diff --git a/sharepoint/TOC.yml b/sharepoint/TOC.yml index b5ef71ac3..e66b729f6 100644 --- a/sharepoint/TOC.yml +++ b/sharepoint/TOC.yml @@ -1,2 +1,26 @@ - name: Index - href: index.md \ No newline at end of file + href: index.md +- name: Clear-SPOSiteRestrictedAppAccessControlList + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md +- name: Clear-SPOSiteRestrictedAppAccessControlPolicy + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrolpolicy.md +- name: Clear-SPOTenantRestrictedAppAccessControlPolicy + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spotenantrestrictedappaccesscontrolpolicy.md +- name: Disable-SPOSiteRestrictedAppAccessControl + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spositerestrictedappaccesscontrol.md +- name: Disable-SPOTenantRestrictedAppAccessControl + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spotenantrestrictedappaccesscontrol.md +- name: Enable-SPOSiteRestrictedAppAccessControl + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spositerestrictedappaccesscontrol.md +- name: Enable-SPOTenantRestrictedAppAccessControl + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spotenantrestrictedappaccesscontrol.md +- name: Get-SPOSiteRestrictedAppAccessControl + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spositerestrictedappaccesscontrol.md +- name: Get-SPOTenantRestrictedAppAccessControl + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spotenantrestrictedappaccesscontrol.md +- name: Set-SPOSiteRestrictedAppAccessControlList + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrollist.md +- name: Set-SPOSiteRestrictedAppAccessControlMode + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrolmode.md +- name: Set-SPOTenantRestrictedAppAccessControlList + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spotenantrestrictedappaccesscontrollist.md diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlList.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlList.md new file mode 100644 index 000000000..84d66d8fb --- /dev/null +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlList.md @@ -0,0 +1,204 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/clear-spositerestrictedappaccesscontrollist +applicable: SharePoint Online +title: Clear-SPOSiteRestrictedAppAccessControlList +schema: 2.0.0 +ms.author: neilh +ms.reviewer: neilh +description: Clear-SPOSiteRestrictedAppAccessControlList removes all entries from a site's allow or deny list in SharePoint Online. Learn syntax, examples, and parameters. +ms.date: 10/13/2026 +ms.topic: reference +--- + +# Clear-SPOSiteRestrictedAppAccessControlList + +## SYNOPSIS + +Clears a site's Application Restrictions allow or deny list while preserving the other list, active mode, and site enablement. + +## SYNTAX + +```powershell +Clear-SPOSiteRestrictedAppAccessControlList -Identity -ListType [-WhatIf] [-Confirm] [] +``` + +## DESCRIPTION + +Use the `Clear-SPOSiteRestrictedAppAccessControlList` cmdlet to clear the allow list or deny list on a single site. Clearing one list preserves the other list, active mode, and site enablement. To remove the complete policy, use `Clear-SPOSiteRestrictedAppAccessControlPolicy`. + +A site stores both lists, but only the list selected by the active mode participates in enforcement: + +- **Allow** mode enforces the allow list. Listed applications pass the Application Restrictions check, and all other governed applications are denied by the site policy. +- **Deny** mode enforces the deny list. Listed applications are denied by the site policy, and all other governed applications pass the Application Restrictions check. + +When the cleared list is the one the active mode enforces, the cmdlet emits a warning before confirmation. Clearing the active allow list causes the site policy to deny all governed third-party and agentic applications. Clearing the active deny list means the site policy no longer denies any governed applications. This warning describes only the Application Restrictions policy decision and never means that an application is granted access. Existing Microsoft Entra consent and SharePoint authorization still apply. The warning also states whether the change takes effect immediately or when enforcement is next enabled. + +Clearing an inactive list doesn't change current enforcement, but it still supports `-WhatIf` and `-Confirm`, and it's audited. + +Configuration and enablement are orthogonal. List changes never turn enforcement on, so clearing a list on a site that isn't enabled leaves the site disabled and stages the change for the next time enforcement is enabled with `Enable-SPOSiteRestrictedAppAccessControl`. This avoids the dangerous case where adding a single ID to an unconfigured site would immediately activate an allow list and block every other application. + +The tenant switch gates all site enforcement. A site policy has no effect while the tenant switch is off, and the tenant deny list can't be overridden by a site allow list, so clearing a site deny list never restores access for an application that the tenant denies. + +Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and Application Restrictions. + +Site Application Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. Application Restrictions is fully decoupled from `SiteProperties`, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated Application Restrictions cmdlets listed in [Related Links](#related-links). + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +```powershell +Clear-SPOSiteRestrictedAppAccessControlList -Identity "https://contoso.sharepoint.com/sites/Finance" -ListType DenyList +``` + +This example clears the deny list on the Finance site. It preserves the allow list, active mode, and site enablement. If `Deny` is the active mode, the cmdlet warns that the site policy no longer denies governed applications in that list. Existing Microsoft Entra consent and SharePoint authorization still apply. + +### Example 2 + +```powershell +Clear-SPOSiteRestrictedAppAccessControlList -Identity "e1b2c3d4-5678-4abc-9def-0123456789ab" -ListType AllowList -WhatIf +``` + +This example identifies the site by site ID and previews clearing the allow list without changing the policy. Every site Application Restrictions cmdlet accepts `-Identity` as either a site URL or a site ID. + +### Example 3 + +```powershell +$url = "https://contoso.sharepoint.com/sites/Finance" +Clear-SPOSiteRestrictedAppAccessControlList -Identity $url -ListType AllowList +Set-SPOSiteRestrictedAppAccessControlList -Identity $url -ListType AllowList -AddRestrictedAppIds "11111111-1111-1111-1111-111111111111" +``` + +This example rebuilds an allow list from scratch. Because list changes are configuration-only, neither command changes whether the site is enabled. + +### Example 4 + +```powershell +Clear-SPOSiteRestrictedAppAccessControlList -Identity "https://contoso.sharepoint.com/sites/Finance" -ListType DenyList -Confirm:$false +``` + +This example clears the deny list without an interactive confirmation prompt, for use in automation. Using `-Confirm:$false` doesn't bypass validation, authorization, auditing, or first-party protection. + +## PARAMETERS + +### -Identity + +> Applicable: SharePoint Online + +Specifies the site to change. Provide either the site URL or the site ID. + +```yaml +Type: System.String +Parameter Sets: (All) +Aliases: + +Required: True +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -ListType + +> Applicable: SharePoint Online + +Specifies which list to clear. Entry mutations must explicitly identify the target list. The valid values are: + +- `AllowList` +- `DenyList` + +```yaml +Type: System.String +Parameter Sets: (All) +Aliases: +Accepted values: AllowList, DenyList + +Required: True +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm + +> Applicable: SharePoint Online + +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: cf + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf + +> Applicable: SharePoint Online + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: wi + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### None + +## OUTPUTS + +### None + +This cmdlet doesn't return an object. Use `Get-SPOSiteRestrictedAppAccessControl` to read the resulting policy. + +## NOTES + +- Clearing one list preserves the other list, the active mode, and site enablement. +- Clearing the list that the active mode enforces changes the Application Restrictions policy decision. An empty active allow list causes the site policy to deny all governed third-party and agentic applications. An empty active deny list means the site policy denies none of them. Existing Microsoft Entra consent and SharePoint authorization still apply. The cmdlet warns before confirmation and states whether the change takes effect immediately or when enforcement is next enabled. +- Clearing an inactive list doesn't change current enforcement, but the operation still supports `-WhatIf` and `-Confirm` and is audited. +- List changes never turn enforcement on. Site enforcement is turned on only by `Enable-SPOSiteRestrictedAppAccessControl`. +- The tenant switch gates all site enforcement, so a site policy has no effect while the tenant switch is off. The tenant deny list can't be overridden by a site allow list. +- Application Restrictions never grants permissions. A request must still pass existing SharePoint authorization. +- This cmdlet supports `-WhatIf` and `-Confirm` with `ConfirmImpact.High`. `-Confirm:$false` is allowed for automation and doesn't bypass validation, authorization, auditing, or first-party protection. + +## RELATED LINKS + +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) + +[Set-SPOSiteRestrictedAppAccessControlMode](Set-SPOSiteRestrictedAppAccessControlMode.md) + +[Set-SPOSiteRestrictedAppAccessControlList](Set-SPOSiteRestrictedAppAccessControlList.md) + +[Enable-SPOSiteRestrictedAppAccessControl](Enable-SPOSiteRestrictedAppAccessControl.md) + +[Disable-SPOSiteRestrictedAppAccessControl](Disable-SPOSiteRestrictedAppAccessControl.md) + +[Clear-SPOSiteRestrictedAppAccessControlPolicy](Clear-SPOSiteRestrictedAppAccessControlPolicy.md) + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlPolicy.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlPolicy.md new file mode 100644 index 000000000..a14e16bea --- /dev/null +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlPolicy.md @@ -0,0 +1,169 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/clear-spositerestrictedappaccesscontrolpolicy +applicable: SharePoint Online +title: Clear-SPOSiteRestrictedAppAccessControlPolicy +schema: 2.0.0 +ms.author: neilh +ms.reviewer: neilh +description: Clear-SPOSiteRestrictedAppAccessControlPolicy removes a site's Application Restrictions policy, disabling enforcement and clearing lists. Learn syntax and examples. +ms.date: 10/13/2026 +ms.topic: reference +--- + +# Clear-SPOSiteRestrictedAppAccessControlPolicy + +## SYNOPSIS + +Removes the complete Application Restrictions policy from a site. The cmdlet disables enforcement and removes the active mode and both lists. + +## SYNTAX + +```powershell +Clear-SPOSiteRestrictedAppAccessControlPolicy -Identity [-WhatIf] [-Confirm] [] +``` + +## DESCRIPTION + +Use the `Clear-SPOSiteRestrictedAppAccessControlPolicy` cmdlet to return a site to its unconfigured state. The cmdlet disables enforcement, removes the active mode and both lists, and clears the stored site policy. After the policy is cleared, the site is in the same state as a site that was never configured: enforcement is disabled and there are no entries. + +Clearing is different from disabling. `Disable-SPOSiteRestrictedAppAccessControl` turns off enforcement but preserves the active mode and both lists so the same configuration can be re-enabled later. Use `Clear-SPOSiteRestrictedAppAccessControlPolicy` when you want the configuration removed as well. To clear only one list and keep the other list, the mode, and site enablement, use `Clear-SPOSiteRestrictedAppAccessControlList`. + +Because the mode is removed along with the lists, a cleared site can't be enabled again until a mode is set. `Enable-SPOSiteRestrictedAppAccessControl` fails when no mode is set; enabled with mode `None` is the only combination the backend rejects. Rebuild the policy with `Set-SPOSiteRestrictedAppAccessControlMode` and `Set-SPOSiteRestrictedAppAccessControlList`, then enable it explicitly. Configuration and enablement are orthogonal: mode and list changes never turn enforcement on, so an administrator can stage a policy and then enable it. This avoids the dangerous case where adding a single ID to an unconfigured site would immediately activate an allow list and block every other application. + +Clearing a site policy affects only that site. The tenant switch gates all site enforcement, and the tenant deny list can't be overridden by a site allow list, so clearing a site policy never restores access for an application that the tenant denies. Use `Clear-SPOTenantRestrictedAppAccessControlPolicy` for the tenant scope. + +Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and Application Restrictions, so clearing a site policy doesn't grant any application access it doesn't already have. + +Site Application Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. Application Restrictions is fully decoupled from `SiteProperties`, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated Application Restrictions cmdlets listed in [Related Links](#related-links). + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +```powershell +Clear-SPOSiteRestrictedAppAccessControlPolicy -Identity "https://contoso.sharepoint.com/sites/Finance" +``` + +This example removes the complete Application Restrictions policy from the Finance site. It disables enforcement and removes the active mode, allow list, and deny list. + +### Example 2 + +```powershell +Clear-SPOSiteRestrictedAppAccessControlPolicy -Identity "e1b2c3d4-5678-4abc-9def-0123456789ab" -WhatIf +``` + +This example identifies the site by site ID and previews the change without modifying the policy. Every site Application Restrictions cmdlet accepts `-Identity` as either a site URL or a site ID. + +### Example 3 + +```powershell +$url = "https://contoso.sharepoint.com/sites/Finance" +Clear-SPOSiteRestrictedAppAccessControlPolicy -Identity $url -Confirm:$false +Set-SPOSiteRestrictedAppAccessControlMode -Identity $url -Mode Deny +Set-SPOSiteRestrictedAppAccessControlList -Identity $url -ListType DenyList -AddRestrictedAppIds "11111111-1111-1111-1111-111111111111" +Enable-SPOSiteRestrictedAppAccessControl -Identity $url +``` + +This example removes an existing policy and then rebuilds it from scratch. Because the mode is removed when the policy is cleared, you must assign a mode to the site before you can enable it. + +## PARAMETERS + +### -Identity + +> Applicable: SharePoint Online + +Specifies the site whose policy is cleared. Provide either the site URL or the site ID. + +```yaml +Type: System.String +Parameter Sets: (All) +Aliases: + +Required: True +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm + +> Applicable: SharePoint Online + +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: cf + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf + +> Applicable: SharePoint Online + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: wi + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### None + +## OUTPUTS + +### None + +This cmdlet doesn't return an object. Use `Get-SPOSiteRestrictedAppAccessControl` to confirm that the site is unconfigured. + +## NOTES + +- Clearing a site policy disables enforcement, removes the active mode and both lists, and clears the stored site policy. A cleared site is indistinguishable from a site that was never configured. +- To keep the configuration for later use, use `Disable-SPOSiteRestrictedAppAccessControl` instead. It preserves the active mode and both lists. +- To clear only one list, use `Clear-SPOSiteRestrictedAppAccessControlList`, which preserves the other list, the active mode, and site enablement. +- After clearing, the site can't be enabled until a mode is set. `Enable-SPOSiteRestrictedAppAccessControl` fails when no mode is set. +- The tenant switch gates all site enforcement, so a site policy has no effect while the tenant switch is off. The tenant deny list can't be overridden by a site allow list. +- Application Restrictions never grants permissions. A request must still pass existing SharePoint authorization. +- This cmdlet supports `-WhatIf` and `-Confirm` with `ConfirmImpact.High`. `-Confirm:$false` is allowed for automation and doesn't bypass validation, authorization, auditing, or first-party protection. + +## RELATED LINKS + +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) + +[Set-SPOSiteRestrictedAppAccessControlMode](Set-SPOSiteRestrictedAppAccessControlMode.md) + +[Set-SPOSiteRestrictedAppAccessControlList](Set-SPOSiteRestrictedAppAccessControlList.md) + +[Enable-SPOSiteRestrictedAppAccessControl](Enable-SPOSiteRestrictedAppAccessControl.md) + +[Disable-SPOSiteRestrictedAppAccessControl](Disable-SPOSiteRestrictedAppAccessControl.md) + +[Clear-SPOSiteRestrictedAppAccessControlList](Clear-SPOSiteRestrictedAppAccessControlList.md) + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOTenantRestrictedAppAccessControlPolicy.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOTenantRestrictedAppAccessControlPolicy.md new file mode 100644 index 000000000..c6b166fd6 --- /dev/null +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOTenantRestrictedAppAccessControlPolicy.md @@ -0,0 +1,145 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/clear-spotenantrestrictedappaccesscontrolpolicy +applicable: SharePoint Online +title: Clear-SPOTenantRestrictedAppAccessControlPolicy +schema: 2.0.0 +ms.author: neilh +ms.reviewer: neilh +description: Clear-SPOTenantRestrictedAppAccessControlPolicy disables tenant Application Restrictions enforcement and clears the deny list. Learn syntax, parameters, and examples. +ms.date: 10/13/2026 +ms.topic: reference +--- + +# Clear-SPOTenantRestrictedAppAccessControlPolicy + +## SYNOPSIS + +Turns off the tenant Application Restrictions enforcement switch and clears the tenant-wide deny list. + +## SYNTAX + +```powershell +Clear-SPOTenantRestrictedAppAccessControlPolicy [-WhatIf] [-Confirm] [] +``` + +## DESCRIPTION + +Use the `Clear-SPOTenantRestrictedAppAccessControlPolicy` cmdlet to reset the tenant Application Restrictions policy. The cmdlet disables the tenant enforcement switch and clears the tenant-wide deny list in one operation. + +Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and Application Restrictions. + +The tenant switch gates the tenant deny list and all site-level enforcement. Turning it off stops enforcement for every site policy whose site-level `Enabled` flag is `True`, not only the tenant deny list. The cmdlet warns about this effect before confirmation. + +The tenant scope is deny-only with a single list, so there's no separate clear-list cmdlet. To empty the deny list while keeping the tenant switch on for enabled site policies, remove its application IDs with `Set-SPOTenantRestrictedAppAccessControlList`. Use `Clear-SPOTenantRestrictedAppAccessControlPolicy` to remove the tenant policy entirely. + +Use this cmdlet when you want to remove the tenant configuration entirely. If you want to stop enforcement but keep the deny list for later, use `Disable-SPOTenantRestrictedAppAccessControl` instead. If you want to remove only selected application IDs, use `Set-SPOTenantRestrictedAppAccessControlList` with `-RemoveRestrictedAppIds`. + +Removing IDs doesn't require Microsoft Graph, so stale or deleted applications on the tenant deny list are cleared along with the rest of the list. + +Tenant Application Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. Application Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +```powershell +Clear-SPOTenantRestrictedAppAccessControlPolicy +``` + +This example turns off the tenant enforcement switch and clears the tenant deny list. The cmdlet warns that this also stops enforcement for every site policy whose site-level `Enabled` flag is `True`, and then prompts for confirmation. + +### Example 2 + +```powershell +Clear-SPOTenantRestrictedAppAccessControlPolicy -WhatIf +``` + +This example shows what would happen if the tenant policy were cleared, without changing the stored tenant policy. + +### Example 3 + +```powershell +Get-SPOTenantRestrictedAppAccessControl +Clear-SPOTenantRestrictedAppAccessControlPolicy -Confirm:$false +Get-SPOTenantRestrictedAppAccessControl +``` + +This example reads the current tenant policy, clears it without prompting for confirmation, and reads the policy again to confirm that `Enabled` is `False` and `RestrictedAppIds` is empty. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. + +## PARAMETERS + +### -Confirm + +> Applicable: SharePoint Online + +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: cf + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf + +> Applicable: SharePoint Online + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: wi + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### None + +## OUTPUTS + +### None + +This cmdlet doesn't return an output object. Use `Get-SPOTenantRestrictedAppAccessControl` to confirm the resulting tenant policy. + +## NOTES + +- This cmdlet disables the tenant switch and clears the tenant deny list. To stop enforcement while preserving the deny list, use `Disable-SPOTenantRestrictedAppAccessControl`. +- The tenant switch gates the tenant deny list and all site-level enforcement. Turning it off stops enforcement for every site policy whose site-level `Enabled` flag is `True`, not only the tenant deny list. The cmdlet warns about this effect before confirmation. +- The tenant scope is deny-only with a single list, so there's no separate clear-list cmdlet at tenant scope. +- Clearing doesn't call Microsoft Graph, so stale or deleted application IDs are removed with the rest of the list. +- This cmdlet doesn't remove site policy configuration. Use `Clear-SPOSiteRestrictedAppAccessControlPolicy` to clear the policy for an individual site. + +## RELATED LINKS + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Set-SPOTenantRestrictedAppAccessControlList](Set-SPOTenantRestrictedAppAccessControlList.md) + +[Enable-SPOTenantRestrictedAppAccessControl](Enable-SPOTenantRestrictedAppAccessControl.md) + +[Disable-SPOTenantRestrictedAppAccessControl](Disable-SPOTenantRestrictedAppAccessControl.md) + +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOSiteRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOSiteRestrictedAppAccessControl.md new file mode 100644 index 000000000..888b050c2 --- /dev/null +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOSiteRestrictedAppAccessControl.md @@ -0,0 +1,165 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/disable-spositerestrictedappaccesscontrol +applicable: SharePoint Online +title: Disable-SPOSiteRestrictedAppAccessControl +schema: 2.0.0 +ms.author: neilh +ms.reviewer: neilh +description: Learn how to use Disable-SPOSiteRestrictedAppAccessControl to turn off site-level Application Restrictions enforcement without losing saved settings. +ms.date: 10/13/2026 +ms.topic: reference +--- + +# Disable-SPOSiteRestrictedAppAccessControl + +## SYNOPSIS + +Turns off Application Restrictions enforcement for a site while preserving the active mode and both lists. + +## SYNTAX + +```powershell +Disable-SPOSiteRestrictedAppAccessControl -Identity [-WhatIf] [-Confirm] [] +``` + +## DESCRIPTION + +Use the `Disable-SPOSiteRestrictedAppAccessControl` cmdlet to turn off Application Restrictions enforcement for a single site while preserving the active mode and both lists. You can re-enable the same configuration later with `Enable-SPOSiteRestrictedAppAccessControl`. + +Disabling a site is different from clearing it. To remove the mode and both lists and clear the stored site policy entirely, use `Clear-SPOSiteRestrictedAppAccessControlPolicy`. + +Configuration and enablement are orthogonal. Mode and list changes never turn enforcement on, so after you disable a site you can continue to stage changes with `Set-SPOSiteRestrictedAppAccessControlMode` and `Set-SPOSiteRestrictedAppAccessControlList` without reactivating enforcement. Site enforcement is turned on only by `Enable-SPOSiteRestrictedAppAccessControl`. + +While the site is disabled, no site-level Application Restrictions decision applies to requests for that site. Tenant-level policy is unaffected: the tenant switch gates all site enforcement, and the tenant deny list can't be overridden by a site allow list. + +Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and Application Restrictions, so disabling a site policy doesn't grant any application access it doesn't already have. + +Site Application Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. Application Restrictions is fully decoupled from `SiteProperties`, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated Application Restrictions cmdlets listed in [Related Links](#related-links). + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +```powershell +Disable-SPOSiteRestrictedAppAccessControl -Identity "https://contoso.sharepoint.com/sites/Finance" +``` + +This example turns off Application Restrictions enforcement for the Finance site. The active mode, allow list, and deny list are preserved. + +### Example 2 + +```powershell +Disable-SPOSiteRestrictedAppAccessControl -Identity "e1b2c3d4-5678-4abc-9def-0123456789ab" -WhatIf +``` + +This example uses a site ID and shows what would happen without changing the policy. Every site Application Restrictions cmdlet accepts `-Identity` as either a site URL or a site ID. + +### Example 3 + +```powershell +$url = "https://contoso.sharepoint.com/sites/Finance" +Disable-SPOSiteRestrictedAppAccessControl -Identity $url -Confirm:$false +Get-SPOSiteRestrictedAppAccessControl -Identity $url +``` + +This example disables enforcement without an interactive prompt and then reads the policy back to confirm that the mode and both lists are still stored. Using `-Confirm:$false` doesn't bypass validation, authorization, auditing, or first-party protection. + +## PARAMETERS + +### -Identity + +> Applicable: SharePoint Online + +Specifies the site to disable. Provide either the site URL or the site ID. + +```yaml +Type: System.String +Parameter Sets: (All) +Aliases: + +Required: True +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm + +> Applicable: SharePoint Online + +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: cf + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf + +> Applicable: SharePoint Online + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: wi + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### None + +## OUTPUTS + +### None + +This cmdlet doesn't return an object. Use `Get-SPOSiteRestrictedAppAccessControl` to read the resulting policy. + +## NOTES + +- Disabling preserves the active mode and both lists. Use `Clear-SPOSiteRestrictedAppAccessControlPolicy` to remove the mode and lists and clear the stored site policy. +- Site enforcement is turned on again only by `Enable-SPOSiteRestrictedAppAccessControl`. Mode and list changes never turn enforcement on. +- The tenant switch gates all site enforcement, so a site policy has no effect while the tenant switch is off. The tenant deny list can't be overridden by a site allow list. +- Application Restrictions never grants permissions. A request must still pass existing SharePoint authorization. +- This cmdlet supports `-WhatIf` and `-Confirm` with `ConfirmImpact.High`. `-Confirm:$false` is allowed for automation and doesn't bypass validation, authorization, auditing, or first-party protection. + +## RELATED LINKS + +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) + +[Set-SPOSiteRestrictedAppAccessControlMode](Set-SPOSiteRestrictedAppAccessControlMode.md) + +[Set-SPOSiteRestrictedAppAccessControlList](Set-SPOSiteRestrictedAppAccessControlList.md) + +[Enable-SPOSiteRestrictedAppAccessControl](Enable-SPOSiteRestrictedAppAccessControl.md) + +[Clear-SPOSiteRestrictedAppAccessControlList](Clear-SPOSiteRestrictedAppAccessControlList.md) + +[Clear-SPOSiteRestrictedAppAccessControlPolicy](Clear-SPOSiteRestrictedAppAccessControlPolicy.md) + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOTenantRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOTenantRestrictedAppAccessControl.md new file mode 100644 index 000000000..383a5fb84 --- /dev/null +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOTenantRestrictedAppAccessControl.md @@ -0,0 +1,144 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/disable-spotenantrestrictedappaccesscontrol +applicable: SharePoint Online +title: Disable-SPOTenantRestrictedAppAccessControl +schema: 2.0.0 +ms.author: neilh +ms.reviewer: neilh +description: Disable-SPOTenantRestrictedAppAccessControl turns off tenant-wide Application Restrictions enforcement while keeping your deny list intact. Learn the syntax and examples. +ms.date: 10/13/2026 +ms.topic: reference +--- + +# Disable-SPOTenantRestrictedAppAccessControl + +## SYNOPSIS + +Turns off the tenant Application Restrictions enforcement switch while preserving the tenant deny list. + +## SYNTAX + +```powershell +Disable-SPOTenantRestrictedAppAccessControl [-WhatIf] [-Confirm] [] +``` + +## DESCRIPTION + +Use the `Disable-SPOTenantRestrictedAppAccessControl` cmdlet to turn off the tenant enforcement switch for Application Restrictions without discarding your configuration. + +Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and Application Restrictions. + +The tenant switch is the master enforcement switch for Application Restrictions. It gates the tenant deny list and all site-level enforcement. Turning it off stops enforcement for every site policy whose site-level `Enabled` flag is `True`, not only the tenant deny list. The cmdlet warns about this effect before confirmation. + +The tenant deny list is preserved. Stored tenant and site configuration remains in place, so enforcement resumes with the same configuration when you run `Enable-SPOTenantRestrictedAppAccessControl` again. If you want to disable the switch *and* clear the tenant deny list, use `Clear-SPOTenantRestrictedAppAccessControlPolicy` instead. + +Configuration and enablement are orthogonal: this cmdlet changes only the switch, and list changes made with `Set-SPOTenantRestrictedAppAccessControlList` never flip the switch. + +The tenant scope is deny-only and has a single list, so there's no mode cmdlet and no `-ListType` parameter at tenant scope. + +Tenant Application Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. Application Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +```powershell +Disable-SPOTenantRestrictedAppAccessControl +``` + +This example turns off the tenant enforcement switch and preserves the tenant deny list. The cmdlet warns that this also stops enforcement for every site policy whose site-level `Enabled` flag is `True`, and then prompts for confirmation. + +### Example 2 + +```powershell +Disable-SPOTenantRestrictedAppAccessControl -WhatIf +``` + +This example shows what would happen if the tenant switch were turned off, without changing the stored tenant policy. + +### Example 3 + +```powershell +Disable-SPOTenantRestrictedAppAccessControl -Confirm:$false +Get-SPOTenantRestrictedAppAccessControl +``` + +This example turns off the tenant switch without prompting, which is useful in automation, and then reads the tenant policy to confirm that `Enabled` is `False` and that `RestrictedAppIds` still contains the preserved deny list. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. + +## PARAMETERS + +### -Confirm + +> Applicable: SharePoint Online + +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: cf + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf + +> Applicable: SharePoint Online + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: wi + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### None + +## OUTPUTS + +### None + +This cmdlet doesn't return an output object. Use `Get-SPOTenantRestrictedAppAccessControl` to confirm the resulting tenant policy. + +## NOTES + +- The tenant switch gates the tenant deny list and all site-level enforcement. Turning it off stops enforcement for every site policy whose site-level `Enabled` flag is `True`, not only the tenant deny list. +- The tenant deny list and all stored tenant and site configuration are preserved. Enforcement resumes with the same configuration when the switch is turned on again. +- Configuration and enablement are orthogonal: this cmdlet doesn't change the deny list. +- To disable the switch and clear the tenant deny list in one operation, use `Clear-SPOTenantRestrictedAppAccessControlPolicy`. +- Use `Disable-SPOSiteRestrictedAppAccessControl` to turn off enforcement for an individual site. + +## RELATED LINKS + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Set-SPOTenantRestrictedAppAccessControlList](Set-SPOTenantRestrictedAppAccessControlList.md) + +[Enable-SPOTenantRestrictedAppAccessControl](Enable-SPOTenantRestrictedAppAccessControl.md) + +[Clear-SPOTenantRestrictedAppAccessControlPolicy](Clear-SPOTenantRestrictedAppAccessControlPolicy.md) + +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOSiteRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOSiteRestrictedAppAccessControl.md new file mode 100644 index 000000000..5cad468fd --- /dev/null +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOSiteRestrictedAppAccessControl.md @@ -0,0 +1,183 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/enable-spositerestrictedappaccesscontrol +applicable: SharePoint Online +title: Enable-SPOSiteRestrictedAppAccessControl +schema: 2.0.0 +ms.author: neilh +ms.reviewer: neilh +description: Enable-SPOSiteRestrictedAppAccessControl turns on Application Restrictions enforcement for a SharePoint site using its configured mode and lists. Learn syntax and examples. +ms.date: 10/13/2026 +ms.topic: reference +--- + +# Enable-SPOSiteRestrictedAppAccessControl + +## SYNOPSIS + +Turns on Application Restrictions enforcement for a site using its configured mode and lists. + +## SYNTAX + +```powershell +Enable-SPOSiteRestrictedAppAccessControl -Identity [-WhatIf] [-Confirm] [] +``` + +## DESCRIPTION + +Use the `Enable-SPOSiteRestrictedAppAccessControl` cmdlet to turn on Application Restrictions enforcement for a single site. A mode must already be configured with `Set-SPOSiteRestrictedAppAccessControlMode`; the cmdlet fails when no mode is set. + +Site enforcement is turned on only by this cmdlet. Configuration and enablement are independent: mode and list changes never turn enforcement on. An administrator can stage a policy with `Set-SPOSiteRestrictedAppAccessControlMode` and `Set-SPOSiteRestrictedAppAccessControlList` and then enable it explicitly. + +The active mode determines the site policy decision: + +- **Allow** - applications in the allow list pass the Application Restrictions check, and all other governed applications are denied by the site policy. An empty active allow list causes the site policy to deny all governed third-party and agentic applications. +- **Deny** - applications in the deny list are denied by the site policy, and all other governed applications pass the Application Restrictions check. + +The inactive list is preserved and has no runtime effect. + +The tenant switch gates all site enforcement. A site policy has no effect while the tenant switch is off, and the tenant deny list can't be overridden by a site allow list. Use `Get-SPOTenantRestrictedAppAccessControl` to confirm the tenant switch before you rely on a site policy. + +Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Microsoft Entra consent. A request must pass both the existing permission model and Application Restrictions. + +Site Application Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. Application Restrictions is fully decoupled from `SiteProperties`, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated Application Restrictions cmdlets listed in [Related Links](#related-links). + +Microsoft first-party and core applications are excluded from Application Restrictions configuration and enforcement. + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +```powershell +Enable-SPOSiteRestrictedAppAccessControl -Identity "https://contoso.sharepoint.com/sites/Finance" +``` + +This example turns on Application Restrictions enforcement for the Finance site identified by its URL. Enforcement uses the mode and lists that are already configured on the site. + +### Example 2 + +```powershell +Enable-SPOSiteRestrictedAppAccessControl -Identity "e1b2c3d4-5678-4abc-9def-0123456789ab" +``` + +This example turns on enforcement for a site identified by its ID. Every site Application Restrictions cmdlet accepts `-Identity` as either a site URL or a site ID. + +### Example 3 + +```powershell +$url = "https://contoso.sharepoint.com/sites/Finance" +Set-SPOSiteRestrictedAppAccessControlMode -Identity $url -Mode Allow +Set-SPOSiteRestrictedAppAccessControlList -Identity $url -ListType AllowList -AddRestrictedAppIds "11111111-1111-1111-1111-111111111111" +Enable-SPOSiteRestrictedAppAccessControl -Identity $url +``` + +This example configures a mode and allow list and then enables the policy explicitly. The mode and list changes don't turn enforcement on, so nothing is enforced until the final command runs. Applications in the allow list pass the Application Restrictions check; all other governed applications are denied by the site policy. Existing Microsoft Entra consent and SharePoint authorization still apply. + +### Example 4 + +```powershell +Enable-SPOSiteRestrictedAppAccessControl -Identity "https://contoso.sharepoint.com/sites/Finance" -Confirm:$false +``` + +This example turns on enforcement without an interactive confirmation prompt, for use in automation. Using `-Confirm:$false` doesn't bypass validation, authorization, auditing, or first-party protection. + +## PARAMETERS + +### -Identity + +> Applicable: SharePoint Online + +Specifies the site to enable. Provide either the site URL or the site ID. + +```yaml +Type: System.String +Parameter Sets: (All) +Aliases: + +Required: True +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm + +> Applicable: SharePoint Online + +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: cf + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf + +> Applicable: SharePoint Online + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: wi + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### None + +## OUTPUTS + +### None + +This cmdlet doesn't return an object. Use `Get-SPOSiteRestrictedAppAccessControl` to read the resulting policy. + +## NOTES + +- This cmdlet fails when no mode is configured on the site. Set the mode to `Allow` or `Deny` before enabling the policy. +- Site enforcement is turned on only by this cmdlet. Mode and list changes preserve the current enablement state. +- An empty active allow list causes the site policy to deny all governed third-party and agentic applications. Review the active list with `Get-SPOSiteRestrictedAppAccessControl` before you enable a site. +- In `Deny` mode, applications represented in the deny list are denied by the site policy. All other governed applications pass the Application Restrictions check. +- The tenant switch gates all site enforcement, so a site policy has no effect while the tenant switch is off. The tenant deny list can't be overridden by a site allow list. +- Application Restrictions never grants permissions. A request must still pass existing SharePoint authorization. +- This cmdlet supports `-WhatIf` and `-Confirm` with `ConfirmImpact.High`. `-Confirm:$false` is allowed for automation and doesn't bypass validation, authorization, auditing, or first-party protection. + +## RELATED LINKS + +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) + +[Set-SPOSiteRestrictedAppAccessControlMode](Set-SPOSiteRestrictedAppAccessControlMode.md) + +[Set-SPOSiteRestrictedAppAccessControlList](Set-SPOSiteRestrictedAppAccessControlList.md) + +[Disable-SPOSiteRestrictedAppAccessControl](Disable-SPOSiteRestrictedAppAccessControl.md) + +[Clear-SPOSiteRestrictedAppAccessControlList](Clear-SPOSiteRestrictedAppAccessControlList.md) + +[Clear-SPOSiteRestrictedAppAccessControlPolicy](Clear-SPOSiteRestrictedAppAccessControlPolicy.md) + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOTenantRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOTenantRestrictedAppAccessControl.md new file mode 100644 index 000000000..1496c621b --- /dev/null +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOTenantRestrictedAppAccessControl.md @@ -0,0 +1,153 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/enable-spotenantrestrictedappaccesscontrol +applicable: SharePoint Online +title: Enable-SPOTenantRestrictedAppAccessControl +schema: 2.0.0 +ms.author: neilh +ms.reviewer: neilh +description: Learn how to use Enable-SPOTenantRestrictedAppAccessControl to activate the master enforcement switch for Application Restrictions across your SharePoint Online tenant. +ms.date: 10/13/2026 +ms.topic: reference +--- + +# Enable-SPOTenantRestrictedAppAccessControl + +## SYNOPSIS + +Turns on the tenant Application Restrictions enforcement switch for your organization. + +## SYNTAX + +```powershell +Enable-SPOTenantRestrictedAppAccessControl [-WhatIf] [-Confirm] [] +``` + +## DESCRIPTION + +Use the `Enable-SPOTenantRestrictedAppAccessControl` cmdlet to turn on the tenant enforcement switch for Application Restrictions. + +Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and Application Restrictions. + +The tenant switch is the master enforcement switch for Application Restrictions. While it's off, the tenant deny list isn't enforced, and no site-level policy is enforced. Turning on the switch starts tenant deny-list enforcement and site-level enforcement only for site policies whose site-level `Enabled` flag is `True`. Disabled site policies don't begin enforcing. Review the stored tenant deny list with `Get-SPOTenantRestrictedAppAccessControl` and review enabled site policies before you enable the switch. + +Enabling the switch doesn't change the stored deny list. Configuration and enablement are orthogonal: this cmdlet changes only the switch, and list changes made with `Set-SPOTenantRestrictedAppAccessControlList` never flip the switch. Enforcement resumes with the configuration that was preserved while the switch was off. + +An enabled switch with an empty tenant deny list is a valid state, but the tenant deny list denies nothing until an application ID is added. + +The tenant scope is deny-only and has a single list, so there's no mode cmdlet and no `-ListType` parameter at tenant scope. + +Tenant Application Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. Application Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +```powershell +Enable-SPOTenantRestrictedAppAccessControl +``` + +This example turns on the tenant enforcement switch. Tenant deny-list enforcement starts, along with site-level enforcement for site policies whose site-level `Enabled` flag is `True`. Disabled site policies don't begin enforcing. The cmdlet warns about this effect and then prompts for confirmation. + +### Example 2 + +```powershell +Get-SPOTenantRestrictedAppAccessControl +Enable-SPOTenantRestrictedAppAccessControl +``` + +This example reviews the stored tenant policy first so you can see which application IDs are on the deny list, and then turns on enforcement. Site-level enforcement starts only for site policies whose site-level `Enabled` flag is `True`. + +### Example 3 + +```powershell +Enable-SPOTenantRestrictedAppAccessControl -WhatIf +``` + +This example shows what would happen if the tenant switch were turned on, without changing the stored tenant policy. + +### Example 4 + +```powershell +Enable-SPOTenantRestrictedAppAccessControl -Confirm:$false +``` + +This example turns on the tenant switch without prompting for confirmation, which is useful in automation. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. + +## PARAMETERS + +### -Confirm + +> Applicable: SharePoint Online + +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: cf + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf + +> Applicable: SharePoint Online + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: wi + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### None + +## OUTPUTS + +### None + +This cmdlet doesn't return an output object. Use `Get-SPOTenantRestrictedAppAccessControl` to confirm the resulting tenant policy. + +## NOTES + +- Turning on the tenant switch starts tenant deny-list enforcement and site-level enforcement only for site policies whose site-level `Enabled` flag is `True`. Disabled site policies don't begin enforcing. +- The tenant switch is the master enforcement switch. While it's off, the tenant deny list and all site-level policies aren't enforced. +- Enabling the switch doesn't change the stored deny list. Configuration and enablement are orthogonal. +- An enabled switch with an empty deny list is allowed, but the tenant deny list denies nothing until an application ID is added. +- Microsoft first-party and core applications are excluded from Application Restrictions configuration and enforcement. +- Use `Enable-SPOSiteRestrictedAppAccessControl` to turn on enforcement for an individual site. + +## RELATED LINKS + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Set-SPOTenantRestrictedAppAccessControlList](Set-SPOTenantRestrictedAppAccessControlList.md) + +[Disable-SPOTenantRestrictedAppAccessControl](Disable-SPOTenantRestrictedAppAccessControl.md) + +[Clear-SPOTenantRestrictedAppAccessControlPolicy](Clear-SPOTenantRestrictedAppAccessControlPolicy.md) + +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md new file mode 100644 index 000000000..2a4a1fdf5 --- /dev/null +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md @@ -0,0 +1,166 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/get-spositerestrictedappaccesscontrol +applicable: SharePoint Online +title: Get-SPOSiteRestrictedAppAccessControl +schema: 2.0.0 +ms.author: neilh +ms.reviewer: neilh +description: Learn how to use Get-SPOSiteRestrictedAppAccessControl to read a SharePoint site's Application Restrictions policy and check enforcement status with PowerShell. +ms.date: 10/13/2026 +ms.topic: reference +--- + +# Get-SPOSiteRestrictedAppAccessControl + +## SYNOPSIS + +Returns the complete site-level Application Restrictions policy for a site, including enablement, active mode, and both the allow list and the deny list. + +## SYNTAX + +```powershell +Get-SPOSiteRestrictedAppAccessControl [-Identity] [] +``` + +## DESCRIPTION + +Use the `Get-SPOSiteRestrictedAppAccessControl` cmdlet to read the complete Application Restrictions policy stored for a single site. + +Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and Application Restrictions. + +A site policy has four parts: + +- **Enabled** - whether site enforcement is turned on. Site enforcement is turned on only by `Enable-SPOSiteRestrictedAppAccessControl`. Mode and list changes are configuration-only and preserve the current enablement state. +- **Mode** - the active mode. When the mode is `Allow`, applications in the allow list pass the Application Restrictions check and all other governed applications are denied by the site policy. When the mode is `Deny`, applications in the deny list are denied by the site policy and all other governed applications pass the Application Restrictions check. A mode must be explicitly configured before the site policy can be enabled. +- **AllowList** - the persistent list used when the mode is `Allow`. +- **DenyList** - the persistent list used when the mode is `Deny`. + +Both lists are always stored and can be managed regardless of which mode is active. Only the list selected by the active mode participates in runtime enforcement. The inactive list is preserved for future mode changes and has no runtime effect. An empty active allow list causes the site policy to deny all governed third-party and agentic applications. An empty active deny list means the site policy denies none of them. Existing Microsoft Entra consent and SharePoint authorization still apply. + +`AllowList` and `DenyList` are returned as GUID arrays. Each list can contain both concrete application IDs and parent agent blueprint IDs, and a blueprint ID applies to the blueprint application itself and to every current or future agent app created from that blueprint. The cmdlet doesn't require you to distinguish between the two: each property merges its internally typed application and blueprint entries into one stable, duplicate-free list of GUIDs. + +This cmdlet performs an uncached read and always returns the authoritative stored policy rather than a cached copy. + +Site enforcement is gated by the tenant switch. While the tenant switch is off, no site policy is enforced, even when a site policy reports `Enabled` as `True`. While the tenant switch is on, the tenant deny list takes precedence and can't be overridden by a site allow list. Use `Get-SPOTenantRestrictedAppAccessControl` to read the tenant switch and the tenant deny list. + +Site Application Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. Application Restrictions is fully decoupled from site properties, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated Application Restrictions cmdlets listed in [Related Links](#related-links). + +Microsoft first-party and core applications are excluded from Application Restrictions configuration and enforcement and never appear in a site list. + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +```powershell +Get-SPOSiteRestrictedAppAccessControl -Identity https://contoso.sharepoint.com/sites/Finance +``` + +This example returns the complete Application Restrictions policy for the Finance site identified by its URL. The returned object includes `SiteUrl`. + +### Example 2 + +```powershell +Get-SPOSiteRestrictedAppAccessControl -Identity 8a1e30f6-2f52-4b9e-9d1b-2e9f6c1d40aa +``` + +This example returns the same policy for a site identified by its ID. The returned object includes `SiteUrl`, so the result remains identifiable even when the input is a site ID. + +### Example 3 + +```powershell +$policy = Get-SPOSiteRestrictedAppAccessControl -Identity https://contoso.sharepoint.com/sites/Finance +if ($policy.Mode -eq "Allow") { + $policy.AllowList +} else { + $policy.DenyList +} +``` + +This example returns only the list that the active mode enforces. The other list is still stored and preserved, but it has no runtime effect until you change the mode. + +### Example 4 + +```powershell +$tenantPolicy = Get-SPOTenantRestrictedAppAccessControl +$policy = Get-SPOSiteRestrictedAppAccessControl -Identity https://contoso.sharepoint.com/sites/Finance +if ($tenantPolicy.Enabled -and $policy.Enabled -and $policy.Mode -eq "Allow" -and $policy.AllowList.Count -eq 0) { + Write-Host "Enforcement is on with an empty active allow list, which blocks all governed third-party and agentic apps." +} +``` + +This example identifies the state where the tenant switch and site policy are enabled, the active mode is `Allow`, and the active allow list is empty. In that state, the site policy blocks all governed third-party and agentic apps. + +## PARAMETERS + +### -Identity + +> Applicable: SharePoint Online + +Specifies the site to read. You can specify either the site URL or the site ID. + +```yaml +Type: System.String +Parameter Sets: (All) +Aliases: + +Required: True +Position: 0 +Default value: None +Accept pipeline input: True (ByValue) +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### System.String + +## OUTPUTS + +### SPORestrictedAppAccessControlSitePolicy + +Returns an `SPORestrictedAppAccessControlSitePolicy` object with the following properties. + +| Property | Type | Description | +|---|---|---| +| `SiteUrl` | String | The URL of the site the policy belongs to. This property keeps results identifiable when sites are piped into the cmdlet or when the input is a site ID. | +| `Enabled` | Boolean | Indicates whether site enforcement is turned on. Site enforcement is also gated by the tenant switch. | +| `Mode` | String | The active mode, `Allow` or `Deny`. Only the list selected by this mode is enforced. | +| `AllowList` | Guid[] | The persistent allow list, returned as one stable, duplicate-free list of application IDs and parent agent blueprint IDs. | +| `DenyList` | Guid[] | The persistent deny list, returned as one stable, duplicate-free list of application IDs and parent agent blueprint IDs. | + +## NOTES + +- This cmdlet returns the authoritative, uncached policy state. +- When the stored policy data is malformed, the cmdlet emits a warning and the returned object includes `IsPolicyDataMalformed = true`. Healthy output omits that property. +- Both lists are always stored. Only the list selected by the active mode is enforced; the inactive list is preserved and has no runtime effect. +- Each list has a hard maximum of 100 entries, and the two lists combined have a hard maximum of 200 entries. +- A parent agent blueprint ID entry applies to the blueprint application itself and to every current or future agent app created from that blueprint. +- The tenant switch gates all site enforcement. While the tenant switch is on, the tenant deny list can't be overridden by a site allow list. +- Configuration and enablement are orthogonal: mode and list changes never turn enforcement on. A mode must be explicitly configured before `Enable-SPOSiteRestrictedAppAccessControl` succeeds. +- Use `Get-SPOTenantRestrictedAppAccessControl` to read the tenant-level policy. + +## RELATED LINKS + +[Set-SPOSiteRestrictedAppAccessControlMode](Set-SPOSiteRestrictedAppAccessControlMode.md) + +[Set-SPOSiteRestrictedAppAccessControlList](Set-SPOSiteRestrictedAppAccessControlList.md) + +[Enable-SPOSiteRestrictedAppAccessControl](Enable-SPOSiteRestrictedAppAccessControl.md) + +[Disable-SPOSiteRestrictedAppAccessControl](Disable-SPOSiteRestrictedAppAccessControl.md) + +[Clear-SPOSiteRestrictedAppAccessControlList](Clear-SPOSiteRestrictedAppAccessControlList.md) + +[Clear-SPOSiteRestrictedAppAccessControlPolicy](Clear-SPOSiteRestrictedAppAccessControlPolicy.md) + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOTenantRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOTenantRestrictedAppAccessControl.md new file mode 100644 index 000000000..27b645bfe --- /dev/null +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOTenantRestrictedAppAccessControl.md @@ -0,0 +1,130 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/get-spotenantrestrictedappaccesscontrol +applicable: SharePoint Online +title: Get-SPOTenantRestrictedAppAccessControl +schema: 2.0.0 +ms.author: neilh +ms.reviewer: neilh +description: Get-SPOTenantRestrictedAppAccessControl retrieves the tenant Application Restrictions enforcement status and deny list. +ms.date: 10/13/2026 +ms.topic: reference +--- + +# Get-SPOTenantRestrictedAppAccessControl + +## SYNOPSIS + +Returns the tenant-level Application Restrictions policy, including the tenant enforcement switch and the tenant-wide deny list of restricted application IDs. + +## SYNTAX + +```powershell +Get-SPOTenantRestrictedAppAccessControl [] +``` + +## DESCRIPTION + +Use the `Get-SPOTenantRestrictedAppAccessControl` cmdlet to read the complete tenant Application Restrictions policy for your organization. + +Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and Application Restrictions. + +The tenant policy has two parts: + +- **Enabled** - the master enforcement switch for Application Restrictions. When this switch is off, the tenant deny list and all site-level policies aren't enforced. Stored tenant and site configuration is preserved. When the switch is turned on again, the tenant deny list and site policies whose site-level `Enabled` flag is `True` resume enforcement with the same configuration. +- **RestrictedAppIds** - the tenant-wide deny list. When the switch is on, applications in this list are denied and the list can't be overridden by a site-level allow list. + +The tenant deny list can contain both concrete application IDs and parent agent blueprint IDs. A blueprint ID applies to the blueprint application itself and to every current or future agent app created from that blueprint. The cmdlet doesn't require you to distinguish between the two: `RestrictedAppIds` merges the internally typed entries into one stable, duplicate-free `Guid[]`. + +This cmdlet returns the authoritative, uncached policy state. + +Tenant Application Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. Application Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. Use the dedicated Application Restrictions cmdlets listed in [Related Links](#related-links). + +Microsoft first-party and core applications are excluded from Application Restrictions configuration and enforcement and never appear in the tenant deny list. + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +```powershell +Get-SPOTenantRestrictedAppAccessControl +``` + +This example returns the complete tenant Application Restrictions policy, showing whether enforcement is enabled and which application IDs are on the tenant deny list. + +### Example 2 + +```powershell +(Get-SPOTenantRestrictedAppAccessControl).RestrictedAppIds +``` + +This example returns only the restricted application IDs from the tenant deny list. + +### Example 3 + +```powershell +$policy = Get-SPOTenantRestrictedAppAccessControl +if (-not $policy.Enabled) { + Write-Host "Application Restrictions enforcement is off. Site policies aren't enforced." +} +``` + +This example stores the tenant policy in a variable and checks the master switch. Because the tenant switch gates all site-level enforcement, a disabled switch means no site policy is being enforced, including policies whose site-level `Enabled` flag is `True`. + +### Example 4 + +```powershell +$policy = Get-SPOTenantRestrictedAppAccessControl +if ($policy.Enabled -and $policy.RestrictedAppIds.Count -eq 0) { + Write-Host "Enforcement is on, but the tenant deny list is empty and denies nothing." +} +``` + +This example identifies an enabled tenant switch with an empty tenant deny list. This state is valid. The tenant deny list denies nothing until an application ID is added; site policies whose site-level `Enabled` flag is `True` can still enforce. + +## PARAMETERS + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### None + +## OUTPUTS + +### SPORestrictedAppAccessControlTenantPolicy + +Returns an `SPORestrictedAppAccessControlTenantPolicy` object with the following properties. + +| Property | Type | Description | +|---|---|---| +| `Enabled` | Boolean | Indicates whether the tenant Application Restrictions enforcement switch is on. When `False`, the tenant deny list and all site-level policies aren't enforced. | +| `RestrictedAppIds` | Guid[] | The tenant-wide deny list, returned as one stable, duplicate-free list of application IDs and parent agent blueprint IDs. | + +## NOTES + +- The tenant switch is the master enforcement switch for Application Restrictions. Turning it off stops enforcement for every site policy whose site-level `Enabled` flag is `True`, not only the tenant deny list. +- While the tenant switch is on, the tenant deny list takes precedence over site policy and can't be overridden by a site allow list. +- The tenant scope is deny-only and has a single list, so there's no mode and no list-type selection at tenant scope. +- The tenant deny list has a hard maximum of 100 application IDs. +- Configuration and enablement are independent: changing the deny list never turns the tenant switch on or off. +- Use `Get-SPOSiteRestrictedAppAccessControl` to read the policy for an individual site. + +## RELATED LINKS + +[Enable-SPOTenantRestrictedAppAccessControl](Enable-SPOTenantRestrictedAppAccessControl.md) + +[Disable-SPOTenantRestrictedAppAccessControl](Disable-SPOTenantRestrictedAppAccessControl.md) + +[Set-SPOTenantRestrictedAppAccessControlList](Set-SPOTenantRestrictedAppAccessControlList.md) + +[Clear-SPOTenantRestrictedAppAccessControlPolicy](Clear-SPOTenantRestrictedAppAccessControlPolicy.md) + +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Microsoft.Online.SharePoint.PowerShell.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Microsoft.Online.SharePoint.PowerShell.md index 2a35cd2ab..f98373007 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Microsoft.Online.SharePoint.PowerShell.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Microsoft.Online.SharePoint.PowerShell.md @@ -83,9 +83,18 @@ Approves a permission request for the current tenant's "SharePoint Online Client ### [Approve-SPOTenantServicePrincipalPermissionRequest](Approve-SPOTenantServicePrincipalPermissionRequest.md) Approves a permission request for the current tenant's "SharePoint Online Client" service principal +### [Clear-SPOSiteRestrictedAppAccessControlList](Clear-SPOSiteRestrictedAppAccessControlList.md) +Clears a site's Application Restrictions allow or deny list while preserving the other list, active mode, and site enablement. + +### [Clear-SPOSiteRestrictedAppAccessControlPolicy](Clear-SPOSiteRestrictedAppAccessControlPolicy.md) +Removes the complete Application Restrictions policy from a site, disabling enforcement and removing the active mode and both lists. + ### [Clear-SPOTenantPreAuthSettings](Clear-SPOTenantPreAuthSettings.md) Clears the pre-authentication settings for either the allow or deny list. +### [Clear-SPOTenantRestrictedAppAccessControlPolicy](Clear-SPOTenantRestrictedAppAccessControlPolicy.md) +Turns off the tenant Application Restrictions enforcement switch and clears the tenant-wide deny list. + ### [Connect-SPOService](Connect-SPOService.md) Connects the SharePoint Online Administrator or the SharePoint Embedded Administrator to a SharePoint Online connection (the SharePoint Online Administration Center). This cmdlet must be run before any other SharePoint Online cmdlets can run. @@ -101,12 +110,24 @@ This cmdlet command allows you to relocate existing SharePoint pages by utilizin ### [Deny-SPOTenantServicePrincipalPermissionRequest](Deny-SPOTenantServicePrincipalPermissionRequest.md) Denies a permission request for the current tenant's "SharePoint Online Client" service principal +### [Disable-SPOSiteRestrictedAppAccessControl](Disable-SPOSiteRestrictedAppAccessControl.md) +Turns off Application Restrictions enforcement for a site while preserving the active mode and both lists. + +### [Disable-SPOTenantRestrictedAppAccessControl](Disable-SPOTenantRestrictedAppAccessControl.md) +Turns off the tenant Application Restrictions enforcement switch while preserving the tenant deny list. + ### [Disconnect-SPOService](Disconnect-SPOService.md) Disconnects from a SharePoint Online service. ### [Enable-SPOCommSite](Enable-SPOCommSite.md) Enables the communication site experience on an existing classic team site. Please read instructions in [modernize classic team site](/sharepoint/modernize-classic-team-site) before attempting to execute this cmdlet. +### [Enable-SPOSiteRestrictedAppAccessControl](Enable-SPOSiteRestrictedAppAccessControl.md) +Turns on Application Restrictions enforcement for a site using its configured mode and lists. + +### [Enable-SPOTenantRestrictedAppAccessControl](Enable-SPOTenantRestrictedAppAccessControl.md) +Turns on the tenant Application Restrictions enforcement switch for the organization. + ### [Enable-SPOTenantServicePrincipal](Enable-SPOTenantServicePrincipal.md) Enables the current tenant's "SharePoint Online Client" service principal. @@ -362,6 +383,9 @@ This cmdlet allows you to retrieve all SharePoint pages under a specific SharePo ### [Get-SPOSiteRenameState](Get-SPOSiteRenameState.md) Returns the current rename job state of a SharePoint Online Site. +### [Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) +Returns the complete site-level Application Restrictions policy for a site, including enablement, active mode, and both lists. + ### [Get-SPOSiteReview](Get-SPOSiteReview.md) Track all site access reviews initiated from Data Access Governance (DAG) reports. @@ -425,6 +449,9 @@ Returns the list of sites that are prioritized for early execution, as part of [ ### [Get-SPOTenantRenameStatus](Get-SPOTenantRenameStatus.md) > [!IMPORTANT] > This feature is currently available to organizations that have no more than 10,000 total SharePoint sites and OneDrive accounts combined. Get the status of the job to change the SharePoint domain name for your organization in Microsoft 365. +### [Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) +Returns the tenant Application Restrictions enforcement status and deny list. + ### [Get-SPOTenantServicePrincipalPermissionGrants](Get-SPOTenantServicePrincipalPermissionGrants.md) Gets the collection of permission grants for the "SharePoint Online Client" service principal @@ -827,6 +854,12 @@ Updates the SharePoint Online owner and permission levels on a group inside a si ### [Set-SPOSiteOffice365Group](Set-SPOSiteOffice365Group.md) Connects a top-level SPO site collection to a new Microsoft 365 Group. +### [Set-SPOSiteRestrictedAppAccessControlList](Set-SPOSiteRestrictedAppAccessControlList.md) +Adds or removes application IDs in a site's Application Restrictions allow or deny list in one atomic update. + +### [Set-SPOSiteRestrictedAppAccessControlMode](Set-SPOSiteRestrictedAppAccessControlMode.md) +Sets a site's active Application Restrictions mode to Allow or Deny while preserving site enablement and both lists. + ### [Set-SPOSiteScript](Set-SPOSiteScript.md) Updates a previously uploaded site script. @@ -860,6 +893,9 @@ Sets the configuration of pre-authentication. ### [Set-SPOTenantRenameSitePrioritization](Set-SPOTenantRenameSitePrioritization.md) Allows prioritization of a site for early execution, as part of [Advanced Tenant Rename](/sharepoint/change-your-sharepoint-domain-name#advanced-tenant-rename-preview). +### [Set-SPOTenantRestrictedAppAccessControlList](Set-SPOTenantRestrictedAppAccessControlList.md) +Adds or removes application IDs in the tenant-wide Application Restrictions deny list in one atomic update. + ### [Set-SPOTenantSyncClientRestriction](Set-SPOTenantSyncClientRestriction.md) Controls tenant-wide options and restrictions specific to syncing files. diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlList.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlList.md new file mode 100644 index 000000000..0adcc329e --- /dev/null +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlList.md @@ -0,0 +1,230 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/set-spositerestrictedappaccesscontrollist +applicable: SharePoint Online +title: Set-SPOSiteRestrictedAppAccessControlList +schema: 2.0.0 +ms.author: neilh +ms.reviewer: neilh +description: Learn how to use Set-SPOSiteRestrictedAppAccessControlList to manage site-level allow and deny lists for Application Restrictions in SharePoint Online. +ms.date: 10/13/2026 +ms.topic: reference +--- + +# Set-SPOSiteRestrictedAppAccessControlList + +## SYNOPSIS + +Adds or removes application IDs in a site's Application Restrictions allow or deny list in one atomic update. + +## SYNTAX + +```powershell +Set-SPOSiteRestrictedAppAccessControlList [-Identity] -ListType [-AddRestrictedAppIds ] [-RemoveRestrictedAppIds ] [-WhatIf] [-Confirm] [] +``` + +## DESCRIPTION + +Use the `Set-SPOSiteRestrictedAppAccessControlList` cmdlet to change the contents of one site list. Additions and removals are applied in one atomic update that preserves site enablement and the active mode. + +Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and Application Restrictions. + +Use `-ListType` to identify the target list explicitly. Both lists are always stored and can be managed regardless of which mode is active. Only the list selected by the active mode participates in runtime enforcement, so adding or removing entries in the inactive list doesn't change current enforcement. The inactive list is preserved for future mode changes. + +The active mode determines what the change means at runtime. When the mode is `Allow`, applications in the allow list pass the Application Restrictions check and all other governed applications are denied by the site policy; an empty active allow list causes the site policy to deny all governed third-party and agentic applications. When the mode is `Deny`, applications in the deny list are denied by the site policy and all other governed applications pass the Application Restrictions check; an empty active deny list means the site policy denies none of them. + +At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, an ID can't appear in both, and removals are applied before additions. + +You supply application IDs only. Each list can contain both concrete application IDs and parent agent blueprint IDs, and the backend classifies each added ID and stores its type internally. A parent agent blueprint ID applies to the blueprint application itself and to every current or future agent app created from that blueprint. In an active deny list, a blueprint ID causes the site policy to deny that complete app family. In an active allow list, it lets that complete app family pass the Application Restrictions check. Existing Microsoft Entra consent and SharePoint authorization still apply. + +Adding IDs uses the same bulk Microsoft Graph classification and first-party exclusion as the tenant cmdlets. Microsoft first-party and core applications are rejected, IDs that can't be classified are rejected, and a bulk add is all-or-none, so no partial set of IDs is persisted. + +Removing entries requires only `-ListType` and `-RemoveRestrictedAppIds`. Removal doesn't call Microsoft Graph, so deleted or stale application IDs can still be removed. If a supplied ID isn't present in the target list, the cmdlet returns a validation error. + +Configuration and enablement are orthogonal: a list change never turns enforcement on. Site enforcement is turned on only by `Enable-SPOSiteRestrictedAppAccessControl`, so you can stage lists and then enable the site explicitly. A mode must be explicitly configured before `Enable-SPOSiteRestrictedAppAccessControl` succeeds. + +Site enforcement is also gated by the tenant switch. While the tenant switch is on, the tenant deny list takes precedence and can't be overridden by a site allow list. + +Automation can use the standard `-Confirm:$false`. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. + +Site Application Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated Application Restrictions cmdlets listed in [Related Links](#related-links). + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +```powershell +Set-SPOSiteRestrictedAppAccessControlList -Identity https://contoso.sharepoint.com/sites/Finance -ListType AllowList -AddRestrictedAppIds 11111111-1111-1111-1111-111111111111 +``` + +This example adds one application ID to the allow list of the Finance site. The site's enablement and active mode are preserved. If the ID is a Microsoft first-party or core application, or if it can't be classified, the add is rejected. + +### Example 2 + +```powershell +Set-SPOSiteRestrictedAppAccessControlList -Identity https://contoso.sharepoint.com/sites/Finance -ListType DenyList -AddRestrictedAppIds 22222222-2222-2222-2222-222222222222,33333333-3333-3333-3333-333333333333 -RemoveRestrictedAppIds 44444444-4444-4444-4444-444444444444 +``` + +This example adds two application IDs and removes a third in one atomic update. The removal is applied before the additions. Site enablement and the active mode are unchanged. + +## PARAMETERS + +### -Identity + +> Applicable: SharePoint Online + +Specifies the site to configure. You can specify either the site URL or the site ID. + +```yaml +Type: System.String +Parameter Sets: (All) +Aliases: + +Required: True +Position: 0 +Default value: None +Accept pipeline input: True (ByValue) +Accept wildcard characters: False +``` + +### -ListType + +> Applicable: SharePoint Online + +Specifies the list to change. Valid values are `AllowList` and `DenyList`. Entry mutations must explicitly identify the target list. + +```yaml +Type: System.String +Parameter Sets: (All) +Aliases: +Accepted values: AllowList, DenyList + +Required: True +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -AddRestrictedAppIds + +> Applicable: SharePoint Online + +Specifies the application IDs to add to the list identified by `-ListType`. You supply application IDs only; the backend classifies each added ID as a regular application or a parent agent blueprint and stores the type internally. + +Adds use the shared bulk Microsoft Graph classification. First-party or core applications and unclassifiable IDs are rejected, and a bulk add is all-or-none. + +At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, and an ID can't appear in both. + +```yaml +Type: System.Guid[] +Parameter Sets: (All) +Aliases: + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -RemoveRestrictedAppIds + +> Applicable: SharePoint Online + +Specifies the application IDs to remove from the list identified by `-ListType`. Removals are applied before additions. + +Removing entries doesn't call Microsoft Graph, so deleted or stale application IDs can still be removed. If a supplied ID isn't present in the target list, the cmdlet returns a validation error. + +At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, and an ID can't appear in both. + +```yaml +Type: System.Guid[] +Parameter Sets: (All) +Aliases: + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm + +> Applicable: SharePoint Online + +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: cf + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf + +> Applicable: SharePoint Online + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: wi + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### System.String + +## OUTPUTS + +### None + +## NOTES + +- Additions and removals are applied in one atomic update that preserves site enablement and the active mode. +- At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, an ID can't appear in both, and removals are applied before additions. +- Each list has a hard maximum of 100 entries, and the two lists combined have a hard maximum of 200 entries. Both regular application IDs and parent agent blueprint IDs consume the same quota. +- Adding or removing entries in the list that the active mode doesn't enforce doesn't change current enforcement. +- Configuration and enablement are orthogonal. Site enforcement is turned on only by `Enable-SPOSiteRestrictedAppAccessControl`, and a mode must be explicitly configured before that cmdlet succeeds. +- The tenant switch gates all site enforcement. While the tenant switch is on, the tenant deny list can't be overridden by a site allow list. +- Use `Get-SPOSiteRestrictedAppAccessControl` to confirm the resulting lists, and `Clear-SPOSiteRestrictedAppAccessControlList` to clear an entire list. + +## RELATED LINKS + +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) + +[Set-SPOSiteRestrictedAppAccessControlMode](Set-SPOSiteRestrictedAppAccessControlMode.md) + +[Enable-SPOSiteRestrictedAppAccessControl](Enable-SPOSiteRestrictedAppAccessControl.md) + +[Disable-SPOSiteRestrictedAppAccessControl](Disable-SPOSiteRestrictedAppAccessControl.md) + +[Clear-SPOSiteRestrictedAppAccessControlList](Clear-SPOSiteRestrictedAppAccessControlList.md) + +[Clear-SPOSiteRestrictedAppAccessControlPolicy](Clear-SPOSiteRestrictedAppAccessControlPolicy.md) + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlMode.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlMode.md new file mode 100644 index 000000000..7de5f61ec --- /dev/null +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlMode.md @@ -0,0 +1,202 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/set-spositerestrictedappaccesscontrolmode +applicable: SharePoint Online +title: Set-SPOSiteRestrictedAppAccessControlMode +schema: 2.0.0 +ms.author: neilh +ms.reviewer: neilh +description: Set-SPOSiteRestrictedAppAccessControlMode switches a site between Allow and Deny modes while preserving both application lists. Learn the syntax and examples. +ms.date: 10/13/2026 +ms.topic: reference +--- + +# Set-SPOSiteRestrictedAppAccessControlMode + +## SYNOPSIS + +Sets the active mode of the site-level Application Restrictions policy to `Allow` or `Deny`, preserving site enablement and both lists. + +## SYNTAX + +```powershell +Set-SPOSiteRestrictedAppAccessControlMode [-Identity] -Mode [-WhatIf] [-Confirm] [] +``` + +## DESCRIPTION + +Use the `Set-SPOSiteRestrictedAppAccessControlMode` cmdlet to change which list a site enforces. This cmdlet changes the active mode only. It preserves site enablement and both the allow list and the deny list. + +Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and Application Restrictions. + +The active mode selects the list that is enforced: + +- **Allow** - applications in the allow list pass the Application Restrictions check, and all other governed applications are denied by the site policy. An empty active allow list causes the site policy to deny all governed third-party and agentic applications. +- **Deny** - applications in the deny list are denied by the site policy, and all other governed applications pass the Application Restrictions check. An empty active deny list means the site policy denies none of them. + +Both lists are always stored and can be managed regardless of which mode is active. Only the list selected by the active mode participates in runtime enforcement. The inactive list is preserved for future mode changes and has no runtime effect. A mode must be explicitly configured before the site policy can be enabled. + +Because a mode switch can change the effective decision for every governed application on the site, the cmdlet displays a warning before it makes the change. The warning identifies the current mode, the target mode, the size of the newly active preserved list, and the new default decision, and it clearly states that both lists are preserved. The cmdlet then asks you to confirm. Use `-WhatIf` to display the same impact without changing the policy. + +Configuration and enablement are orthogonal: a mode change never turns enforcement on. Site enforcement is turned on only by `Enable-SPOSiteRestrictedAppAccessControl`, so you can stage a mode and lists and then enable the site explicitly. The only combination the backend rejects is enabled with mode `None`. + +Site enforcement is also gated by the tenant switch. While the tenant switch is on, the tenant deny list takes precedence and can't be overridden by a site allow list. + +Automation can use the standard `-Confirm:$false`. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. + +Site Application Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated Application Restrictions cmdlets listed in [Related Links](#related-links). + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +```powershell +Set-SPOSiteRestrictedAppAccessControlMode -Identity https://contoso.sharepoint.com/sites/Finance -Mode Allow +``` + +This example sets the active mode of the Finance site to `Allow`. Applications in the site allow list pass the Application Restrictions check, and all other governed applications are denied by the site policy. Existing Microsoft Entra consent and SharePoint authorization still apply. The deny list is preserved but becomes inactive. The cmdlet displays the mode-switch warning and asks for confirmation before it applies the change. + +### Example 2 + +```powershell +Set-SPOSiteRestrictedAppAccessControlMode -Identity https://contoso.sharepoint.com/sites/Finance -Mode Deny -WhatIf +``` + +This example displays the impact of switching the Finance site to `Deny`, including the current mode, the target mode, the size of the newly active deny list, and the new default decision, without changing the policy. + +### Example 3 + +```powershell +Set-SPOSiteRestrictedAppAccessControlMode -Identity 8a1e30f6-2f52-4b9e-9d1b-2e9f6c1d40aa -Mode Deny -Confirm:$false +``` + +This example switches a site identified by its ID to `Deny` without prompting, for use in automation. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. + +### Example 4 + +```powershell +Set-SPOSiteRestrictedAppAccessControlMode -Identity https://contoso.sharepoint.com/sites/Finance -Mode Allow +Enable-SPOSiteRestrictedAppAccessControl -Identity https://contoso.sharepoint.com/sites/Finance +``` + +This example stages the mode first and then turns enforcement on explicitly. A mode change never turns enforcement on by itself. + +## PARAMETERS + +### -Identity + +> Applicable: SharePoint Online + +Specifies the site to configure. You can specify either the site URL or the site ID. + +```yaml +Type: System.String +Parameter Sets: (All) +Aliases: + +Required: True +Position: 0 +Default value: None +Accept pipeline input: True (ByValue) +Accept wildcard characters: False +``` + +### -Mode + +> Applicable: SharePoint Online + +Specifies the active mode of the site policy. Valid values are `Allow` and `Deny`. + +When the mode is `Allow`, applications in the allow list pass the Application Restrictions check and all other governed applications are denied by the site policy. When the mode is `Deny`, applications in the deny list are denied by the site policy and all other governed applications pass the Application Restrictions check. Both lists are preserved either way. Existing Microsoft Entra consent and SharePoint authorization still apply. + +```yaml +Type: System.String +Parameter Sets: (All) +Aliases: +Accepted values: Allow, Deny + +Required: True +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm + +> Applicable: SharePoint Online + +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: cf + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf + +> Applicable: SharePoint Online + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. `-WhatIf` displays the same mode-switch impact as the confirmation warning without changing the policy. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: wi + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### System.String + +## OUTPUTS + +### None + +## NOTES + +- A mode change changes only the active mode. It preserves site enablement and both lists. +- Before the switch, the cmdlet warns with the current mode, target mode, size of the newly active preserved list, and new default decision. +- The warning states that both lists are preserved, and the cmdlet asks for confirmation. +- An empty active allow list causes the site policy to deny all governed third-party and agentic applications. An empty active deny list means the site policy denies none of them. Existing Microsoft Entra consent and SharePoint authorization still apply. +- Configuration and enablement are orthogonal. Site enforcement is turned on only by `Enable-SPOSiteRestrictedAppAccessControl`. The only combination the backend rejects is enabled with mode `None`. +- The tenant switch gates all site enforcement. While the tenant switch is on, the tenant deny list can't be overridden by a site allow list. +- Use `Get-SPOSiteRestrictedAppAccessControl` to confirm the resulting mode and both lists. + +## RELATED LINKS + +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) + +[Set-SPOSiteRestrictedAppAccessControlList](Set-SPOSiteRestrictedAppAccessControlList.md) + +[Enable-SPOSiteRestrictedAppAccessControl](Enable-SPOSiteRestrictedAppAccessControl.md) + +[Disable-SPOSiteRestrictedAppAccessControl](Disable-SPOSiteRestrictedAppAccessControl.md) + +[Clear-SPOSiteRestrictedAppAccessControlList](Clear-SPOSiteRestrictedAppAccessControlList.md) + +[Clear-SPOSiteRestrictedAppAccessControlPolicy](Clear-SPOSiteRestrictedAppAccessControlPolicy.md) + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOTenantRestrictedAppAccessControlList.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOTenantRestrictedAppAccessControlList.md new file mode 100644 index 000000000..1d16d0a2d --- /dev/null +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOTenantRestrictedAppAccessControlList.md @@ -0,0 +1,200 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/set-spotenantrestrictedappaccesscontrollist +applicable: SharePoint Online +title: Set-SPOTenantRestrictedAppAccessControlList +schema: 2.0.0 +ms.author: neilh +ms.reviewer: neilh +description: Set-SPOTenantRestrictedAppAccessControlList adds or removes application IDs in the tenant-wide Application Restrictions deny list in one atomic update. +ms.date: 10/13/2026 +ms.topic: reference +--- + +# Set-SPOTenantRestrictedAppAccessControlList + +## SYNOPSIS + +Adds or removes application IDs in the tenant-wide Application Restrictions deny list in one atomic update. + +## SYNTAX + +```powershell +Set-SPOTenantRestrictedAppAccessControlList [-AddRestrictedAppIds ] [-RemoveRestrictedAppIds ] [-WhatIf] [-Confirm] [] +``` + +## DESCRIPTION + +Use the `Set-SPOTenantRestrictedAppAccessControlList` cmdlet to change the tenant-wide deny list for Application Restrictions. + +Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and Application Restrictions. + +Both parameters are applied in one atomic update that preserves the tenant enforcement switch. At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, and the same ID can't appear in both parameters. Removals are applied before additions. + +You supply application IDs only. You don't identify whether an ID is a regular application or a parent agent blueprint: the backend classifies each added ID and stores it in the appropriate internal list. A parent agent blueprint ID on the tenant deny list blocks the blueprint application itself and every current or future agent app created from that blueprint. + +Added IDs are classified by using Microsoft Graph. Microsoft first-party and core applications and IDs that can't be classified are rejected. A bulk add is all-or-none: if any supplied ID is rejected, no IDs are persisted. Removals don't use Microsoft Graph, so stale or deleted application IDs can always be removed. + +The combined tenant deny list has a hard maximum of 100 application IDs. + +Configuration and enablement are orthogonal: list changes never turn the tenant switch on or off. Use `Enable-SPOTenantRestrictedAppAccessControl` and `Disable-SPOTenantRestrictedAppAccessControl` to change enforcement. + +Removing the last entry leaves an enabled switch with an empty deny list, which denies nothing. That state is allowed because it's legitimate during cleanup, but the cmdlet warns and points you to `Disable-SPOTenantRestrictedAppAccessControl` or `Clear-SPOTenantRestrictedAppAccessControlPolicy` for turning Application Restrictions off explicitly. + +The tenant scope is deny-only and has a single list, so there's no mode cmdlet, no `-ListType` parameter, and no separate clear-list cmdlet. + +Tenant Application Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. Application Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +```powershell +Set-SPOTenantRestrictedAppAccessControlList -AddRestrictedAppIds 11111111-1111-1111-1111-111111111111 +``` + +This example adds one application ID to the tenant deny list. The backend classifies the ID and stores it as either a regular application or a parent agent blueprint. The tenant enforcement switch isn't changed. + +### Example 2 + +```powershell +Set-SPOTenantRestrictedAppAccessControlList -AddRestrictedAppIds 11111111-1111-1111-1111-111111111111, 22222222-2222-2222-2222-222222222222 -RemoveRestrictedAppIds 33333333-3333-3333-3333-333333333333 +``` + +This example adds two application IDs and removes a third in a single atomic update. The removal is applied before the additions. If either added ID is a first-party or core application or can't be classified, the complete operation fails and nothing is persisted. + +### Example 3 + +```powershell +Set-SPOTenantRestrictedAppAccessControlList -RemoveRestrictedAppIds 33333333-3333-3333-3333-333333333333 -Confirm:$false +``` + +This example removes an application ID without prompting for confirmation, which is useful in automation. Removals don't call Microsoft Graph, so an ID for a deleted or stale application can still be removed. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. + +### Example 4 + +```powershell +Set-SPOTenantRestrictedAppAccessControlList -AddRestrictedAppIds 44444444-4444-4444-4444-444444444444 -WhatIf +``` + +This example shows what would happen if the application ID were added, without changing the stored tenant policy. + +## PARAMETERS + +### -AddRestrictedAppIds + +> Applicable: SharePoint Online + +Specifies the application IDs to add to the tenant deny list. Each supplied ID is classified by using Microsoft Graph and stored internally as either a regular application or a parent agent blueprint. First-party or core applications and unclassifiable IDs are rejected, and the add is all-or-none. + +At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, and an ID can't appear in both parameters. The combined tenant deny list can't exceed 100 IDs. + +```yaml +Type: System.Guid[] +Parameter Sets: (All) +Aliases: + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -RemoveRestrictedAppIds + +> Applicable: SharePoint Online + +Specifies the application IDs to remove from the tenant deny list. Removals are applied before additions and don't use Microsoft Graph, so stale or deleted application IDs can always be removed. + +At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, and an ID can't appear in both parameters. + +```yaml +Type: System.Guid[] +Parameter Sets: (All) +Aliases: + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm + +> Applicable: SharePoint Online + +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: cf + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf + +> Applicable: SharePoint Online + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: wi + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### None + +## OUTPUTS + +### None + +This cmdlet doesn't return an output object. Use `Get-SPOTenantRestrictedAppAccessControl` to read the resulting tenant policy. + +## NOTES + +- Adds and removes are applied as one atomic update. Removals are applied before additions. +- A bulk add is all-or-none. If any supplied ID is a first-party or core application or can't be classified, no IDs are persisted. +- The combined tenant deny list has a hard maximum of 100 application IDs. +- The administrator supplies IDs only. The backend classifies each added ID and stores it as either a regular application or a parent agent blueprint. +- A parent agent blueprint ID blocks the blueprint application and every current or future agent app created from it. +- Configuration and enablement are orthogonal: list changes never flip the tenant switch. +- Removing the last entry leaves an enabled switch with an empty deny list that denies nothing. The cmdlet warns and points to `Disable-SPOTenantRestrictedAppAccessControl` or `Clear-SPOTenantRestrictedAppAccessControlPolicy`. +- Use `Set-SPOSiteRestrictedAppAccessControlList` to change the lists for an individual site. + +## RELATED LINKS + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Enable-SPOTenantRestrictedAppAccessControl](Enable-SPOTenantRestrictedAppAccessControl.md) + +[Disable-SPOTenantRestrictedAppAccessControl](Disable-SPOTenantRestrictedAppAccessControl.md) + +[Clear-SPOTenantRestrictedAppAccessControlPolicy](Clear-SPOTenantRestrictedAppAccessControlPolicy.md) + +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell)