.com/office/use-whiteboard-in-a-teams-meeting-26f87802-b37f-4af0-806d-af79fbfb8ae6) |



I think we also missed the "Expected behavior for the Microsoft Graph URL settings" section from the original .md file.

I have added this a little further up in the doc. Let me know if you think it should be at the bottom and I can move it today.

Updated documentation for Set-SPOTenantPreAuthSettings to include new expected API behaviors and parameters related to Microsoft Graph URL settings. Added missing parameters and API behavior

Neil Hodgkinson (nellymo)

Engineering to check on the changes

learn-build-service-prod · 2026-09-16T01:00:40Z

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.

learn-build-service-prod · 2026-09-16T01:02:11Z

Learn Build status updates of commit b742f65:

✅ Validation status: passed

File	Status	Preview URL	Details
sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOTenantPreAuthSettings.md	✅Succeeded	View (sharepoint-ps)

For more details, please refer to the build report.

lw-msft · 2026-09-24T17:20:29Z

+
+For APIs with a Microsoft Graph alternative, if the setting is enabled for the calling application, the response uses a Microsoft Graph URL, and the application can call that URL by using an appropriate Microsoft Graph access token.
+
+For APIs without a Microsoft Graph alternative, the returned SharePoint Online URL does not contain temporary authentication information. The application must obtain an appropriate Microsoft Entra access token for SharePoint Online and include it when calling the returned URL.


We actually keep the behavior the same. So in this case we still return preauth urls.

We can use this from the previous docs:
For APIs without a Microsoft Graph URL alternative, the response will continue to include a preauthenticated SharePoint Online URL.

Updated to reflect the correct statement

lw-msft · 2026-09-24T17:23:33Z

+
+For APIs without a Microsoft Graph alternative, the returned SharePoint Online URL does not contain temporary authentication information. The application must obtain an appropriate Microsoft Entra access token for SharePoint Online and include it when calling the returned URL.
+
+**APIs that currently return an HTTP 302 redirect**


This change is not made yet. Perhaps exclude for now?

Removed the HTTP redirect section

lw-msft · 2026-09-24T17:28:44Z

+
+The tenant setting applies when the original request is made through Microsoft Graph. It does not change requests that applications make directly to SharePoint APIs.
+
+**Affected API scenarios**


Same as above. Some of these changes are not available yet. Should we exclude them?

lw-msft , Can you elaborate on which scenarios are not included yet. We can add them back as they become available.

lw-msft · 2026-09-24T17:35:55Z

+
+Affected APIs return content directly rather than redirecting the application to a temporary authentication URL. Applications must not depend on intercepting the redirect, extracting a temporary authentication value from the redirect location, passing the redirected URL to an unauthenticated client, or assuming that every content request returns an HTTP 302 status code. Applications should be prepared to process a successful content response from the original Microsoft Graph request.
+
+**Direct SharePoint API requests**


This is a good callout we should keep this

Adriana Wood (AdwoodMicrosoft)

The added Graph URL guidance is important, but the current head still contains technically disputed behavior that could cause application authentication failures:

Line 78 says APIs without a Microsoft Graph URL alternative return a SharePoint Online URL without temporary authentication information. The existing technical-review thread says those APIs continue returning a preauthenticated SharePoint URL until the broader retirement change. This also matches the published tempauth retirement guidance. Please correct the current-behavior statement and distinguish today's opt-in behavior from the April 1, 2027 retirement behavior.
Lines 80-102 still document removal of HTTP 302 redirects and several API-specific behavior changes. The reviewer stated that some of these changes weren't implemented yet and suggested excluding them. Those threads remain unresolved. Please remove, clearly future-date, or product-owner-verify every scenario before publication.
The replies saying the redirect section was removed and line 78 was corrected aren't represented in a commit: the current head is still b742f65, and the disputed text remains. Please push the actual corrections and resolve the threads against the resulting head.
Add the effective timeline and lifecycle details, including the April 1, 2027 behavior-change date, whether -UseGraphUrlIsEnabled and -UseGraphUrlAppsList are currently shipped or preview, and the minimum SharePoint Online Management Shell version that contains them. Confirm that the syntax, parameter types/defaults, empty-list semantics, and supported API matrix match the released module.
The branch is behind main; please update it and rerun validation after the technical corrections.

The current automated checks pass, but they only show that this revision builds and meets structural policy. They don't validate runtime API behavior or feature availability.

Authoritative retirement guidance: https://devblogs.microsoft.com/microsoft365dev/pre-authenticated-tempauth-urls-are-retiring-move-to-microsoft-entra-id-tokens-before-april-1-2027/

Neil Hodgkinson (nellymo) added 2 commits September 15, 2026 13:45

Learn Editor: Update Set-SPOTenantPreAuthSettings.md

128a761

Learn Editor: Update Set-SPOTenantPreAuthSettings.md

de09450

Neil Hodgkinson (nellymo) marked this pull request as ready for review September 15, 2026 18:45

github-actions Bot added Microsoft submitter sharepoint-server-itpro/svc labels Sep 15, 2026

github-actions Bot requested a review from sachin-lalwani September 15, 2026 18:47

Neil Hodgkinson (nellymo) commented Sep 15, 2026

View reviewed changes

lw-msft reviewed Sep 15, 2026

View reviewed changes

Comment thread sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOTenantPreAuthSettings.md

lw-msft reviewed Sep 15, 2026

View reviewed changes

Enhance documentation for Set-SPOTenantPreAuthSettings

b742f65

Updated documentation for Set-SPOTenantPreAuthSettings to include new expected API behaviors and parameters related to Microsoft Graph URL settings. Added missing parameters and API behavior

Neil Hodgkinson (nellymo) commented Sep 16, 2026

View reviewed changes

lw-msft reviewed Sep 24, 2026

View reviewed changes

Adriana Wood (AdwoodMicrosoft) suggested changes Oct 12, 2026

View reviewed changes

Adriana Wood (AdwoodMicrosoft) added the Back to submitter The pull request didn't pass the review criteria and has been returned to the writer for updates label Oct 12, 2026

Sam M. Kabue (samkabue-msft) added Sign off The pull request is ready to be reviewed and merged by PubOps and removed Back to submitter The pull request didn't pass the review criteria and has been returned to the writer for updates labels Oct 16, 2026


		For APIs with a Microsoft Graph alternative, if the setting is enabled for the calling application, the response uses a Microsoft Graph URL, and the application can call that URL by using an appropriate Microsoft Graph access token.

		For APIs without a Microsoft Graph alternative, the returned SharePoint Online URL does not contain temporary authentication information. The application must obtain an appropriate Microsoft Entra access token for SharePoint Online and include it when calling the returned URL.


		For APIs without a Microsoft Graph alternative, the returned SharePoint Online URL does not contain temporary authentication information. The application must obtain an appropriate Microsoft Entra access token for SharePoint Online and include it when calling the returned URL.

		APIs that currently return an HTTP 302 redirect


		The tenant setting applies when the original request is made through Microsoft Graph. It does not change requests that applications make directly to SharePoint APIs.

		Affected API scenarios


		Affected APIs return content directly rather than redirecting the application to a temporary authentication URL. Applications must not depend on intercepting the redirect, extracting a temporary authentication value from the redirect location, passing the redirected URL to an unauthenticated client, or assuming that every content request returns an HTTP 302 status code. Applications should be prepared to process a successful content response from the original Microsoft Graph request.

		Direct SharePoint API requests

Conversation

Neil Hodgkinson (nellymo) commented Sep 15, 2026

Uh oh!

github-actions Bot commented Sep 15, 2026

Uh oh!

learn-build-service-prod Bot commented Sep 15, 2026

✅ Validation status: passed

Uh oh!

learn-build-service-prod Bot commented Sep 15, 2026

PoliCheck Scan Report

✅ No issues found

More information about PoliCheck

Uh oh!

learn-build-service-prod Bot commented Sep 15, 2026

✅ Validation status: passed

Uh oh!

Neil Hodgkinson (nellymo) left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Neil Hodgkinson (nellymo) left a comment

Choose a reason for hiding this comment

Uh oh!

learn-build-service-prod Bot commented Sep 16, 2026

PoliCheck Scan Report

✅ No issues found

More information about PoliCheck

Uh oh!

learn-build-service-prod Bot commented Sep 16, 2026

✅ Validation status: passed

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lw-msft Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Adriana Wood (AdwoodMicrosoft) left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

lw-msft Sep 24, 2026 •

edited

Loading