From 2cde32c2d0a4c8fa4a5ab0b36cc1ee77af5ffae7 Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 14:07:08 -0500 Subject: [PATCH 01/43] Update 13 files in OfficeDocs-Sharepoint-PowerShell --- sharepoint/TOC.yml | 30 ++- ...r-spositerestrictedappaccesscontrollist.md | 200 +++++++++++++++ ...spositerestrictedappaccesscontrolpolicy.md | 166 ++++++++++++ ...otenantrestrictedappaccesscontrolpolicy.md | 143 +++++++++++ ...sable-spositerestrictedappaccesscontrol.md | 162 ++++++++++++ ...ble-spotenantrestrictedappaccesscontrol.md | 142 +++++++++++ ...nable-spositerestrictedappaccesscontrol.md | 178 +++++++++++++ ...ble-spotenantrestrictedappaccesscontrol.md | 151 +++++++++++ .../get-spositerestrictedappaccesscontrol.md | 165 ++++++++++++ ...get-spotenantrestrictedappaccesscontrol.md | 134 ++++++++++ ...t-spositerestrictedappaccesscontrolmode.md | 196 +++++++++++++++ ...spotenantrestrictedappaccesscontrollist.md | 195 ++++++++++++++ ...t-spositerestrictedappaccesscontrollist.md | 238 ++++++++++++++++++ 13 files changed, 2099 insertions(+), 1 deletion(-) create mode 100644 sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md create mode 100644 sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrolpolicy.md create mode 100644 sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spotenantrestrictedappaccesscontrolpolicy.md create mode 100644 sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spositerestrictedappaccesscontrol.md create mode 100644 sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spotenantrestrictedappaccesscontrol.md create mode 100644 sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spositerestrictedappaccesscontrol.md create mode 100644 sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spotenantrestrictedappaccesscontrol.md create mode 100644 sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spositerestrictedappaccesscontrol.md create mode 100644 sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spotenantrestrictedappaccesscontrol.md create mode 100644 sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrolmode.md create mode 100644 sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spotenantrestrictedappaccesscontrollist.md create mode 100644 sharepoint/sharepoint-ps/set-spositerestrictedappaccesscontrollist.md diff --git a/sharepoint/TOC.yml b/sharepoint/TOC.yml index b5ef71ac3..0bf05a0c9 100644 --- a/sharepoint/TOC.yml +++ b/sharepoint/TOC.yml @@ -1,2 +1,30 @@ - name: Index - href: index.md \ No newline at end of file + href: index.md +- name: Clear-SPOSiteRestrictedAppAccessControlList + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md +- name: Clear-SPOSiteRestrictedAppAccessControlPolicy + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrolpolicy.md +- name: Clear-SPOTenantRestrictedAppAccessControlPolicy + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spotenantrestrictedappaccesscontrolpolicy.md +- name: Disable-SPOSiteRestrictedAppAccessControl + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spositerestrictedappaccesscontrol.md +- name: Disable-SPOTenantRestrictedAppAccessControl + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spotenantrestrictedappaccesscontrol.md +- name: Enable-SPOSiteRestrictedAppAccessControl + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spositerestrictedappaccesscontrol.md +- name: Enable-SPOTenantRestrictedAppAccessControl + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spotenantrestrictedappaccesscontrol.md +- name: Get-SPOSiteRestrictedAppAccessControl + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spositerestrictedappaccesscontrol.md +- name: Get-SPOTenantRestrictedAppAccessControl + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spotenantrestrictedappaccesscontrol.md +- name: Set-SPOSiteRestrictedAppAccessControlList + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrollist.md +- name: Set-SPOSiteRestrictedAppAccessControlMode + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrolmode.md +- name: Set-SPOSiteRestrictedAppAccessControlList + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrollist.md +- name: Set-SPOTenantRestrictedAppAccessControlList + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spotenantrestrictedappaccesscontrollist.md +- name: Set-SPOSiteRestrictedAppAccessControlList + href: sharepoint-ps/set-spositerestrictedappaccesscontrollist.md diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md new file mode 100644 index 000000000..dd0857c89 --- /dev/null +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md @@ -0,0 +1,200 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/clear-spositerestrictedappaccesscontrollist +applicable: SharePoint Online +title: Clear-SPOSiteRestrictedAppAccessControlList +schema: 2.0.0 +ms.author: neilh +ms.reviewer: [ Add reviewer alias ] +description: Clear-SPOSiteRestrictedAppAccessControlList removes all entries from a site's allow or deny list in SharePoint Online. Learn syntax, examples, and parameters. +ms.date: 10/09/2026 +ms.topic: concept-article +--- + +# Clear-SPOSiteRestrictedAppAccessControlList + +## SYNOPSIS + +Removes every entry from one app restrictions list on a site, preserving the other list, the active mode, and site enablement. + +## SYNTAX + +```powershell +Clear-SPOSiteRestrictedAppAccessControlList -Identity -ListType [-WhatIf] [-Confirm] + [] +``` + +## DESCRIPTION + +Use the `Clear-SPOSiteRestrictedAppAccessControlList` cmdlet to clear the allow list or the deny list on a single site. Clearing one list always clears it, and preserves the other list, the active mode, and site enablement. To remove both lists and the mode and clear the stored site policy, use `Clear-SPOSiteRestrictedAppAccessControlPolicy` instead. + +A site stores both lists, but only the list selected by the active mode participates in enforcement: + +- **Allow** mode enforces the allow list. Subjects in the allow list are allowed and all other governed apps are denied. +- **Deny** mode enforces the deny list. Subjects in the deny list are denied and all other governed apps are allowed. + +When the cleared list is the one the active mode enforces, the cmdlet emits a warning before confirmation. Clearing the active allow list means no third-party applications can access the site, because an empty active allow list blocks all governed third-party and agentic apps. Clearing the active deny list means all of them can. The warning also states whether the change takes effect immediately or when enforcement is next enabled. + +Clearing an inactive list doesn't change current enforcement, but it still supports `-WhatIf` and `-Confirm`, and it's audited. + +Configuration and enablement are orthogonal. List changes never turn enforcement on, so clearing a list on a site that isn't enabled leaves the site disabled and stages the change for the next time enforcement is enabled with `Enable-SPOSiteRestrictedAppAccessControl`. This avoids the dangerous case where adding a single ID to an unconfigured site would immediately activate an allow list and block every other application. + +The tenant switch gates all site enforcement. A site policy has no effect while the tenant switch is off, and the tenant deny list can't be overridden by a site allow list, so clearing a site deny list never restores access for an application that the tenant denies. + +App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions. + +Site App Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. App Restrictions is fully decoupled from `SiteProperties`, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated App Restrictions cmdlets listed in [Related Links](#related-links). + +You must be at least a SharePoint Administrator to run this cmdlet. + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +```powershell +Clear-SPOSiteRestrictedAppAccessControlList -Identity "https://contoso.sharepoint.com/sites/Finance" -ListType DenyList +``` + +This example clears the deny list on the Finance site. The allow list, the active mode, and site enablement are preserved. If `Deny` is the active mode, the cmdlet warns that clearing the active deny list means all governed third-party applications can access the site. + +### Example 2 + +```powershell +Clear-SPOSiteRestrictedAppAccessControlList -Identity "e1b2c3d4-5678-4abc-9def-0123456789ab" -ListType AllowList -WhatIf +``` + +This example identifies the site by site ID and previews clearing the allow list without changing the policy. Every site App Restrictions cmdlet accepts `-Identity` as either a site URL or a site ID. + +### Example 3 + +```powershell +$url = "https://contoso.sharepoint.com/sites/Finance" +Clear-SPOSiteRestrictedAppAccessControlList -Identity $url -ListType AllowList +Set-SPOSiteRestrictedAppAccessControlList -Identity $url -ListType AllowList -AddRestrictedAppIds "11111111-1111-1111-1111-111111111111" +``` + +This example rebuilds an allow list from scratch. Because list changes are configuration-only, neither command changes whether the site is enabled. + +### Example 4 + +```powershell +Clear-SPOSiteRestrictedAppAccessControlList -Identity "https://contoso.sharepoint.com/sites/Finance" -ListType DenyList -Confirm:$false +``` + +This example clears the deny list without an interactive confirmation prompt, for use in automation. Using `-Confirm:$false` doesn't bypass validation, authorization, auditing, or first-party protection. + +## PARAMETERS + +### -Identity + +Specifies the site to change. Provide either the site URL or the site ID. + +```yaml +Type: String +Parameter Sets: (All) +Aliases: +Applicable: SharePoint Online +Required: True +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -ListType + +Specifies which list to clear. Entry mutations must explicitly identify the target list. The valid values are: + +- `AllowList` +- `DenyList` + +```yaml +Type: String +Parameter Sets: (All) +Aliases: +Accepted values: AllowList, DenyList +Applicable: SharePoint Online +Required: True +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: wi +Applicable: SharePoint Online +Required: False +Position: Named +Default value: False +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm + +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: cf +Applicable: SharePoint Online +Required: False +Position: Named +Default value: True +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### None + +## OUTPUTS + +### None + +This cmdlet doesn't return an object. Use `Get-SPOSiteRestrictedAppAccessControl` to read the resulting policy. + +## NOTES + +- Clearing one list preserves the other list, the active mode, and site enablement. +- Clearing the list that the active mode enforces changes the effective decision for the site: an empty active allow list blocks all governed third-party and agentic apps, and an empty active deny list allows all of them. The cmdlet warns before confirmation and states whether the change takes effect immediately or when enforcement is next enabled. +- Clearing an inactive list doesn't change current enforcement, but the operation still supports `-WhatIf` and `-Confirm` and is audited. +- List changes never turn enforcement on. Site enforcement is turned on only by `Enable-SPOSiteRestrictedAppAccessControl`. +- The tenant switch gates all site enforcement, so a site policy has no effect while the tenant switch is off. The tenant deny list can't be overridden by a site allow list. +- App Restrictions never grants permissions. A request must still pass existing SharePoint authorization. +- This cmdlet supports `-WhatIf` and `-Confirm` with `ConfirmImpact.High`. `-Confirm:$false` is allowed for automation and doesn't bypass validation, authorization, auditing, or first-party protection. +- [Add the exact warning and error text emitted by the cmdlet.] + +## Related links + +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) + +[Set-SPOSiteRestrictedAppAccessControlMode](Set-SPOSiteRestrictedAppAccessControlMode.md) + +[Set-SPOSiteRestrictedAppAccessControlList](Set-SPOSiteRestrictedAppAccessControlList.md) + +[Enable-SPOSiteRestrictedAppAccessControl](Enable-SPOSiteRestrictedAppAccessControl.md) + +[Disable-SPOSiteRestrictedAppAccessControl](Disable-SPOSiteRestrictedAppAccessControl.md) + +[Clear-SPOSiteRestrictedAppAccessControlPolicy](Clear-SPOSiteRestrictedAppAccessControlPolicy.md) + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrolpolicy.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrolpolicy.md new file mode 100644 index 000000000..bcf5392bf --- /dev/null +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrolpolicy.md @@ -0,0 +1,166 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/clear-spositerestrictedappaccesscontrolpolicy +applicable: SharePoint Online +title: Clear-SPOSiteRestrictedAppAccessControlPolicy +schema: 2.0.0 +ms.author: neilh +ms.reviewer: [ Add reviewer alias ] +description: Clear-SPOSiteRestrictedAppAccessControlPolicy removes a site's App Restrictions policy, disabling enforcement and clearing lists. Learn syntax and examples. +ms.date: 10/09/2026 +ms.topic: concept-article +--- + +# Clear-SPOSiteRestrictedAppAccessControlPolicy + +## SYNOPSIS + +Removes the complete app restrictions policy from a site. The cmdlet disables enforcement, and removes the active mode and both lists. + +## SYNTAX + +```powershell +Clear-SPOSiteRestrictedAppAccessControlPolicy -Identity [-WhatIf] [-Confirm] [] +``` + +## DESCRIPTION + +Use the `Clear-SPOSiteRestrictedAppAccessControlPolicy` cmdlet to return a site to its unconfigured state. The cmdlet disables enforcement, removes the active mode and both lists, and clears the stored site policy. After the policy is cleared, the site is in the same state as a site that was never configured: enforcement is disabled and there are no entries. + +Clearing is different from disabling. `Disable-SPOSiteRestrictedAppAccessControl` turns off enforcement but preserves the active mode and both lists so the same configuration can be re-enabled later. Use `Clear-SPOSiteRestrictedAppAccessControlPolicy` when you want the configuration removed as well. To clear only one list and keep the other list, the mode, and site enablement, use `Clear-SPOSiteRestrictedAppAccessControlList`. + +Because the mode is removed along with the lists, a cleared site can't be enabled again until a mode is set. `Enable-SPOSiteRestrictedAppAccessControl` fails when no mode is set; enabled with mode `None` is the only combination the backend rejects. Rebuild the policy with `Set-SPOSiteRestrictedAppAccessControlMode` and `Set-SPOSiteRestrictedAppAccessControlList`, then enable it explicitly. Configuration and enablement are orthogonal: mode and list changes never turn enforcement on, so an administrator can stage a policy and then enable it. This avoids the dangerous case where adding a single ID to an unconfigured site would immediately activate an allow list and block every other application. + +Clearing a site policy affects only that site. The tenant switch gates all site enforcement, and the tenant deny list can't be overridden by a site allow list, so clearing a site policy never restores access for an application that the tenant denies. Use `Clear-SPOTenantRestrictedAppAccessControlPolicy` for the tenant scope. + +App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions, so clearing a site policy doesn't grant any application access it doesn't already have. + +Site App Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. App Restrictions is fully decoupled from `SiteProperties`, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated App Restrictions cmdlets listed in [Related Links](#related-links). + +You must be at least a SharePoint Administrator to run this cmdlet. + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +```powershell +Clear-SPOSiteRestrictedAppAccessControlPolicy -Identity "https://contoso.sharepoint.com/sites/Finance" +``` + +This example removes the complete App Restrictions policy from the Finance site. It disables enforcement and removes the active mode, allow list, and deny list. + +### Example 2 + +```powershell +Clear-SPOSiteRestrictedAppAccessControlPolicy -Identity "e1b2c3d4-5678-4abc-9def-0123456789ab" -WhatIf +``` + +This example identifies the site by site ID and previews the change without modifying the policy. Every site App Restrictions cmdlet accepts `-Identity` as either a site URL or a site ID. + +### Example 3 + +```powershell +$url = "https://contoso.sharepoint.com/sites/Finance" +Clear-SPOSiteRestrictedAppAccessControlPolicy -Identity $url -Confirm:$false +Set-SPOSiteRestrictedAppAccessControlMode -Identity $url -Mode Deny +Set-SPOSiteRestrictedAppAccessControlList -Identity $url -ListType DenyList -AddRestrictedAppIds "11111111-1111-1111-1111-111111111111" +Enable-SPOSiteRestrictedAppAccessControl -Identity $url +``` + +This example removes an existing policy and then rebuilds it from scratch. Because the mode is removed when the policy is cleared, you must assign a mode to the site before you can enable it. + +## PARAMETERS + +### -Identity + +Specifies the site whose policy is cleared. Provide either the site URL or the site ID. + +```yaml +Type: String +Parameter Sets: (All) +Aliases: +Applicable: SharePoint Online +Required: True +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: wi +Applicable: SharePoint Online +Required: False +Position: Named +Default value: False +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm + +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: cf +Applicable: SharePoint Online +Required: False +Position: Named +Default value: True +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### None + +## OUTPUTS + +### None + +This cmdlet doesn't return an object. Use `Get-SPOSiteRestrictedAppAccessControl` to confirm that the site is unconfigured. + +## NOTES + +- Clearing a site policy disables enforcement, removes the active mode and both lists, and clears the stored site policy. A cleared site is indistinguishable from a site that was never configured. +- To keep the configuration for later use, use `Disable-SPOSiteRestrictedAppAccessControl` instead. It preserves the active mode and both lists. +- To clear only one list, use `Clear-SPOSiteRestrictedAppAccessControlList`, which preserves the other list, the active mode, and site enablement. +- After clearing, the site can't be enabled until a mode is set. `Enable-SPOSiteRestrictedAppAccessControl` fails when no mode is set. +- The tenant switch gates all site enforcement, so a site policy has no effect while the tenant switch is off. The tenant deny list can't be overridden by a site allow list. +- App Restrictions never grants permissions. A request must still pass existing SharePoint authorization. +- This cmdlet supports `-WhatIf` and `-Confirm` with `ConfirmImpact.High`. `-Confirm:$false` is allowed for automation and doesn't bypass validation, authorization, auditing, or first-party protection. +- [Add the exact warning and error text emitted by the cmdlet.] + +## Related links + +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) + +[Set-SPOSiteRestrictedAppAccessControlMode](Set-SPOSiteRestrictedAppAccessControlMode.md) + +[Set-SPOSiteRestrictedAppAccessControlList](Set-SPOSiteRestrictedAppAccessControlList.md) + +[Enable-SPOSiteRestrictedAppAccessControl](Enable-SPOSiteRestrictedAppAccessControl.md) + +[Disable-SPOSiteRestrictedAppAccessControl](Disable-SPOSiteRestrictedAppAccessControl.md) + +[Clear-SPOSiteRestrictedAppAccessControlList](Clear-SPOSiteRestrictedAppAccessControlList.md) + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spotenantrestrictedappaccesscontrolpolicy.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spotenantrestrictedappaccesscontrolpolicy.md new file mode 100644 index 000000000..69941a630 --- /dev/null +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spotenantrestrictedappaccesscontrolpolicy.md @@ -0,0 +1,143 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/clear-spotenantrestrictedappaccesscontrolpolicy +applicable: SharePoint Online +title: Clear-SPOTenantRestrictedAppAccessControlPolicy +schema: 2.0.0 +ms.author: neilh +ms.reviewer: [ Add reviewer alias ] +description: Clear-SPOTenantRestrictedAppAccessControlPolicy disables tenant App Restrictions enforcement and clears the deny list. Learn syntax, parameters, and examples. +ms.date: 10/09/2026 +ms.topic: concept-article +--- + +# Clear-SPOTenantRestrictedAppAccessControlPolicy + +## SYNOPSIS + +Turns off the tenant App Restrictions enforcement switch and clears the tenant-wide deny list. + +## SYNTAX + +```powershell +Clear-SPOTenantRestrictedAppAccessControlPolicy [-WhatIf] [-Confirm] [] +``` + +## DESCRIPTION + +Use the `Clear-SPOTenantRestrictedAppAccessControlPolicy` cmdlet to reset the tenant Restricted App Access Control policy. The cmdlet disables the tenant enforcement switch and clears the tenant-wide deny list in one operation. + +App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions. + +This cmdlet warns that the tenant switch gates all site-level enforcement, so turning it off stops every configured site policy from enforcing, not just the tenant deny list. + +The tenant scope is deny-only with a single list, so there's no separate clear-list cmdlet. Clearing the only list while leaving the switch on would be indistinguishable from the feature being off, so `Clear-SPOTenantRestrictedAppAccessControlPolicy` covers that intent. + +Use this cmdlet when you want to remove the tenant configuration entirely. If you want to stop enforcement but keep the deny list for later, use `Disable-SPOTenantRestrictedAppAccessControl` instead. If you want to remove only selected application IDs, use `Set-SPOTenantRestrictedAppAccessControlList` with `-RemoveRestrictedAppIds`. + +Removing IDs doesn't require Microsoft Graph, so stale or deleted applications on the tenant deny list are cleared along with the rest of the list. + +Tenant App Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. App Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. + +You must be at least a SharePoint Administrator or to run this cmdlet. + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## Examples + +### Example 1 + +```powershell +Clear-SPOTenantRestrictedAppAccessControlPolicy +``` + +This example turns off the tenant enforcement switch and clears the tenant deny list. The cmdlet warns that the tenant switch gates all site-level enforcement, and then prompts for confirmation. + +### Example 2 + +```powershell +Clear-SPOTenantRestrictedAppAccessControlPolicy -WhatIf +``` + +This example shows what would happen if the tenant policy were cleared, without changing the stored tenant policy. + +### Example 3 + +```powershell +Get-SPOTenantRestrictedAppAccessControl +Clear-SPOTenantRestrictedAppAccessControlPolicy -Confirm:$false +Get-SPOTenantRestrictedAppAccessControl +``` + +This example records the current tenant policy, clears it without prompting for confirmation, and then reads the policy again to confirm that `Enabled` is `False` and that `RestrictedAppIds` is empty. Suppressing the prompt doesn't bypass validation, authorization, or auditing. + +## Parameters + +### -WhatIf + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: wi +Applicable: SharePoint Online +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm + +Prompts you for confirmation before running the cmdlet. This cmdlet has a confirm impact of High, so it prompts by default. Automation can use `-Confirm:$false` to suppress the prompt. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: cf +Applicable: SharePoint Online +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### None + +## OUTPUTS + +### None + +This cmdlet doesn't return an output object. Use `Get-SPOTenantRestrictedAppAccessControl` to confirm the resulting tenant policy. + +## NOTES + +- This cmdlet disables the tenant switch and clears the tenant deny list. To stop enforcement while preserving the deny list, use `Disable-SPOTenantRestrictedAppAccessControl`. +- The cmdlet warns that the tenant switch gates all site-level enforcement, so turning it off stops every configured site policy from enforcing, not just the tenant deny list. +- The tenant scope is deny-only with a single list, so there's no separate clear-list cmdlet at tenant scope. +- Clearing doesn't call Microsoft Graph, so stale or deleted application IDs are removed with the rest of the list. +- This cmdlet doesn't remove site policy configuration. Use `Clear-SPOSiteRestrictedAppAccessControlPolicy` to clear the policy for an individual site. + +## Related links + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Set-SPOTenantRestrictedAppAccessControlList](Set-SPOTenantRestrictedAppAccessControlList.md) + +[Enable-SPOTenantRestrictedAppAccessControl](Enable-SPOTenantRestrictedAppAccessControl.md) + +[Disable-SPOTenantRestrictedAppAccessControl](Disable-SPOTenantRestrictedAppAccessControl.md) + +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spositerestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spositerestrictedappaccesscontrol.md new file mode 100644 index 000000000..98b36d154 --- /dev/null +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spositerestrictedappaccesscontrol.md @@ -0,0 +1,162 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/disable-spositerestrictedappaccesscontrol +applicable: SharePoint Online +title: Disable-SPOSiteRestrictedAppAccessControl +schema: 2.0.0 +ms.author: neilh +ms.reviewer: [ Add reviewer alias ] +description: Learn how to use Disable-SPOSiteRestrictedAppAccessControl in SharePoint Online PowerShell to pause site-level app access enforcement without losing saved settings. +ms.date: 10/09/2026 +ms.topic: concept-article +--- + +# Disable-SPOSiteRestrictedAppAccessControl + +## SYNOPSIS + +Turns off App Restrictions enforcement for a site while preserving the site's active mode and both lists. + +## SYNTAX + +```powershell +Disable-SPOSiteRestrictedAppAccessControl -Identity [-WhatIf] [-Confirm] [] +``` + +## DESCRIPTION + +Use the `Disable-SPOSiteRestrictedAppAccessControl` cmdlet to turn off App Restrictions enforcement for a single site. The cmdlet disables enforcement while preserving the active mode and both lists. A stored site policy with enforcement disabled keeps its active mode and both lists staged and preserved, so you can re-enable the same configuration later with `Enable-SPOSiteRestrictedAppAccessControl`. + +Disabling a site is different from clearing it. To remove the mode and both lists and clear the stored site policy entirely, use `Clear-SPOSiteRestrictedAppAccessControlPolicy`. + +Configuration and enablement are orthogonal. Mode and list changes never turn enforcement on, so after you disable a site you can continue to stage changes with `Set-SPOSiteRestrictedAppAccessControlMode` and `Set-SPOSiteRestrictedAppAccessControlList` without reactivating enforcement. Site enforcement is turned on only by `Enable-SPOSiteRestrictedAppAccessControl`. + +While the site is disabled, no site-level App Restrictions decision applies to requests for that site. Tenant-level policy is unaffected: the tenant switch gates all site enforcement, and the tenant deny list can't be overridden by a site allow list. + +App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions, so disabling a site policy doesn't grant any application access it doesn't already have. + +App Restrictions for Apps administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. App Restrictions is fully decoupled from `SiteProperties`, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated App Restrictions cmdlets listed in [Related Links](#related-links). + +You must be at least a SharePoint Administrator or to run this cmdlet. + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +```powershell +Disable-SPOSiteRestrictedAppAccessControl -Identity "https://contoso.sharepoint.com/sites/Finance" +``` + +This example turns off App Restrictions enforcement for the Finance site. The site's active mode, allow list, and deny list are preserved. + +### Example 2 + +```powershell +Disable-SPOSiteRestrictedAppAccessControl -Identity "e1b2c3d4-5678-4abc-9def-0123456789ab" -WhatIf +``` + +This example uses a site ID and shows what would happen without changing the policy. Every site App Restrictions cmdlet accepts `-Identity` as either a site URL or a site ID. + +### Example 3 + +```powershell +$url = "https://contoso.sharepoint.com/sites/Finance" +Disable-SPOSiteRestrictedAppAccessControl -Identity $url -Confirm:$false +Get-SPOSiteRestrictedAppAccessControl -Identity $url +``` + +This example disables enforcement without an interactive prompt and then reads the policy back to confirm that the mode and both lists are still stored. Using `-Confirm:$false` doesn't bypass validation, authorization, auditing, or first-party protection. + +## PARAMETERS + +### -Identity + +Specifies the site to disable. Provide either the site URL or the site ID. + +```yaml +Type: String +Parameter Sets: (All) +Aliases: +Applicable: SharePoint Online +Required: True +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: wi +Applicable: SharePoint Online +Required: False +Position: Named +Default value: False +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm + +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: cf +Applicable: SharePoint Online +Required: False +Position: Named +Default value: True +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### None + +## OUTPUTS + +### None + +This cmdlet doesn't return an object. Use `Get-SPOSiteRestrictedAppAccessControl` to read the resulting policy. + +## NOTES + +- Disabling preserves the active mode and both lists. Use `Clear-SPOSiteRestrictedAppAccessControlPolicy` to remove the mode and lists and clear the stored site policy. +- Site enforcement is turned on again only by `Enable-SPOSiteRestrictedAppAccessControl`. Mode and list changes never turn enforcement on. +- The tenant switch gates all site enforcement, so a site policy has no effect while the tenant switch is off. The tenant deny list can't be overridden by a site allow list. +- App Restrictions never grants permissions. A request must still pass existing SharePoint authorization. +- This cmdlet supports `-WhatIf` and `-Confirm` with `ConfirmImpact.High`. `-Confirm:$false` is allowed for automation and doesn't bypass validation, authorization, auditing, or first-party protection. +- [Add the exact warning and error text emitted by the cmdlet.] + +## RELATED LINKS + +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) + +[Set-SPOSiteRestrictedAppAccessControlMode](Set-SPOSiteRestrictedAppAccessControlMode.md) + +[Set-SPOSiteRestrictedAppAccessControlList](Set-SPOSiteRestrictedAppAccessControlList.md) + +[Enable-SPOSiteRestrictedAppAccessControl](Enable-SPOSiteRestrictedAppAccessControl.md) + +[Clear-SPOSiteRestrictedAppAccessControlList](Clear-SPOSiteRestrictedAppAccessControlList.md) + +[Clear-SPOSiteRestrictedAppAccessControlPolicy](Clear-SPOSiteRestrictedAppAccessControlPolicy.md) + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spotenantrestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spotenantrestrictedappaccesscontrol.md new file mode 100644 index 000000000..374bd23ac --- /dev/null +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spotenantrestrictedappaccesscontrol.md @@ -0,0 +1,142 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/disable-spotenantrestrictedappaccesscontrol +applicable: SharePoint Online +title: Disable-SPOTenantRestrictedAppAccessControl +schema: 2.0.0 +ms.author: neilh +ms.reviewer: [ Add reviewer alias ] +description: Disable-SPOTenantRestrictedAppAccessControl turns off tenant-wide App Restrictions enforcement while keeping your deny list intact. Learn the syntax and examples. +ms.date: 10/09/2026 +ms.topic: concept-article +--- + +# Disable-SPOTenantRestrictedAppAccessControl + +## SYNOPSIS + +Turns off the tenant App Restrictions enforcement switch, while preserving the tenant deny list. + +## SYNTAX + +```powershell +Disable-SPOTenantRestrictedAppAccessControl [-WhatIf] [-Confirm] [] +``` + +## DESCRIPTION + +Use the `Disable-SPOTenantRestrictedAppAccessControl` cmdlet to turn off the tenant enforcement switch for App Restrictions without discarding your configuration. + +App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions. + +The tenant switch is the master enforcement switch for the feature. This cmdlet warns that the tenant switch gates all site-level enforcement, so turning it off stops every configured site policy from enforcing, not just the tenant deny list. + +The tenant deny list is preserved. Stored tenant and site configuration remains in place, so enforcement resumes with the same configuration when you run `Enable-SPOTenantRestrictedAppAccessControl` again. If you want to disable the switch *and* clear the tenant deny list, use `Clear-SPOTenantRestrictedAppAccessControlPolicy` instead. + +Configuration and enablement are orthogonal: this cmdlet changes only the switch, and list changes made with `Set-SPOTenantRestrictedAppAccessControlList` never flip the switch. + +The tenant scope is deny-only and has a single list, so there's no mode cmdlet and no `-ListType` parameter at tenant scope. + +App Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. App Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. + +You must be at least a SharePoint Administrator to run this cmdlet. + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +```powershell +Disable-SPOTenantRestrictedAppAccessControl +``` + +This example turns off the tenant enforcement switch and preserves the tenant deny list. The cmdlet warns that the tenant switch gates all site-level enforcement, and then prompts for confirmation. + +### Example 2 + +```powershell +Disable-SPOTenantRestrictedAppAccessControl -WhatIf +``` + +This example shows what would happen if the tenant switch were turned off, without changing the stored tenant policy. + +### Example 3 + +```powershell +Disable-SPOTenantRestrictedAppAccessControl -Confirm:$false +Get-SPOTenantRestrictedAppAccessControl +``` + +This example turns off the tenant switch without prompting, which is useful in automation, and then reads the tenant policy to confirm that `Enabled` is `False` and that `RestrictedAppIds` still contains the preserved deny list. Suppressing the prompt doesn't bypass validation, authorization, or auditing. + +## PARAMETERS + +### -WhatIf + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: wi +Applicable: SharePoint Online +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm + +Prompts you for confirmation before running the cmdlet. This cmdlet has a confirm impact of High, so it prompts by default. Automation can use `-Confirm:$false` to suppress the prompt. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: cf +Applicable: SharePoint Online +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### None + +## OUTPUTS + +### None + +This cmdlet doesn't return an output object. Use `Get-SPOTenantRestrictedAppAccessControl` to confirm the resulting tenant policy. + +## NOTES + +- The cmdlet warns that the tenant switch gates all site-level enforcement, so turning it off stops every configured site policy from enforcing, not just the tenant deny list. +- The tenant deny list is preserved, and stored tenant and site configuration is preserved, so enforcement resumes with the same configuration when the switch is turned on again. +- Configuration and enablement are orthogonal: this cmdlet doesn't change the deny list. +- To disable the switch and clear the tenant deny list in one operation, use `Clear-SPOTenantRestrictedAppAccessControlPolicy`. +- Use `Disable-SPOSiteRestrictedAppAccessControl` to turn off enforcement for an individual site. + +## RELATED LINKS + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Set-SPOTenantRestrictedAppAccessControlList](Set-SPOTenantRestrictedAppAccessControlList.md) + +[Enable-SPOTenantRestrictedAppAccessControl](Enable-SPOTenantRestrictedAppAccessControl.md) + +[Clear-SPOTenantRestrictedAppAccessControlPolicy](Clear-SPOTenantRestrictedAppAccessControlPolicy.md) + +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spositerestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spositerestrictedappaccesscontrol.md new file mode 100644 index 000000000..573e9c3c7 --- /dev/null +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spositerestrictedappaccesscontrol.md @@ -0,0 +1,178 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/enable-spositerestrictedappaccesscontrol +applicable: SharePoint Online +title: Enable-SPOSiteRestrictedAppAccessControl +schema: 2.0.0 +ms.author: neilh +ms.reviewer: [ Add reviewer alias ] +description: Enable-SPOSiteRestrictedAppAccessControl turns on App Restrictions enforcement for a SharePoint site using its existing mode and lists. Learn syntax and examples. +ms.date: 10/09/2026 +ms.topic: concept-article +--- + +# Enable-SPOSiteRestrictedAppAccessControl + +## SYNOPSIS + +Turns on App Restrictions enforcement for a site, using the mode and lists that are already configured on that site. + +## SYNTAX + +```powershell +Enable-SPOSiteRestrictedAppAccessControl -Identity [-WhatIf] [-Confirm] [] +``` + +## DESCRIPTION + +Use the `Enable-SPOSiteRestrictedAppAccessControl` cmdlet to turn on App Restrictions enforcement for a single site. The cmdlet enables enforcement using the mode and lists that are already configured on the site, and it fails when no mode is set. The only combination that the backend rejects is enabled with mode `None`. + +Site enforcement is turned on only by this cmdlet. Configuration and enablement are orthogonal: mode and list changes never turn enforcement on, so an administrator can stage a policy with `Set-SPOSiteRestrictedAppAccessControlMode` and `Set-SPOSiteRestrictedAppAccessControlList` and then enable it explicitly. This avoids the dangerous case where adding a single ID to an unconfigured site would immediately activate an allow list and block every other application. + +The active mode determines what enforcement does once the site is enabled: + +- **Allow** - subjects in the allow list are allowed and all other governed apps are denied. `Allow` is the default mode when a site is enabled without existing configuration. An empty active allow list blocks all governed third-party and agentic apps. +- **Deny** - subjects in the deny list are denied and all other governed apps are allowed. + +The inactive list is preserved and has no runtime effect. + +The tenant switch gates all site enforcement. A site policy has no effect while the tenant switch is off, and the tenant deny list can't be overridden by a site allow list. Use `Get-SPOTenantRestrictedAppAccessControl` to confirm the tenant switch before you rely on a site policy. + +App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions. + +Site App Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. App Restrictions is fully decoupled from `SiteProperties`, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated App Restrictions cmdlets listed in [Related Links](#related-links). + +You must be at least a SharePoint Administrator to run this cmdlet. +Microsoft first-party and core applications are excluded from App Restrictions configuration and enforcement. + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +```powershell +Enable-SPOSiteRestrictedAppAccessControl -Identity "https://contoso.sharepoint.com/sites/Finance" +``` + +This example turns on App Restrictions enforcement for the Finance site by using its site URL. Enforcement uses the mode and lists that are already configured on the site. + +### Example 2 + +```powershell +Enable-SPOSiteRestrictedAppAccessControl -Identity "e1b2c3d4-5678-4abc-9def-0123456789ab" +``` + +This example turns on enforcement for the same site by using its site ID. Every site App Restrictions cmdlet accepts `-Identity` as either a site URL or a site ID. + +### Example 3 + +```powershell +$url = "https://contoso.sharepoint.com/sites/Finance" +Set-SPOSiteRestrictedAppAccessControlMode -Identity $url -Mode Allow +Set-SPOSiteRestrictedAppAccessControlList -Identity $url -ListType AllowList -AddRestrictedAppIds "11111111-1111-1111-1111-111111111111" +Enable-SPOSiteRestrictedAppAccessControl -Identity $url +``` + +This example stages a policy and then enables it explicitly. The mode and list changes are configuration-only and don't turn enforcement on, so nothing is enforced until the final command runs. + +### Example 4 + +```powershell +Enable-SPOSiteRestrictedAppAccessControl -Identity "https://contoso.sharepoint.com/sites/Finance" -Confirm:$false +``` + +This example turns on enforcement without an interactive confirmation prompt, for use in automation. Using `-Confirm:$false` doesn't bypass validation, authorization, auditing, or first-party protection. + +## PARAMETERS + +### -Identity + +Specifies the site to enable. Provide either the site URL or the site ID. + +```yaml +Type: String +Parameter Sets: (All) +Aliases: +Applicable: SharePoint Online +Required: True +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: wi +Applicable: SharePoint Online +Required: False +Position: Named +Default value: False +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm + +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: cf +Applicable: SharePoint Online +Required: False +Position: Named +Default value: True +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### None + +## OUTPUTS + +### None + +This cmdlet doesn't return an object. Use `Get-SPOSiteRestrictedAppAccessControl` to read the resulting policy. + +## NOTES + +- This cmdlet fails when no mode is set on the site. Enabled with mode `None` is the only combination that the backend rejects. +- Site enforcement is turned on only by this cmdlet. Mode and list changes are configuration-only and preserve the current enablement state. +- An empty active allow list blocks all governed third-party and agentic apps. Review the active list with `Get-SPOSiteRestrictedAppAccessControl` before you enable a site. +- The tenant switch gates all site enforcement, so a site policy has no effect while the tenant switch is off. The tenant deny list can't be overridden by a site allow list. +- App Restrictions never grants permissions. A request must still pass existing SharePoint authorization. +- This cmdlet supports `-WhatIf` and `-Confirm` with `ConfirmImpact.High`. `-Confirm:$false` is allowed for automation and doesn't bypass validation, authorization, auditing, or first-party protection. +- [Add the exact warning and error text emitted by the cmdlet.] + +## RELATED LINKS + +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) + +[Set-SPOSiteRestrictedAppAccessControlMode](Set-SPOSiteRestrictedAppAccessControlMode.md) + +[Set-SPOSiteRestrictedAppAccessControlList](Set-SPOSiteRestrictedAppAccessControlList.md) + +[Disable-SPOSiteRestrictedAppAccessControl](Disable-SPOSiteRestrictedAppAccessControl.md) + +[Clear-SPOSiteRestrictedAppAccessControlList](Clear-SPOSiteRestrictedAppAccessControlList.md) + +[Clear-SPOSiteRestrictedAppAccessControlPolicy](Clear-SPOSiteRestrictedAppAccessControlPolicy.md) + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spotenantrestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spotenantrestrictedappaccesscontrol.md new file mode 100644 index 000000000..44360743e --- /dev/null +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spotenantrestrictedappaccesscontrol.md @@ -0,0 +1,151 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/enable-spotenantrestrictedappaccesscontrol +applicable: SharePoint Online +title: Enable-SPOTenantRestrictedAppAccessControl +schema: 2.0.0 +ms.author: neilh +ms.reviewer: [ Add reviewer alias ] +description: Learn how to use Enable-SPOTenantRestrictedAppAccessControl to activate the master enforcement switch for App Restrictions across your SharePoint Online tenant. +ms.date: 10/09/2026 +ms.topic: concept-article +--- + +# Enable-SPOTenantRestrictedAppAccessControl + +## SYNOPSIS + +Turns on the tenant App Restrictions enforcement switch for your organization. + +## SYNTAX + +```powershell +Enable-SPOTenantRestrictedAppAccessControl [-WhatIf] [-Confirm] [] +``` + +## DESCRIPTION + +Use the `Enable-SPOTenantRestrictedAppAccessControl` cmdlet to turn on the tenant enforcement switch for Restricted App Access Control. + +App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions. + +The tenant switch is the master enforcement switch for the feature. While it's off, no App Restrictions policy is enforced, including the tenant deny list and every configured site policy. This cmdlet warns that enforcement begins tenant-wide, including all configured site policies. Review the stored tenant deny list with `Get-SPOTenantRestrictedAppAccessControl` and review your site policies before you enable the switch. + +Enabling the switch doesn't change the stored deny list. Configuration and enablement are orthogonal: this cmdlet changes only the switch, and list changes made with `Set-SPOTenantRestrictedAppAccessControlList` never flip the switch. Enforcement resumes with the configuration that was preserved while the switch was off. + +An enabled switch with an empty tenant deny list is a valid state, but the tenant deny list denies nothing until an application ID is added. + +The tenant scope is deny-only and has a single list, so there's no mode cmdlet and no `-ListType` parameter at tenant scope. + +Tenant App Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. App Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. + +You must be at least a SharePoint Administrator to run this cmdlet. + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +```powershell +Enable-SPOTenantRestrictedAppAccessControl +``` + +This example turns on the tenant enforcement switch. The cmdlet warns that enforcement begins tenant-wide, including all configured site policies, and then prompts for confirmation. + +### Example 2 + +```powershell +Get-SPOTenantRestrictedAppAccessControl +Enable-SPOTenantRestrictedAppAccessControl +``` + +This example reviews the stored tenant policy first, so you can see which application IDs are on the deny list, and then turns on enforcement. + +### Example 3 + +```powershell +Enable-SPOTenantRestrictedAppAccessControl -WhatIf +``` + +This example shows what would happen if the tenant switch were turned on, without changing the stored tenant policy. + +### Example 4 + +```powershell +Enable-SPOTenantRestrictedAppAccessControl -Confirm:$false +``` + +This example turns on the tenant switch without prompting for confirmation, which is useful in automation. Suppressing the prompt doesn't bypass validation, authorization, or auditing. + +## PARAMETERS + +### -WhatIf + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: wi +Applicable: SharePoint Online +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm + +Prompts you for confirmation before running the cmdlet. This cmdlet has a confirm impact of High, so it prompts by default. Automation can use `-Confirm:$false` to suppress the prompt. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: cf +Applicable: SharePoint Online +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### None + +## OUTPUTS + +### None + +This cmdlet doesn't return an output object. Use `Get-SPOTenantRestrictedAppAccessControl` to confirm the resulting tenant policy. + +## NOTES + +- The cmdlet warns that enforcement begins tenant-wide, including all configured site policies. +- The tenant switch is the master enforcement switch. While it's off, no App Restrictions policy is enforced, including the tenant deny list and all site policies. +- Enabling the switch doesn't change the stored deny list. Configuration and enablement are orthogonal. +- An enabled switch with an empty deny list is allowed, but the tenant deny list denies nothing until an application ID is added. +- Microsoft first-party and core applications are excluded from App Restrictions configuration and enforcement. +- Use `Enable-SPOSiteRestrictedAppAccessControl` to turn on enforcement for an individual site. + +## RELATED LINKS + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Set-SPOTenantRestrictedAppAccessControlList](Set-SPOTenantRestrictedAppAccessControlList.md) + +[Disable-SPOTenantRestrictedAppAccessControl](Disable-SPOTenantRestrictedAppAccessControl.md) + +[Clear-SPOTenantRestrictedAppAccessControlPolicy](Clear-SPOTenantRestrictedAppAccessControlPolicy.md) + +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spositerestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spositerestrictedappaccesscontrol.md new file mode 100644 index 000000000..0399cfaf3 --- /dev/null +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spositerestrictedappaccesscontrol.md @@ -0,0 +1,165 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/get-spositerestrictedappaccesscontrol +applicable: SharePoint Online +title: Get-SPOSiteRestrictedAppAccessControl +schema: 2.0.0 +ms.author: neilh +ms.reviewer: [ Add reviewer alias ] +description: Learn how to use Get-SPOSiteRestrictedAppAccessControl to read a SharePoint site's App Restrictions policy and check enforcement status with PowerShell. +ms.date: 10/09/2026 +ms.topic: concept-article +--- + +# Get-SPOSiteRestrictedAppAccessControl + +## SYNOPSIS + +Returns the complete site-level App Restrictions policy for a site, including enablement, active mode, and both the allow list and the deny list. + +## SYNTAX + +```powershell +Get-SPOSiteRestrictedAppAccessControl [-Identity] [] +``` + +## DESCRIPTION + +Use the `Get-SPOSiteRestrictedAppAccessControl` cmdlet to read the complete Restricted App Access Control policy stored for a single site. + +App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions. + +A site policy has four parts: + +- **Enabled** - whether site enforcement is turned on. Site enforcement is turned on only by `Enable-SPOSiteRestrictedAppAccessControl`. Mode and list changes are configuration-only and preserve the current enablement state. +- **Mode** - the active mode. When the mode is `Allow`, applications in the allow list are allowed and all other governed apps are denied. When the mode is `Deny`, applications in the deny list are denied and all other governed apps are allowed. `Allow` is the default mode when a site is enabled without existing configuration. +- **AllowList** - the persistent list used when the mode is `Allow`. +- **DenyList** - the persistent list used when the mode is `Deny`. + +Both lists are always stored and can be managed regardless of which mode is active. Only the list selected by the active mode participates in runtime enforcement. The inactive list is preserved for future mode changes and has no runtime effect. An empty active allow list blocks all governed third-party and agentic apps. An empty active deny list allows all governed apps. + +`AllowList` and `DenyList` are returned as GUID arrays. Each list can contain both concrete application IDs and parent agent blueprint IDs, and a blueprint ID applies to the blueprint application itself and to every current or future agent app created from that blueprint. The cmdlet doesn't require you to distinguish between the two: each property merges its internally typed application and blueprint entries into one stable, duplicate-free list of GUIDs. + +This cmdlet performs an uncached read and always returns the authoritative stored policy rather than a cached copy. + +Site enforcement is gated by the tenant switch. While the tenant switch is off, no site policy is enforced, even when a site policy reports `Enabled` as `True`. While the tenant switch is on, the tenant deny list takes precedence and can't be overridden by a site allow list. Use `Get-SPOTenantRestrictedAppAccessControl` to read the tenant switch and the tenant deny list. + +Site App Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. App Restrictions is fully decoupled from site properties, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated App Restrictions cmdlets listed in [Related Links](#related-links). + +You must be at least a SharePoint Administrator to run this cmdlet. +Microsoft first-party and core applications are excluded from App Restrictions configuration and enforcement and never appear in a site list. + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +```powershell +Get-SPOSiteRestrictedAppAccessControl -Identity https://contoso.sharepoint.com/sites/Finance +``` + +This example returns the complete Restricted App Access Control policy for the Finance site, bound by site URL. + +### Example 2 + +```powershell +Get-SPOSiteRestrictedAppAccessControl -Identity 8a1e30f6-2f52-4b9e-9d1b-2e9f6c1d40aa +``` + +This example returns the same policy for a site bound by site ID. The returned object carries `SiteUrl`, so it identifies its own site even when you don't know the URL. + +### Example 3 + +```powershell +$policy = Get-SPOSiteRestrictedAppAccessControl -Identity https://contoso.sharepoint.com/sites/Finance +if ($policy.Mode -eq "Allow") { + $policy.AllowList +} else { + $policy.DenyList +} +``` + +This example returns only the list that the active mode enforces. The other list is still stored and preserved, but it has no runtime effect until you change the mode. + +### Example 4 + +```powershell +$policy = Get-SPOSiteRestrictedAppAccessControl -Identity https://contoso.sharepoint.com/sites/Finance +if ($policy.Enabled -and $policy.Mode -eq "Allow" -and $policy.AllowList.Count -eq 0) { + Write-Host "Enforcement is on with an empty active allow list, which blocks all governed third-party and agentic apps." +} +``` + +This example identifies the state where enforcement is enabled, the active mode is `Allow`, and the active allow list is empty. In that state, all governed third-party and agentic apps are blocked from the site while the tenant switch is on. + +## PARAMETERS + +### -Identity + +Specifies the site to read. You can specify either the site URL or the site ID. + +```yaml +Type: String +Parameter Sets: (All) +Aliases: +Applicable: SharePoint Online +Required: True +Position: 0 +Default value: None +Accept pipeline input: True +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### System.String + +## OUTPUTS + +### SPORestrictedAppAccessControlSitePolicy + +Returns an `SPORestrictedAppAccessControlSitePolicy` object with the following properties. + +| Property | Type | Description | +|---|---|---| +| `SiteUrl` | String | The URL of the site the policy belongs to. This property is carried so the returned object identifies its own site, which matters when sites are piped into the cmdlet and when you bound the site by ID. | +| `Enabled` | Boolean | Indicates whether site enforcement is turned on. Site enforcement is also gated by the tenant switch. | +| `Mode` | String | The active mode, `Allow` or `Deny`. Only the list selected by this mode is enforced. | +| `AllowList` | Guid[] | The persistent allow list, returned as one stable, duplicate-free list of application IDs and parent agent blueprint IDs. | +| `DenyList` | Guid[] | The persistent deny list, returned as one stable, duplicate-free list of application IDs and parent agent blueprint IDs. | + +When the stored policy data is malformed, the cmdlet emits a warning and the returned object includes `IsPolicyDataMalformed = true`. Healthy output omits that property. + +## NOTES + +- Getters return authoritative uncached state. +- Both lists are always stored. Only the list selected by the active mode is enforced; the inactive list is preserved and has no runtime effect. +- Each list has a hard maximum of 100 entries, and the two lists combined have a hard maximum of 200 entries. +- A parent agent blueprint ID entry applies to the blueprint application itself and to every current or future agent app created from that blueprint. +- The tenant switch gates all site enforcement. While the tenant switch is on, the tenant deny list can't be overridden by a site allow list. +- Configuration and enablement are orthogonal: mode and list changes never turn enforcement on. The only combination the backend rejects is enabled with mode `None`. +- Use `Get-SPOTenantRestrictedAppAccessControl` to read the tenant-level policy. + +## RELATED LINKS + +[Set-SPOSiteRestrictedAppAccessControlMode](Set-SPOSiteRestrictedAppAccessControlMode.md) + +[Set-SPOSiteRestrictedAppAccessControlList](Set-SPOSiteRestrictedAppAccessControlList.md) + +[Enable-SPOSiteRestrictedAppAccessControl](Enable-SPOSiteRestrictedAppAccessControl.md) + +[Disable-SPOSiteRestrictedAppAccessControl](Disable-SPOSiteRestrictedAppAccessControl.md) + +[Clear-SPOSiteRestrictedAppAccessControlList](Clear-SPOSiteRestrictedAppAccessControlList.md) + +[Clear-SPOSiteRestrictedAppAccessControlPolicy](Clear-SPOSiteRestrictedAppAccessControlPolicy.md) + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spotenantrestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spotenantrestrictedappaccesscontrol.md new file mode 100644 index 000000000..6d2294bf4 --- /dev/null +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spotenantrestrictedappaccesscontrol.md @@ -0,0 +1,134 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/get-spotenantrestrictedappaccesscontrol +applicable: SharePoint Online +title: Get-SPOTenantRestrictedAppAccessControl +schema: 2.0.0 +ms.author: neilh +ms.reviewer: [ Add reviewer alias ] +description: Get-SPOTenantRestrictedAppAccessControl retrieves your tenant's App Restrictionsolicy, including enforcement status and the deny list. Learn how. +ms.date: 10/09/2026 +ms.topic: concept-article +--- + +# Get-SPOTenantRestrictedAppAccessControl + +## SYNOPSIS + +Returns the tenant-level App Restrictions policy, including the tenant enforcement switch and the tenant-wide deny list of restricted application IDs. + +## SYNTAX + +```powershell +Get-SPOTenantRestrictedAppAccessControl [] +``` + +## DESCRIPTION + +Use the `Get-SPOTenantRestrictedAppAccessControl` cmdlet to read the complete tenant Restricted App Access Control policy for your organization. + +App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions. + +The tenant policy has two parts: + +- **Enabled** - the master enforcement switch for App Restrictions. When this switch is off, no RAC for Apps policy is enforced, including the tenant deny list and any site-level policies. Stored tenant and site configuration is preserved, so enforcement resumes with the same configuration when the switch is turned on again. +- **RestrictedAppIds** - the tenant-wide emergency deny list. When the switch is on, applications in this list are denied and the list can't be overridden by a site-level allow list. + +The tenant deny list can contain both concrete application IDs and parent agent blueprint IDs. A blueprint ID applies to the blueprint application itself and to every current or future agent app created from that blueprint. The cmdlet doesn't require you to distinguish between the two: `RestrictedAppIds` merges the internally typed entries into one stable, duplicate-free list of GUIDs. IDs are stored as lowercase canonical GUID strings and sorted, so output is stable between calls. + +This cmdlet performs an uncached read and always returns the authoritative, latest stored policy rather than a cached copy. + +Tenant App Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. App Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. Use the dedicated App Restrictions cmdlets listed in [Related Links](#related-links). + +You must be at least a SharePoint Administrator to run this cmdlet. + +Microsoft first-party and core applications are excluded from App Restrictions configuration and enforcement and never appear in the tenant deny list. + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +```powershell +Get-SPOTenantRestrictedAppAccessControl +``` + +This example returns the complete tenant Restricted App Access Control policy, showing whether enforcement is enabled and which application IDs are on the tenant deny list. + +### Example 2 + +```powershell +(Get-SPOTenantRestrictedAppAccessControl).RestrictedAppIds +``` + +This example returns only the restricted application IDs from the tenant deny list. + +### Example 3 + +```powershell +$policy = Get-SPOTenantRestrictedAppAccessControl +if (-not $policy.Enabled) { + Write-Host "App Restrictions enforcement is off. Site policies aren't enforced." +} +``` + +This example stores the tenant policy in a variable and checks the master switch. Because the tenant switch gates all site-level enforcement, a disabled switch means no configured site policy is being enforced. + +### Example 4 + +```powershell +$policy = Get-SPOTenantRestrictedAppAccessControl +if ($policy.Enabled -and $policy.RestrictedAppIds.Count -eq 0) { + Write-Host "Enforcement is on, but the tenant deny list is empty and denies nothing." +} +``` + +This example identifies the state where enforcement is enabled but the tenant deny list is empty. This state is valid, and often occurs during cleanup, but the tenant deny list has no effect until an application ID is added. + +## PARAMETERS + +This cmdlet has no parameters. + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### None + +## OUTPUTS + +### SPORestrictedAppAccessControlTenantPolicy + +Returns an `SPORestrictedAppAccessControlTenantPolicy` object with the following properties. + +| Property | Type | Description | +|---|---|---| +| `Enabled` | Boolean | Indicates whether the tenant App Restrictions enforcement switch is on. When `False`, no App Restrictions policy is enforced, including the tenant deny list and all site policies. | +| `RestrictedAppIds` | Guid[] | The tenant-wide deny list, returned as one stable, duplicate-free list of application IDs and parent agent blueprint IDs. | + +## NOTES + +- The tenant switch is the master enforcement switch for the feature. Turning it off stops every configured site policy from enforcing, not just the tenant deny list. +- While the tenant switch is on, the tenant deny list takes precedence over site policy and can't be overridden by a site allow list. +- The tenant scope is deny-only and has a single list, so there's no mode and no list-type selection at tenant scope. +- The tenant deny list has a hard maximum of 100 application IDs. +- Configuration and enablement are independent: changing the deny list never turns the tenant switch on or off. +- Use `Get-SPOSiteRestrictedAppAccessControl` to read the policy for an individual site. + +## RELATED LINKS + +[Enable-SPOTenantRestrictedAppAccessControl](Enable-SPOTenantRestrictedAppAccessControl.md) + +[Disable-SPOTenantRestrictedAppAccessControl](Disable-SPOTenantRestrictedAppAccessControl.md) + +[Set-SPOTenantRestrictedAppAccessControlList](Set-SPOTenantRestrictedAppAccessControlList.md) + +[Clear-SPOTenantRestrictedAppAccessControlPolicy](Clear-SPOTenantRestrictedAppAccessControlPolicy.md) + +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrolmode.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrolmode.md new file mode 100644 index 000000000..7efa80ec9 --- /dev/null +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrolmode.md @@ -0,0 +1,196 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/set-spositerestrictedappaccesscontrolmode +applicable: SharePoint Online +title: Set-SPOSiteRestrictedAppAccessControlMode +schema: 2.0.0 +ms.author: neilh +ms.reviewer: [ Add reviewer alias ] +description: Set-SPOSiteRestrictedAppAccessControlMode switches a site between Allow and Deny modes while preserving both app lists. Learn the syntax and examples. +ms.date: 10/09/2026 +ms.topic: concept-article +--- + +# Set-SPOSiteRestrictedAppAccessControlMode + +## SYNOPSIS + +Sets the active mode of the site-level App Restrictions policy to `Allow` or `Deny`, preserving site enablement and both lists. + +## SYNTAX + +```powershell +Set-SPOSiteRestrictedAppAccessControlMode [-Identity] -Mode [-WhatIf] [-Confirm] + [] +``` + +## DESCRIPTION + +Use the `Set-SPOSiteRestrictedAppAccessControlMode` cmdlet to change which list a site enforces. This cmdlet changes the active mode only. It preserves site enablement and both the allow list and the deny list. + +Restricted App Access Control (RAC for Apps) adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and RAC for Apps. + +The active mode selects the list that is enforced: + +- **Allow** - applications in the allow list are allowed and all other governed apps are denied. An empty active allow list blocks all governed third-party and agentic apps. +- **Deny** - applications in the deny list are denied and all other governed apps are allowed. An empty active deny list allows all governed apps. + +`Allow` is the default mode when a site is enabled without existing configuration. Both lists are always stored and can be managed regardless of which mode is active. Only the list selected by the active mode participates in runtime enforcement. The inactive list is preserved for future mode changes and has no runtime effect. + +Because a mode switch can change the effective decision for every governed application on the site, the cmdlet displays a warning before it makes the change. The warning identifies the current mode, the target mode, the size of the newly active preserved list, and the new default decision, and it clearly states that both lists are preserved. The cmdlet then asks you to confirm. Use `-WhatIf` to display the same impact without changing the policy. + +Configuration and enablement are orthogonal: a mode change never turns enforcement on. Site enforcement is turned on only by `Enable-SPOSiteRestrictedAppAccessControl`, so you can stage a mode and lists and then enable the site explicitly. The only combination the backend rejects is enabled with mode `None`. + +Site enforcement is also gated by the tenant switch. While the tenant switch is on, the tenant deny list takes precedence and can't be overridden by a site allow list. + +Automation can use the standard `-Confirm:$false`. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. + +Site App Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated RAC for Apps cmdlets listed in [Related Links](#related-links). + +You must be at least a SharePoint Administrator to run this cmdlet. + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +```powershell +Set-SPOSiteRestrictedAppAccessControlMode -Identity https://contoso.sharepoint.com/sites/Finance -Mode Allow +``` + +This example sets the active mode of the Finance site to `Allow`, so only applications in the site allow list can access the site and all other governed apps are denied. The deny list is preserved but becomes inactive. The cmdlet displays the mode-switch warning and asks for confirmation before it applies the change. + +### Example 2 + +```powershell +Set-SPOSiteRestrictedAppAccessControlMode -Identity https://contoso.sharepoint.com/sites/Finance -Mode Deny -WhatIf +``` + +This example displays the impact of switching the Finance site to `Deny`, including the current mode, the target mode, the size of the newly active deny list, and the new default decision, without changing the policy. + +### Example 3 + +```powershell +Set-SPOSiteRestrictedAppAccessControlMode -Identity 8a1e30f6-2f52-4b9e-9d1b-2e9f6c1d40aa -Mode Deny -Confirm:$false +``` + +This example switches a site bound by site ID to `Deny` without prompting, for use in automation. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. + +### Example 4 + +```powershell +Set-SPOSiteRestrictedAppAccessControlMode -Identity https://contoso.sharepoint.com/sites/Finance -Mode Allow +Enable-SPOSiteRestrictedAppAccessControl -Identity https://contoso.sharepoint.com/sites/Finance +``` + +This example stages the mode first and then turns enforcement on explicitly. A mode change never turns enforcement on by itself. + +## PARAMETERS + +### -Identity + +Specifies the site to configure. You can specify either the site URL or the site ID. + +```yaml +Type: String +Parameter Sets: (All) +Aliases: +Applicable: SharePoint Online +Required: True +Position: 0 +Default value: None +Accept pipeline input: True +Accept wildcard characters: False +``` + +### -Mode + +Specifies the active mode of the site policy. Valid values are `Allow` and `Deny`. + +When the mode is `Allow`, applications in the allow list are allowed and all other governed apps are denied. When the mode is `Deny`, applications in the deny list are denied and all other governed apps are allowed. Both lists are preserved either way. + +```yaml +Type: String +Parameter Sets: (All) +Aliases: +Applicable: SharePoint Online +Accepted values: Allow, Deny +Required: True +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. `-WhatIf` displays the same mode-switch impact as the confirmation warning without changing the policy. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: wi +Applicable: SharePoint Online +Required: False +Position: Named +Default value: False +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm + +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: cf +Applicable: SharePoint Online +Required: False +Position: Named +Default value: True +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### System.String + +## OUTPUTS + +### None + +## NOTES + +- A mode change changes only the active mode. It preserves site enablement and both lists. +- Before the switch, the cmdlet warns with the current mode, the target mode, the size of the newly active preserved list, and the new default decision, states that both lists are preserved, and asks for confirmation. +- An empty active allow list blocks all governed third-party and agentic apps. An empty active deny list allows all governed apps. +- Configuration and enablement are orthogonal. Site enforcement is turned on only by `Enable-SPOSiteRestrictedAppAccessControl`. The only combination the backend rejects is enabled with mode `None`. +- The tenant switch gates all site enforcement. While the tenant switch is on, the tenant deny list can't be overridden by a site allow list. +- Use `Get-SPOSiteRestrictedAppAccessControl` to confirm the resulting mode and both lists. + +## RELATED LINKS + +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) + +[Set-SPOSiteRestrictedAppAccessControlList](Set-SPOSiteRestrictedAppAccessControlList.md) + +[Enable-SPOSiteRestrictedAppAccessControl](Enable-SPOSiteRestrictedAppAccessControl.md) + +[Disable-SPOSiteRestrictedAppAccessControl](Disable-SPOSiteRestrictedAppAccessControl.md) + +[Clear-SPOSiteRestrictedAppAccessControlList](Clear-SPOSiteRestrictedAppAccessControlList.md) + +[Clear-SPOSiteRestrictedAppAccessControlPolicy](Clear-SPOSiteRestrictedAppAccessControlPolicy.md) + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spotenantrestrictedappaccesscontrollist.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spotenantrestrictedappaccesscontrollist.md new file mode 100644 index 000000000..840529c78 --- /dev/null +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spotenantrestrictedappaccesscontrollist.md @@ -0,0 +1,195 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/set-spotenantrestrictedappaccesscontrollist +applicable: SharePoint Online +title: Set-SPOTenantRestrictedAppAccessControlList +schema: 2.0.0 +ms.author: neilh +ms.reviewer: [ Add reviewer alias ] +description: Set-SPOTenantRestrictedAppAccessControlList lets you add or remove app IDs from the tenant deny list in one atomic update. Learn syntax and examples. +ms.date: 10/09/2026 +ms.topic: concept-article +--- + +# Set-SPOTenantRestrictedAppAccessControlList + +## SYNOPSIS + +Adds application IDs to and removes application IDs from the tenant-wide App Restrictions deny list in a single atomic update. + +## SYNTAX + +```powershell +Set-SPOTenantRestrictedAppAccessControlList [-AddRestrictedAppIds ] + [-RemoveRestrictedAppIds ] [-WhatIf] [-Confirm] [] +``` + +## DESCRIPTION + +Use the `Set-SPOTenantRestrictedAppAccessControlList` cmdlet to change the tenant-wide emergency deny list for Restricted App Access Control. + +App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and RAC for Apps. + +Both parameters are applied in one atomic update that preserves the tenant enforcement switch. At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, and the same ID can't appear in both parameters. Removals are applied before additions. + +You supply application IDs only. You don't identify whether an ID is a regular application or a parent agent blueprint: the backend classifies each added ID and stores it in the appropriate internal list. A parent agent blueprint ID on the tenant deny list blocks the blueprint application itself and every current or future agent app created from that blueprint. + +Added IDs are classified by using Microsoft Graph. Microsoft first-party and core applications and IDs that can't be classified are rejected, and a bulk add is all-or-none: if any supplied ID is rejected, no IDs are persisted. Removals don't use Microsoft Graph, so stale or deleted application IDs can always be removed. + +The combined tenant deny list has a hard maximum of 100 application IDs. + +Configuration and enablement are orthogonal: list changes never turn the tenant switch on or off. Use `Enable-SPOTenantRestrictedAppAccessControl` and `Disable-SPOTenantRestrictedAppAccessControl` to change enforcement. + +Removing the last entry leaves an enabled switch with an empty deny list, which denies nothing. That state is allowed because it's legitimate during cleanup, but the cmdlet warns and points you to `Disable-SPOTenantRestrictedAppAccessControl` or `Clear-SPOTenantRestrictedAppAccessControlPolicy` for turning the feature off explicitly. + +The tenant scope is deny-only and has a single list, so there's no mode cmdlet, no `-ListType` parameter, and no separate clear-list cmdlet. + +Tenant App Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. App Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. + +You must be at least a SharePoint Administrator to run this cmdlet. + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/connect-sharepoint-online). + +## EXAMPLES + +### Example 1 + +```powershell +Set-SPOTenantRestrictedAppAccessControlList -AddRestrictedAppIds 11111111-1111-1111-1111-111111111111 +``` + +This example adds one application ID to the tenant deny list. The backend classifies the ID and stores it as either a regular application or a parent agent blueprint. The tenant enforcement switch isn't changed. + +### Example 2 + +```powershell +Set-SPOTenantRestrictedAppAccessControlList -AddRestrictedAppIds 11111111-1111-1111-1111-111111111111, 22222222-2222-2222-2222-222222222222 -RemoveRestrictedAppIds 33333333-3333-3333-3333-333333333333 +``` + +This example adds two application IDs and removes a third in a single atomic update. The removal is applied before the additions. If either added ID is a first-party or core application, or can't be classified, the complete operation fails and nothing is persisted. + +### Example 3 + +```powershell +Set-SPOTenantRestrictedAppAccessControlList -RemoveRestrictedAppIds 33333333-3333-3333-3333-333333333333 -Confirm:$false +``` + +This example removes an application ID without prompting for confirmation, which is useful in automation. Removals don't call Microsoft Graph, so an ID for a deleted or stale application can still be removed. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. + +### Example 4 + +```powershell +Set-SPOTenantRestrictedAppAccessControlList -AddRestrictedAppIds 44444444-4444-4444-4444-444444444444 -WhatIf +``` + +This example shows what would happen if the application ID were added, without changing the stored tenant policy. + +## PARAMETERS + +### -AddRestrictedAppIds + +Specifies the application IDs to add to the tenant deny list. Each supplied ID is classified by using Microsoft Graph and stored internally as either a regular application or a parent agent blueprint. First-party/core and unclassifiable IDs are rejected, and the add is all-or-none. + +At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, and an ID can't appear in both parameters. The combined tenant deny list can't exceed 100 IDs. + +```yaml +Type: Guid[] +Parameter Sets: (All) +Aliases: +Applicable: SharePoint Online +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -RemoveRestrictedAppIds + +Specifies the application IDs to remove from the tenant deny list. Removals are applied before additions and don't use Microsoft Graph, so stale or deleted application IDs can always be removed. + +At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, and an ID can't appear in both parameters. + +```yaml +Type: Guid[] +Parameter Sets: (All) +Aliases: +Applicable: SharePoint Online +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: wi +Applicable: SharePoint Online +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm + +Prompts you for confirmation before running the cmdlet. This cmdlet has a confirm impact of High, so it prompts by default. Automation can use `-Confirm:$false` to suppress the prompt. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: cf +Applicable: SharePoint Online +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### None + +## OUTPUTS + +### None + +This cmdlet doesn't return an output object. Use `Get-SPOTenantRestrictedAppAccessControl` to read the resulting tenant policy. + +## NOTES + +- Adds and removes are applied as one atomic update. Removals are applied before additions. +- A bulk add is all-or-none. If any supplied ID is a first-party/core application or can't be classified, no IDs are persisted. +- The combined tenant deny list has a hard maximum of 100 application IDs. +- The administrator supplies IDs only. The backend classifies each added ID and stores it as either a regular application or a parent agent blueprint. +- A parent agent blueprint ID blocks the blueprint application and every current or future agent app created from it. +- Configuration and enablement are orthogonal: list changes never flip the tenant switch. +- Removing the last entry leaves an enabled switch with an empty deny list that denies nothing. The cmdlet warns and points to `Disable-SPOTenantRestrictedAppAccessControl` or `Clear-SPOTenantRestrictedAppAccessControlPolicy`. +- Use `Set-SPOSiteRestrictedAppAccessControlList` to change the lists for an individual site. + +## RELATED LINKS + +[Get-SPOTenantRestrictedAppAccessControl](/powershell/module/microsoft.online.sharepoint.powershell/Get-SPOTenantRestrictedAppAccessControl) + +[Enable-SPOTenantRestrictedAppAccessControl](/powershell/module/microsoft.online.sharepoint.powershell/Enable-SPOTenantRestrictedAppAccessControl) + +[Disable-SPOTenantRestrictedAppAccessControl](/powershell/module/microsoft.online.sharepoint.powershell/Disable-SPOTenantRestrictedAppAccessControl) + +[Clear-SPOTenantRestrictedAppAccessControlPolicy](/powershell/module/microsoft.online.sharepoint.powershell/Clear-SPOTenantRestrictedAppAccessControlPolicy) + +[Get-SPOSiteRestrictedAppAccessControl](/powershell/module/microsoft.online.sharepoint.powershell/Get-SPOSiteRestrictedAppAccessControl) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) diff --git a/sharepoint/sharepoint-ps/set-spositerestrictedappaccesscontrollist.md b/sharepoint/sharepoint-ps/set-spositerestrictedappaccesscontrollist.md new file mode 100644 index 000000000..fb0add914 --- /dev/null +++ b/sharepoint/sharepoint-ps/set-spositerestrictedappaccesscontrollist.md @@ -0,0 +1,238 @@ +--- +external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml +Module Name: Microsoft.Online.SharePoint.PowerShell +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/set-spositerestrictedappaccesscontrollist +applicable: SharePoint Online +title: Set-SPOSiteRestrictedAppAccessControlList +schema: 2.0.0 +ms.author: neilh +ms.reviewer: [ Add reviewer alias ] +description: Learn how to use Set-SPOSiteRestrictedAppAccessControlList to manage site-level allow and deny lists for App Restrictions in SharePoint Online. +ms.date: 10/09/2026 +ms.topic: concept-article +--- + +# Set-SPOSiteRestrictedAppAccessControlList + +## SYNOPSIS + +Adds application IDs to, or removes application IDs from, the allow list or the deny list of a site-level App Restrictions policy, in one atomic update. + +## SYNTAX + +```powershell +Set-SPOSiteRestrictedAppAccessControlList [-Identity] -ListType + [-AddRestrictedAppIds ] [-RemoveRestrictedAppIds ] [-WhatIf] [-Confirm] + [] +``` + +## DESCRIPTION + +Use the `Set-SPOSiteRestrictedAppAccessControlList` cmdlet to change the contents of one site list. Additions and removals are applied in one atomic update that preserves site enablement and the active mode. + +App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions. + +Use `-ListType` to identify the target list explicitly. Both lists are always stored and can be managed regardless of which mode is active. Only the list selected by the active mode participates in runtime enforcement, so adding or removing entries in the inactive list doesn't change current enforcement. The inactive list is preserved for future mode changes. + +The active mode determines what the change means at runtime. When the mode is `Allow`, applications in the allow list are allowed and all other governed apps are denied; an empty active allow list blocks all governed third-party and agentic apps. When the mode is `Deny`, applications in the deny list are denied and all other governed apps are allowed; an empty active deny list allows all governed apps. + +At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, an ID can't appear in both, and removals are applied before additions. + +You supply application IDs only. Each list can contain both concrete application IDs and parent agent blueprint IDs, and the backend classifies each added ID and stores its type internally. A parent agent blueprint ID applies to the blueprint application itself and to every current or future agent app created from that blueprint. In an active deny list, a blueprint ID blocks that complete app family. In an active allow list, it allows that complete app family through App Restrictions. + +Adding IDs uses the same bulk Microsoft Graph classification and first-party exclusion as the tenant cmdlets. Microsoft first-party and core applications are rejected, IDs that can't be classified are rejected, and a bulk add is all-or-none, so no partial set of IDs is persisted. + +Removing entries requires only `-ListType` and `-RemoveRestrictedAppIds`. Removal doesn't call Microsoft Graph, so deleted or stale application IDs can still be removed. If a supplied ID isn't present in the target list, the cmdlet returns a validation error. + +Configuration and enablement are orthogonal: a list change never turns enforcement on. Site enforcement is turned on only by `Enable-SPOSiteRestrictedAppAccessControl`, so you can stage lists and then enable the site explicitly. This avoids the dangerous case where adding a single ID to an unconfigured site would immediately activate an allow list and block every other application. The only combination the backend rejects is enabled with mode `None`. + +Site enforcement is also gated by the tenant switch. While the tenant switch is on, the tenant deny list takes precedence and can't be overridden by a site allow list. + +Automation can use the standard `-Confirm:$false`. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. + +Site App Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated App Restrictions cmdlets listed in [Related Links](#related-links). + +You must be at least a SharePoint Administrator to run this cmdlet. + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +```powershell +Set-SPOSiteRestrictedAppAccessControlList -Identity https://contoso.sharepoint.com/sites/Finance -ListType AllowList -AddRestrictedAppIds 11111111-1111-1111-1111-111111111111 +``` + +This example adds one application ID to the allow list of the Finance site. The site's enablement and active mode are preserved. If the ID is a Microsoft first-party or core application, or if it can't be classified, the add is rejected. + +### Example 2 + +```powershell +Set-SPOSiteRestrictedAppAccessControlList -Identity https://contoso.sharepoint.com/sites/Finance -ListType DenyList -AddRestrictedAppIds 22222222-2222-2222-2222-222222222222,33333333-3333-3333-3333-333333333333 -RemoveRestrictedAppIds 44444444-4444-4444-4444-444444444444 +``` + +This example adds two IDs to the deny list and removes one ID from the deny list in a single atomic update. Removals are applied before additions, and the bulk add is all-or-none. + +### Example 3 + +```powershell +Set-SPOSiteRestrictedAppAccessControlList -Identity 8a1e30f6-2f52-4b9e-9d1b-2e9f6c1d40aa -ListType AllowList -RemoveRestrictedAppIds 55555555-5555-5555-5555-555555555555 -Confirm:$false +``` + +This example removes a stale application ID from the allow list of a site bound by site ID, without prompting. Removal doesn't call Microsoft Graph, so IDs for deleted applications can still be removed. If the ID isn't present in the list, the cmdlet returns a validation error. + +### Example 4 + +```powershell +Set-SPOSiteRestrictedAppAccessControlList -Identity https://contoso.sharepoint.com/sites/Finance -ListType DenyList -AddRestrictedAppIds 66666666-6666-6666-6666-666666666666 -WhatIf +``` + +This example shows what would change without modifying the policy. Adding a parent agent blueprint ID to a deny list blocks the blueprint application and every current or future agent app created from it. + +## PARAMETERS + +### -Identity + +Specifies the site to configure. You can specify either the site URL or the site ID. + +```yaml +Type: String +Parameter Sets: (All) +Aliases: +Applicable: SharePoint Online +Required: True +Position: 0 +Default value: None +Accept pipeline input: True +Accept wildcard characters: False +``` + +### -ListType + +Specifies the list to change. Valid values are `AllowList` and `DenyList`. Entry mutations must explicitly identify the target list. + +```yaml +Type: String +Parameter Sets: (All) +Aliases: +Applicable: SharePoint Online +Accepted values: AllowList, DenyList +Required: True +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -AddRestrictedAppIds + +Specifies the application IDs to add to the list identified by `-ListType`. You supply application IDs only; the backend classifies each added ID as a regular application or a parent agent blueprint and stores the type internally. + +Adds use the shared bulk Microsoft Graph classification. First-party or core applications and unclassifiable IDs are rejected, and a bulk add is all-or-none. + +At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, and an ID can't appear in both. + +```yaml +Type: Guid[] +Parameter Sets: (All) +Aliases: +Applicable: SharePoint Online +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -RemoveRestrictedAppIds + +Specifies the application IDs to remove from the list identified by `-ListType`. Removals are applied before additions. + +Removing entries doesn't call Microsoft Graph, so deleted or stale application IDs can still be removed. If a supplied ID isn't present in the target list, the cmdlet returns a validation error. + +At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, and an ID can't appear in both. + +```yaml +Type: Guid[] +Parameter Sets: (All) +Aliases: +Applicable: SharePoint Online +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: wi +Applicable: SharePoint Online +Required: False +Position: Named +Default value: False +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm + +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. + +```yaml +Type: SwitchParameter +Parameter Sets: (All) +Aliases: cf +Applicable: SharePoint Online +Required: False +Position: Named +Default value: True +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### System.String + +## OUTPUTS + +### None + +## NOTES + +- Additions and removals are applied in one atomic update that preserves site enablement and the active mode. +- At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, an ID can't appear in both, and removals are applied before additions. +- Each list has a hard maximum of 100 entries, and the two lists combined have a hard maximum of 200 entries. Both regular application IDs and parent agent blueprint IDs consume the same quota. +- Adding or removing entries in the list that the active mode doesn't enforce doesn't change current enforcement. +- Configuration and enablement are orthogonal. Site enforcement is turned on only by `Enable-SPOSiteRestrictedAppAccessControl`. The only combination the backend rejects is enabled with mode `None`. +- The tenant switch gates all site enforcement. While the tenant switch is on, the tenant deny list can't be overridden by a site allow list. +- Use `Get-SPOSiteRestrictedAppAccessControl` to confirm the resulting lists, and `Clear-SPOSiteRestrictedAppAccessControlList` to clear an entire list. + +## RELATED LINKS + +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) + +[Set-SPOSiteRestrictedAppAccessControlMode](Set-SPOSiteRestrictedAppAccessControlMode.md) + +[Enable-SPOSiteRestrictedAppAccessControl](Enable-SPOSiteRestrictedAppAccessControl.md) + +[Disable-SPOSiteRestrictedAppAccessControl](Disable-SPOSiteRestrictedAppAccessControl.md) + +[Clear-SPOSiteRestrictedAppAccessControlList](Clear-SPOSiteRestrictedAppAccessControlList.md) + +[Clear-SPOSiteRestrictedAppAccessControlPolicy](Clear-SPOSiteRestrictedAppAccessControlPolicy.md) + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) From 30c2edfc81e517da04e5f31297fdc5444394f503 Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 14:17:35 -0500 Subject: [PATCH 02/43] Fix href for Set-SPOSiteRestrictedAppAccessControlList --- sharepoint/TOC.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sharepoint/TOC.yml b/sharepoint/TOC.yml index 0bf05a0c9..6ddf8b5bc 100644 --- a/sharepoint/TOC.yml +++ b/sharepoint/TOC.yml @@ -27,4 +27,4 @@ - name: Set-SPOTenantRestrictedAppAccessControlList href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spotenantrestrictedappaccesscontrollist.md - name: Set-SPOSiteRestrictedAppAccessControlList - href: sharepoint-ps/set-spositerestrictedappaccesscontrollist.md + href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrollist.md From 79fb9e3226be2cc056ee4b0e47fab5eda10db040 Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 14:27:33 -0500 Subject: [PATCH 03/43] Change reviewer alias to 'neilh' in documentation Updated the reviewer alias for the Clear-SPOSiteRestrictedAppAccessControlList documentation. --- .../clear-spositerestrictedappaccesscontrollist.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md index dd0857c89..7fcc093a0 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md @@ -6,7 +6,7 @@ applicable: SharePoint Online title: Clear-SPOSiteRestrictedAppAccessControlList schema: 2.0.0 ms.author: neilh -ms.reviewer: [ Add reviewer alias ] +ms.reviewer: neilh description: Clear-SPOSiteRestrictedAppAccessControlList removes all entries from a site's allow or deny list in SharePoint Online. Learn syntax, examples, and parameters. ms.date: 10/09/2026 ms.topic: concept-article From a3ca036000eb5fd5a8ecb60647372845895bb28d Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 14:27:59 -0500 Subject: [PATCH 04/43] Change reviewer alias to 'neilh' in documentation Updated the reviewer alias for the Clear-SPOSiteRestrictedAppAccessControlPolicy article. --- .../clear-spositerestrictedappaccesscontrolpolicy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrolpolicy.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrolpolicy.md index bcf5392bf..9e1af3d7d 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrolpolicy.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrolpolicy.md @@ -6,7 +6,7 @@ applicable: SharePoint Online title: Clear-SPOSiteRestrictedAppAccessControlPolicy schema: 2.0.0 ms.author: neilh -ms.reviewer: [ Add reviewer alias ] +ms.reviewer: neilh description: Clear-SPOSiteRestrictedAppAccessControlPolicy removes a site's App Restrictions policy, disabling enforcement and clearing lists. Learn syntax and examples. ms.date: 10/09/2026 ms.topic: concept-article From 18050012a9d3cd9f289d2b4b59079ad325668b7a Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 14:28:16 -0500 Subject: [PATCH 05/43] Change reviewer alias to 'neilh' in documentation Updated the reviewer alias for the Disable-SPOSiteRestrictedAppAccessControl article. --- .../disable-spositerestrictedappaccesscontrol.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spositerestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spositerestrictedappaccesscontrol.md index 98b36d154..adf7c7291 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spositerestrictedappaccesscontrol.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spositerestrictedappaccesscontrol.md @@ -6,7 +6,7 @@ applicable: SharePoint Online title: Disable-SPOSiteRestrictedAppAccessControl schema: 2.0.0 ms.author: neilh -ms.reviewer: [ Add reviewer alias ] +ms.reviewer: neilh description: Learn how to use Disable-SPOSiteRestrictedAppAccessControl in SharePoint Online PowerShell to pause site-level app access enforcement without losing saved settings. ms.date: 10/09/2026 ms.topic: concept-article From bd988563f49d3e2497f6571f79a915c455b22f75 Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 14:28:31 -0500 Subject: [PATCH 06/43] Change reviewer alias to 'neilh' in documentation Updated reviewer alias for the Enable-SPOSiteRestrictedAppAccessControl documentation. --- .../enable-spositerestrictedappaccesscontrol.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spositerestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spositerestrictedappaccesscontrol.md index 573e9c3c7..be7d77603 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spositerestrictedappaccesscontrol.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spositerestrictedappaccesscontrol.md @@ -6,7 +6,7 @@ applicable: SharePoint Online title: Enable-SPOSiteRestrictedAppAccessControl schema: 2.0.0 ms.author: neilh -ms.reviewer: [ Add reviewer alias ] +ms.reviewer: neilh description: Enable-SPOSiteRestrictedAppAccessControl turns on App Restrictions enforcement for a SharePoint site using its existing mode and lists. Learn syntax and examples. ms.date: 10/09/2026 ms.topic: concept-article From b1cbbd651450b1a0fa78cb6260fff60efb9f7de0 Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 14:28:49 -0500 Subject: [PATCH 07/43] Change reviewer alias to 'neilh' in documentation Updated reviewer alias for the Get-SPOSiteRestrictedAppAccessControl documentation. --- .../get-spositerestrictedappaccesscontrol.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spositerestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spositerestrictedappaccesscontrol.md index 0399cfaf3..8f670a9ce 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spositerestrictedappaccesscontrol.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spositerestrictedappaccesscontrol.md @@ -6,7 +6,7 @@ applicable: SharePoint Online title: Get-SPOSiteRestrictedAppAccessControl schema: 2.0.0 ms.author: neilh -ms.reviewer: [ Add reviewer alias ] +ms.reviewer: neilh description: Learn how to use Get-SPOSiteRestrictedAppAccessControl to read a SharePoint site's App Restrictions policy and check enforcement status with PowerShell. ms.date: 10/09/2026 ms.topic: concept-article From fcba143daee38094fb1202d7ad900916fb41fc80 Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 14:29:04 -0500 Subject: [PATCH 08/43] Change reviewer alias in set-spositerestrictedappaccesscontrolmode.md Updated the reviewer alias to 'neilh' for consistency. --- .../set-spositerestrictedappaccesscontrolmode.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrolmode.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrolmode.md index 7efa80ec9..b3f4a8460 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrolmode.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrolmode.md @@ -6,7 +6,7 @@ applicable: SharePoint Online title: Set-SPOSiteRestrictedAppAccessControlMode schema: 2.0.0 ms.author: neilh -ms.reviewer: [ Add reviewer alias ] +ms.reviewer: neilh description: Set-SPOSiteRestrictedAppAccessControlMode switches a site between Allow and Deny modes while preserving both app lists. Learn the syntax and examples. ms.date: 10/09/2026 ms.topic: concept-article From 2ab04db7c59a3fb31bd9a996458b356c60650410 Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 14:29:20 -0500 Subject: [PATCH 09/43] Change reviewer alias to 'neilh' in documentation Updated the reviewer alias for the Set-SPOTenantRestrictedAppAccessControlList documentation. --- .../set-spotenantrestrictedappaccesscontrollist.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spotenantrestrictedappaccesscontrollist.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spotenantrestrictedappaccesscontrollist.md index 840529c78..2c2d63a2d 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spotenantrestrictedappaccesscontrollist.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spotenantrestrictedappaccesscontrollist.md @@ -6,7 +6,7 @@ applicable: SharePoint Online title: Set-SPOTenantRestrictedAppAccessControlList schema: 2.0.0 ms.author: neilh -ms.reviewer: [ Add reviewer alias ] +ms.reviewer: neilh description: Set-SPOTenantRestrictedAppAccessControlList lets you add or remove app IDs from the tenant deny list in one atomic update. Learn syntax and examples. ms.date: 10/09/2026 ms.topic: concept-article From 2884c8bd41e373de176d381edd1aed4cd43feed4 Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 14:37:24 -0500 Subject: [PATCH 10/43] Fix TOC entries for SharePoint PowerShell commands --- sharepoint/TOC.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/sharepoint/TOC.yml b/sharepoint/TOC.yml index 6ddf8b5bc..c02991ea8 100644 --- a/sharepoint/TOC.yml +++ b/sharepoint/TOC.yml @@ -26,5 +26,3 @@ href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrollist.md - name: Set-SPOTenantRestrictedAppAccessControlList href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spotenantrestrictedappaccesscontrollist.md -- name: Set-SPOSiteRestrictedAppAccessControlList - href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrollist.md From ce4acd8699450262f9290bb622d99f7d963e49b5 Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 14:56:56 -0500 Subject: [PATCH 11/43] Fix syntax formatting in documentation Updated the syntax section for Clear-SPOSiteRestrictedAppAccessControlList command. --- .../clear-spositerestrictedappaccesscontrollist.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md index 7fcc093a0..623036e85 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md @@ -20,7 +20,7 @@ Removes every entry from one app restrictions list on a site, preserving the oth ## SYNTAX -```powershell +``` Clear-SPOSiteRestrictedAppAccessControlList -Identity -ListType [-WhatIf] [-Confirm] [] ``` From 4de71c6e390879f462c9537c42d72b9fbe77615f Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 14:57:32 -0500 Subject: [PATCH 12/43] Fix syntax formatting in documentation Updated the syntax section for the Clear-SPOSiteRestrictedAppAccessControlPolicy cmdlet. --- .../clear-spositerestrictedappaccesscontrolpolicy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrolpolicy.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrolpolicy.md index 9e1af3d7d..42845a073 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrolpolicy.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrolpolicy.md @@ -20,7 +20,7 @@ Removes the complete app restrictions policy from a site. The cmdlet disables en ## SYNTAX -```powershell +``` Clear-SPOSiteRestrictedAppAccessControlPolicy -Identity [-WhatIf] [-Confirm] [] ``` From b537a8c5f8b17371a248a537d011db4ea4c8378c Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 14:59:23 -0500 Subject: [PATCH 13/43] Fix syntax formatting in documentation Updated syntax formatting for Clear-SPOTenantRestrictedAppAccessControlPolicy command. --- .../clear-spotenantrestrictedappaccesscontrolpolicy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spotenantrestrictedappaccesscontrolpolicy.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spotenantrestrictedappaccesscontrolpolicy.md index 69941a630..d88ccda53 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spotenantrestrictedappaccesscontrolpolicy.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spotenantrestrictedappaccesscontrolpolicy.md @@ -20,7 +20,7 @@ Turns off the tenant App Restrictions enforcement switch and clears the tenant-w ## SYNTAX -```powershell +``` Clear-SPOTenantRestrictedAppAccessControlPolicy [-WhatIf] [-Confirm] [] ``` From 41f4fe2a0e2c65be8723eb6535102a3f869f5b1e Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 14:59:48 -0500 Subject: [PATCH 14/43] Fix syntax block in disable-spositerestrictedappaccesscontrol.md Updated syntax formatting for Disable-SPOSiteRestrictedAppAccessControl command. --- .../disable-spositerestrictedappaccesscontrol.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spositerestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spositerestrictedappaccesscontrol.md index adf7c7291..da2336f0d 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spositerestrictedappaccesscontrol.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spositerestrictedappaccesscontrol.md @@ -20,7 +20,7 @@ Turns off App Restrictions enforcement for a site while preserving the site's ac ## SYNTAX -```powershell +``` Disable-SPOSiteRestrictedAppAccessControl -Identity [-WhatIf] [-Confirm] [] ``` From 4872dff3ff3c0d59f7d6c6c90032404ea1b25f4b Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 15:00:13 -0500 Subject: [PATCH 15/43] Fix syntax formatting in disable-spotenantrestrictedappaccesscontrol.md Updated syntax formatting for Disable-SPOTenantRestrictedAppAccessControl command. --- .../disable-spotenantrestrictedappaccesscontrol.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spotenantrestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spotenantrestrictedappaccesscontrol.md index 374bd23ac..f3a12344d 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spotenantrestrictedappaccesscontrol.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spotenantrestrictedappaccesscontrol.md @@ -20,7 +20,7 @@ Turns off the tenant App Restrictions enforcement switch, while preserving the t ## SYNTAX -```powershell +``` Disable-SPOTenantRestrictedAppAccessControl [-WhatIf] [-Confirm] [] ``` From 07a4ffc16304dd7d013151686c2f29f8e42decfa Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 15:00:56 -0500 Subject: [PATCH 16/43] Fix syntax formatting in documentation Updated syntax formatting for Set-SPOSiteRestrictedAppAccessControlList command. --- .../sharepoint-ps/set-spositerestrictedappaccesscontrollist.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sharepoint/sharepoint-ps/set-spositerestrictedappaccesscontrollist.md b/sharepoint/sharepoint-ps/set-spositerestrictedappaccesscontrollist.md index fb0add914..07b96f8d4 100644 --- a/sharepoint/sharepoint-ps/set-spositerestrictedappaccesscontrollist.md +++ b/sharepoint/sharepoint-ps/set-spositerestrictedappaccesscontrollist.md @@ -20,7 +20,7 @@ Adds application IDs to, or removes application IDs from, the allow list or the ## SYNTAX -```powershell +``` Set-SPOSiteRestrictedAppAccessControlList [-Identity] -ListType [-AddRestrictedAppIds ] [-RemoveRestrictedAppIds ] [-WhatIf] [-Confirm] [] From c4abbbaf73f6704be71a63c653f8134f9141aa80 Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 15:29:32 -0500 Subject: [PATCH 17/43] Fix formatting and enhance examples in documentation Updated examples in the clear-spositerestrictedappaccesscontrollist.md documentation to correct formatting and improve clarity. --- .../clear-spositerestrictedappaccesscontrollist.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md index 623036e85..b5334df17 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md @@ -54,7 +54,7 @@ For permissions and the most current information about Windows PowerShell for Sh ### Example 1 -```powershell +``` Clear-SPOSiteRestrictedAppAccessControlList -Identity "https://contoso.sharepoint.com/sites/Finance" -ListType DenyList ``` @@ -62,7 +62,7 @@ This example clears the deny list on the Finance site. The allow list, the activ ### Example 2 -```powershell +``` Clear-SPOSiteRestrictedAppAccessControlList -Identity "e1b2c3d4-5678-4abc-9def-0123456789ab" -ListType AllowList -WhatIf ``` @@ -70,7 +70,7 @@ This example identifies the site by site ID and previews clearing the allow list ### Example 3 -```powershell +``` $url = "https://contoso.sharepoint.com/sites/Finance" Clear-SPOSiteRestrictedAppAccessControlList -Identity $url -ListType AllowList Set-SPOSiteRestrictedAppAccessControlList -Identity $url -ListType AllowList -AddRestrictedAppIds "11111111-1111-1111-1111-111111111111" @@ -80,7 +80,7 @@ This example rebuilds an allow list from scratch. Because list changes are confi ### Example 4 -```powershell +``` Clear-SPOSiteRestrictedAppAccessControlList -Identity "https://contoso.sharepoint.com/sites/Finance" -ListType DenyList -Confirm:$false ``` From 85abf5e18b493866cbbd3b9bf371139adb3a595e Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 16:53:47 -0500 Subject: [PATCH 18/43] Update 12 files in OfficeDocs-Sharepoint-PowerShell --- .../clear-spositerestrictedappaccesscontrollist.md | 2 +- .../clear-spositerestrictedappaccesscontrolpolicy.md | 6 +++--- .../clear-spotenantrestrictedappaccesscontrolpolicy.md | 4 ++-- .../disable-spositerestrictedappaccesscontrol.md | 6 +++--- .../disable-spotenantrestrictedappaccesscontrol.md | 6 +++--- .../enable-spositerestrictedappaccesscontrol.md | 10 +++++----- .../enable-spotenantrestrictedappaccesscontrol.md | 10 +++++----- .../get-spositerestrictedappaccesscontrol.md | 10 +++++----- .../get-spotenantrestrictedappaccesscontrol.md | 10 +++++----- .../set-spositerestrictedappaccesscontrolmode.md | 10 +++++----- .../set-spotenantrestrictedappaccesscontrollist.md | 10 +++++----- .../set-spositerestrictedappaccesscontrollist.md | 8 ++++---- 12 files changed, 46 insertions(+), 46 deletions(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md index b5334df17..48f023d24 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md @@ -58,7 +58,7 @@ For permissions and the most current information about Windows PowerShell for Sh Clear-SPOSiteRestrictedAppAccessControlList -Identity "https://contoso.sharepoint.com/sites/Finance" -ListType DenyList ``` -This example clears the deny list on the Finance site. The allow list, the active mode, and site enablement are preserved. If `Deny` is the active mode, the cmdlet warns that clearing the active deny list means all governed third-party applications can access the site. +This example clears the deny list on the Finance site. It preserves the allow list, the active mode, and site enablement. If `Deny` is the active mode, the cmdlet warns that clearing the active deny list means all governed third-party applications can access the site. ### Example 2 diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrolpolicy.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrolpolicy.md index 42845a073..95681abfb 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrolpolicy.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrolpolicy.md @@ -46,7 +46,7 @@ For permissions and the most current information about Windows PowerShell for Sh ### Example 1 -```powershell +``` Clear-SPOSiteRestrictedAppAccessControlPolicy -Identity "https://contoso.sharepoint.com/sites/Finance" ``` @@ -54,7 +54,7 @@ This example removes the complete App Restrictions policy from the Finance site. ### Example 2 -```powershell +``` Clear-SPOSiteRestrictedAppAccessControlPolicy -Identity "e1b2c3d4-5678-4abc-9def-0123456789ab" -WhatIf ``` @@ -62,7 +62,7 @@ This example identifies the site by site ID and previews the change without modi ### Example 3 -```powershell +``` $url = "https://contoso.sharepoint.com/sites/Finance" Clear-SPOSiteRestrictedAppAccessControlPolicy -Identity $url -Confirm:$false Set-SPOSiteRestrictedAppAccessControlMode -Identity $url -Mode Deny diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spotenantrestrictedappaccesscontrolpolicy.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spotenantrestrictedappaccesscontrolpolicy.md index d88ccda53..228e0a544 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spotenantrestrictedappaccesscontrolpolicy.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spotenantrestrictedappaccesscontrolpolicy.md @@ -48,7 +48,7 @@ For permissions and the most current information about Windows PowerShell for Sh ### Example 1 -```powershell +``` Clear-SPOTenantRestrictedAppAccessControlPolicy ``` @@ -56,7 +56,7 @@ This example turns off the tenant enforcement switch and clears the tenant deny ### Example 2 -```powershell +``` Clear-SPOTenantRestrictedAppAccessControlPolicy -WhatIf ``` diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spositerestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spositerestrictedappaccesscontrol.md index da2336f0d..f3e746f0c 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spositerestrictedappaccesscontrol.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spositerestrictedappaccesscontrol.md @@ -46,7 +46,7 @@ For permissions and the most current information about Windows PowerShell for Sh ### Example 1 -```powershell +``` Disable-SPOSiteRestrictedAppAccessControl -Identity "https://contoso.sharepoint.com/sites/Finance" ``` @@ -54,7 +54,7 @@ This example turns off App Restrictions enforcement for the Finance site. The si ### Example 2 -```powershell +``` Disable-SPOSiteRestrictedAppAccessControl -Identity "e1b2c3d4-5678-4abc-9def-0123456789ab" -WhatIf ``` @@ -62,7 +62,7 @@ This example uses a site ID and shows what would happen without changing the pol ### Example 3 -```powershell +``` $url = "https://contoso.sharepoint.com/sites/Finance" Disable-SPOSiteRestrictedAppAccessControl -Identity $url -Confirm:$false Get-SPOSiteRestrictedAppAccessControl -Identity $url diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spotenantrestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spotenantrestrictedappaccesscontrol.md index f3a12344d..696953cbf 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spotenantrestrictedappaccesscontrol.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spotenantrestrictedappaccesscontrol.md @@ -48,7 +48,7 @@ For permissions and the most current information about Windows PowerShell for Sh ### Example 1 -```powershell +``` Disable-SPOTenantRestrictedAppAccessControl ``` @@ -56,7 +56,7 @@ This example turns off the tenant enforcement switch and preserves the tenant de ### Example 2 -```powershell +``` Disable-SPOTenantRestrictedAppAccessControl -WhatIf ``` @@ -64,7 +64,7 @@ This example shows what would happen if the tenant switch were turned off, witho ### Example 3 -```powershell +``` Disable-SPOTenantRestrictedAppAccessControl -Confirm:$false Get-SPOTenantRestrictedAppAccessControl ``` diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spositerestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spositerestrictedappaccesscontrol.md index be7d77603..5d6db1a22 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spositerestrictedappaccesscontrol.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spositerestrictedappaccesscontrol.md @@ -20,7 +20,7 @@ Turns on App Restrictions enforcement for a site, using the mode and lists that ## SYNTAX -```powershell +``` Enable-SPOSiteRestrictedAppAccessControl -Identity [-WhatIf] [-Confirm] [] ``` @@ -52,7 +52,7 @@ For permissions and the most current information about Windows PowerShell for Sh ### Example 1 -```powershell +``` Enable-SPOSiteRestrictedAppAccessControl -Identity "https://contoso.sharepoint.com/sites/Finance" ``` @@ -60,7 +60,7 @@ This example turns on App Restrictions enforcement for the Finance site by using ### Example 2 -```powershell +``` Enable-SPOSiteRestrictedAppAccessControl -Identity "e1b2c3d4-5678-4abc-9def-0123456789ab" ``` @@ -68,7 +68,7 @@ This example turns on enforcement for the same site by using its site ID. Every ### Example 3 -```powershell +``` $url = "https://contoso.sharepoint.com/sites/Finance" Set-SPOSiteRestrictedAppAccessControlMode -Identity $url -Mode Allow Set-SPOSiteRestrictedAppAccessControlList -Identity $url -ListType AllowList -AddRestrictedAppIds "11111111-1111-1111-1111-111111111111" @@ -79,7 +79,7 @@ This example stages a policy and then enables it explicitly. The mode and list c ### Example 4 -```powershell +``` Enable-SPOSiteRestrictedAppAccessControl -Identity "https://contoso.sharepoint.com/sites/Finance" -Confirm:$false ``` diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spotenantrestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spotenantrestrictedappaccesscontrol.md index 44360743e..5c43db281 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spotenantrestrictedappaccesscontrol.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spotenantrestrictedappaccesscontrol.md @@ -20,7 +20,7 @@ Turns on the tenant App Restrictions enforcement switch for your organization. ## SYNTAX -```powershell +``` Enable-SPOTenantRestrictedAppAccessControl [-WhatIf] [-Confirm] [] ``` @@ -48,7 +48,7 @@ For permissions and the most current information about Windows PowerShell for Sh ### Example 1 -```powershell +``` Enable-SPOTenantRestrictedAppAccessControl ``` @@ -56,7 +56,7 @@ This example turns on the tenant enforcement switch. The cmdlet warns that enfor ### Example 2 -```powershell +``` Get-SPOTenantRestrictedAppAccessControl Enable-SPOTenantRestrictedAppAccessControl ``` @@ -65,7 +65,7 @@ This example reviews the stored tenant policy first, so you can see which applic ### Example 3 -```powershell +``` Enable-SPOTenantRestrictedAppAccessControl -WhatIf ``` @@ -73,7 +73,7 @@ This example shows what would happen if the tenant switch were turned on, withou ### Example 4 -```powershell +``` Enable-SPOTenantRestrictedAppAccessControl -Confirm:$false ``` diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spositerestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spositerestrictedappaccesscontrol.md index 8f670a9ce..0c9db65f5 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spositerestrictedappaccesscontrol.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spositerestrictedappaccesscontrol.md @@ -20,7 +20,7 @@ Returns the complete site-level App Restrictions policy for a site, including en ## SYNTAX -```powershell +``` Get-SPOSiteRestrictedAppAccessControl [-Identity] [] ``` @@ -56,7 +56,7 @@ For permissions and the most current information about Windows PowerShell for Sh ### Example 1 -```powershell +``` Get-SPOSiteRestrictedAppAccessControl -Identity https://contoso.sharepoint.com/sites/Finance ``` @@ -64,7 +64,7 @@ This example returns the complete Restricted App Access Control policy for the F ### Example 2 -```powershell +``` Get-SPOSiteRestrictedAppAccessControl -Identity 8a1e30f6-2f52-4b9e-9d1b-2e9f6c1d40aa ``` @@ -72,7 +72,7 @@ This example returns the same policy for a site bound by site ID. The returned o ### Example 3 -```powershell +``` $policy = Get-SPOSiteRestrictedAppAccessControl -Identity https://contoso.sharepoint.com/sites/Finance if ($policy.Mode -eq "Allow") { $policy.AllowList @@ -85,7 +85,7 @@ This example returns only the list that the active mode enforces. The other list ### Example 4 -```powershell +``` $policy = Get-SPOSiteRestrictedAppAccessControl -Identity https://contoso.sharepoint.com/sites/Finance if ($policy.Enabled -and $policy.Mode -eq "Allow" -and $policy.AllowList.Count -eq 0) { Write-Host "Enforcement is on with an empty active allow list, which blocks all governed third-party and agentic apps." diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spotenantrestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spotenantrestrictedappaccesscontrol.md index 6d2294bf4..e0b9c4e94 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spotenantrestrictedappaccesscontrol.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spotenantrestrictedappaccesscontrol.md @@ -20,7 +20,7 @@ Returns the tenant-level App Restrictions policy, including the tenant enforceme ## SYNTAX -```powershell +``` Get-SPOTenantRestrictedAppAccessControl [] ``` @@ -51,7 +51,7 @@ For permissions and the most current information about Windows PowerShell for Sh ### Example 1 -```powershell +``` Get-SPOTenantRestrictedAppAccessControl ``` @@ -59,7 +59,7 @@ This example returns the complete tenant Restricted App Access Control policy, s ### Example 2 -```powershell +``` (Get-SPOTenantRestrictedAppAccessControl).RestrictedAppIds ``` @@ -67,7 +67,7 @@ This example returns only the restricted application IDs from the tenant deny li ### Example 3 -```powershell +``` $policy = Get-SPOTenantRestrictedAppAccessControl if (-not $policy.Enabled) { Write-Host "App Restrictions enforcement is off. Site policies aren't enforced." @@ -78,7 +78,7 @@ This example stores the tenant policy in a variable and checks the master switch ### Example 4 -```powershell +``` $policy = Get-SPOTenantRestrictedAppAccessControl if ($policy.Enabled -and $policy.RestrictedAppIds.Count -eq 0) { Write-Host "Enforcement is on, but the tenant deny list is empty and denies nothing." diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrolmode.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrolmode.md index b3f4a8460..37887386f 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrolmode.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrolmode.md @@ -20,7 +20,7 @@ Sets the active mode of the site-level App Restrictions policy to `Allow` or `De ## SYNTAX -```powershell +``` Set-SPOSiteRestrictedAppAccessControlMode [-Identity] -Mode [-WhatIf] [-Confirm] [] ``` @@ -56,7 +56,7 @@ For permissions and the most current information about Windows PowerShell for Sh ### Example 1 -```powershell +``` Set-SPOSiteRestrictedAppAccessControlMode -Identity https://contoso.sharepoint.com/sites/Finance -Mode Allow ``` @@ -64,7 +64,7 @@ This example sets the active mode of the Finance site to `Allow`, so only applic ### Example 2 -```powershell +``` Set-SPOSiteRestrictedAppAccessControlMode -Identity https://contoso.sharepoint.com/sites/Finance -Mode Deny -WhatIf ``` @@ -72,7 +72,7 @@ This example displays the impact of switching the Finance site to `Deny`, includ ### Example 3 -```powershell +``` Set-SPOSiteRestrictedAppAccessControlMode -Identity 8a1e30f6-2f52-4b9e-9d1b-2e9f6c1d40aa -Mode Deny -Confirm:$false ``` @@ -80,7 +80,7 @@ This example switches a site bound by site ID to `Deny` without prompting, for u ### Example 4 -```powershell +``` Set-SPOSiteRestrictedAppAccessControlMode -Identity https://contoso.sharepoint.com/sites/Finance -Mode Allow Enable-SPOSiteRestrictedAppAccessControl -Identity https://contoso.sharepoint.com/sites/Finance ``` diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spotenantrestrictedappaccesscontrollist.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spotenantrestrictedappaccesscontrollist.md index 2c2d63a2d..a58fd9e80 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spotenantrestrictedappaccesscontrollist.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spotenantrestrictedappaccesscontrollist.md @@ -20,7 +20,7 @@ Adds application IDs to and removes application IDs from the tenant-wide App Res ## SYNTAX -```powershell +``` Set-SPOTenantRestrictedAppAccessControlList [-AddRestrictedAppIds ] [-RemoveRestrictedAppIds ] [-WhatIf] [-Confirm] [] ``` @@ -55,7 +55,7 @@ For permissions and the most current information about Windows PowerShell for Sh ### Example 1 -```powershell +``` Set-SPOTenantRestrictedAppAccessControlList -AddRestrictedAppIds 11111111-1111-1111-1111-111111111111 ``` @@ -63,7 +63,7 @@ This example adds one application ID to the tenant deny list. The backend classi ### Example 2 -```powershell +``` Set-SPOTenantRestrictedAppAccessControlList -AddRestrictedAppIds 11111111-1111-1111-1111-111111111111, 22222222-2222-2222-2222-222222222222 -RemoveRestrictedAppIds 33333333-3333-3333-3333-333333333333 ``` @@ -71,7 +71,7 @@ This example adds two application IDs and removes a third in a single atomic upd ### Example 3 -```powershell +``` Set-SPOTenantRestrictedAppAccessControlList -RemoveRestrictedAppIds 33333333-3333-3333-3333-333333333333 -Confirm:$false ``` @@ -79,7 +79,7 @@ This example removes an application ID without prompting for confirmation, which ### Example 4 -```powershell +``` Set-SPOTenantRestrictedAppAccessControlList -AddRestrictedAppIds 44444444-4444-4444-4444-444444444444 -WhatIf ``` diff --git a/sharepoint/sharepoint-ps/set-spositerestrictedappaccesscontrollist.md b/sharepoint/sharepoint-ps/set-spositerestrictedappaccesscontrollist.md index 07b96f8d4..a934003a0 100644 --- a/sharepoint/sharepoint-ps/set-spositerestrictedappaccesscontrollist.md +++ b/sharepoint/sharepoint-ps/set-spositerestrictedappaccesscontrollist.md @@ -60,7 +60,7 @@ For permissions and the most current information about Windows PowerShell for Sh ### Example 1 -```powershell +``` Set-SPOSiteRestrictedAppAccessControlList -Identity https://contoso.sharepoint.com/sites/Finance -ListType AllowList -AddRestrictedAppIds 11111111-1111-1111-1111-111111111111 ``` @@ -68,7 +68,7 @@ This example adds one application ID to the allow list of the Finance site. The ### Example 2 -```powershell +``` Set-SPOSiteRestrictedAppAccessControlList -Identity https://contoso.sharepoint.com/sites/Finance -ListType DenyList -AddRestrictedAppIds 22222222-2222-2222-2222-222222222222,33333333-3333-3333-3333-333333333333 -RemoveRestrictedAppIds 44444444-4444-4444-4444-444444444444 ``` @@ -76,7 +76,7 @@ This example adds two IDs to the deny list and removes one ID from the deny list ### Example 3 -```powershell +``` Set-SPOSiteRestrictedAppAccessControlList -Identity 8a1e30f6-2f52-4b9e-9d1b-2e9f6c1d40aa -ListType AllowList -RemoveRestrictedAppIds 55555555-5555-5555-5555-555555555555 -Confirm:$false ``` @@ -84,7 +84,7 @@ This example removes a stale application ID from the allow list of a site bound ### Example 4 -```powershell +``` Set-SPOSiteRestrictedAppAccessControlList -Identity https://contoso.sharepoint.com/sites/Finance -ListType DenyList -AddRestrictedAppIds 66666666-6666-6666-6666-666666666666 -WhatIf ``` From 56d3bd212710166f606622e1f69af6103172be0b Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 17:15:45 -0500 Subject: [PATCH 19/43] Update 5 files in OfficeDocs-Sharepoint-PowerShell --- .../clear-spotenantrestrictedappaccesscontrolpolicy.md | 2 +- .../disable-spotenantrestrictedappaccesscontrol.md | 2 +- .../enable-spotenantrestrictedappaccesscontrol.md | 2 +- .../get-spotenantrestrictedappaccesscontrol.md | 2 +- .../sharepoint-ps/set-spositerestrictedappaccesscontrollist.md | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spotenantrestrictedappaccesscontrolpolicy.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spotenantrestrictedappaccesscontrolpolicy.md index 228e0a544..de062a4f6 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spotenantrestrictedappaccesscontrolpolicy.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spotenantrestrictedappaccesscontrolpolicy.md @@ -6,7 +6,7 @@ applicable: SharePoint Online title: Clear-SPOTenantRestrictedAppAccessControlPolicy schema: 2.0.0 ms.author: neilh -ms.reviewer: [ Add reviewer alias ] +ms.reviewer: neilh description: Clear-SPOTenantRestrictedAppAccessControlPolicy disables tenant App Restrictions enforcement and clears the deny list. Learn syntax, parameters, and examples. ms.date: 10/09/2026 ms.topic: concept-article diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spotenantrestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spotenantrestrictedappaccesscontrol.md index 696953cbf..570ee9d3a 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spotenantrestrictedappaccesscontrol.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spotenantrestrictedappaccesscontrol.md @@ -6,7 +6,7 @@ applicable: SharePoint Online title: Disable-SPOTenantRestrictedAppAccessControl schema: 2.0.0 ms.author: neilh -ms.reviewer: [ Add reviewer alias ] +ms.reviewer: neilh description: Disable-SPOTenantRestrictedAppAccessControl turns off tenant-wide App Restrictions enforcement while keeping your deny list intact. Learn the syntax and examples. ms.date: 10/09/2026 ms.topic: concept-article diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spotenantrestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spotenantrestrictedappaccesscontrol.md index 5c43db281..43366404f 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spotenantrestrictedappaccesscontrol.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spotenantrestrictedappaccesscontrol.md @@ -6,7 +6,7 @@ applicable: SharePoint Online title: Enable-SPOTenantRestrictedAppAccessControl schema: 2.0.0 ms.author: neilh -ms.reviewer: [ Add reviewer alias ] +ms.reviewer: neilh description: Learn how to use Enable-SPOTenantRestrictedAppAccessControl to activate the master enforcement switch for App Restrictions across your SharePoint Online tenant. ms.date: 10/09/2026 ms.topic: concept-article diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spotenantrestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spotenantrestrictedappaccesscontrol.md index e0b9c4e94..244daa8dd 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spotenantrestrictedappaccesscontrol.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spotenantrestrictedappaccesscontrol.md @@ -6,7 +6,7 @@ applicable: SharePoint Online title: Get-SPOTenantRestrictedAppAccessControl schema: 2.0.0 ms.author: neilh -ms.reviewer: [ Add reviewer alias ] +ms.reviewer: neilh description: Get-SPOTenantRestrictedAppAccessControl retrieves your tenant's App Restrictionsolicy, including enforcement status and the deny list. Learn how. ms.date: 10/09/2026 ms.topic: concept-article diff --git a/sharepoint/sharepoint-ps/set-spositerestrictedappaccesscontrollist.md b/sharepoint/sharepoint-ps/set-spositerestrictedappaccesscontrollist.md index a934003a0..93b343eb2 100644 --- a/sharepoint/sharepoint-ps/set-spositerestrictedappaccesscontrollist.md +++ b/sharepoint/sharepoint-ps/set-spositerestrictedappaccesscontrollist.md @@ -6,7 +6,7 @@ applicable: SharePoint Online title: Set-SPOSiteRestrictedAppAccessControlList schema: 2.0.0 ms.author: neilh -ms.reviewer: [ Add reviewer alias ] +ms.reviewer: neilh description: Learn how to use Set-SPOSiteRestrictedAppAccessControlList to manage site-level allow and deny lists for App Restrictions in SharePoint Online. ms.date: 10/09/2026 ms.topic: concept-article From 2e0b90e8996b2d87ca5ac847e1e078a82064399b Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 17:23:25 -0500 Subject: [PATCH 20/43] Update clear-spositerestrictedappaccesscontrollist.md --- .../clear-spositerestrictedappaccesscontrollist.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md index 48f023d24..740abc1a9 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md @@ -95,7 +95,7 @@ Specifies the site to change. Provide either the site URL or the site ID. ```yaml Type: String Parameter Sets: (All) -Aliases: +Aliases: [] Applicable: SharePoint Online Required: True Position: Named @@ -114,7 +114,7 @@ Specifies which list to clear. Entry mutations must explicitly identify the targ ```yaml Type: String Parameter Sets: (All) -Aliases: +Aliases: [] Accepted values: AllowList, DenyList Applicable: SharePoint Online Required: True From 445a3ece429ace27dfdeab8f244b7134a9211000 Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 17:34:33 -0500 Subject: [PATCH 21/43] Update 11 files in OfficeDocs-Sharepoint-PowerShell --- ...trollist.md => Clear-SPOSiteRestrictedAppAccessControLlist.md} | 0 ...policy.md => Clear-SPOSiteRestrictedAppAccessControlPolicy.md} | 0 ...licy.md => Clear-SPOTenantRestrictedAppAccessControlPolicy.md} | 0 ...esscontrol.md => Disable-SPOSiteRestrictedAppAccessControl.md} | 0 ...scontrol.md => Disable-SPOTenantRestrictedAppAccessControl.md} | 0 ...sscontrol.md => Enable-SPOTenantRestrictedAppAccessControl.md} | 0 ...ccesscontrol.md => EnableSPOSiteRestrictedAppAccessControl.md} | 0 ...ccesscontrol.md => Get-SPOTenantRestrictedAppAccessControl.md} | 0 .../Set-SPOSiteRestrictedAppAccessControlList.md} | 0 ...ontrolmode.md => Set-SPOSiteRestrictedAppAccessControlMode.md} | 0 10 files changed, 0 insertions(+), 0 deletions(-) rename sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/{clear-spositerestrictedappaccesscontrollist.md => Clear-SPOSiteRestrictedAppAccessControLlist.md} (100%) rename sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/{clear-spositerestrictedappaccesscontrolpolicy.md => Clear-SPOSiteRestrictedAppAccessControlPolicy.md} (100%) rename sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/{clear-spotenantrestrictedappaccesscontrolpolicy.md => Clear-SPOTenantRestrictedAppAccessControlPolicy.md} (100%) rename sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/{disable-spositerestrictedappaccesscontrol.md => Disable-SPOSiteRestrictedAppAccessControl.md} (100%) rename sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/{disable-spotenantrestrictedappaccesscontrol.md => Disable-SPOTenantRestrictedAppAccessControl.md} (100%) rename sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/{enable-spotenantrestrictedappaccesscontrol.md => Enable-SPOTenantRestrictedAppAccessControl.md} (100%) rename sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/{enable-spositerestrictedappaccesscontrol.md => EnableSPOSiteRestrictedAppAccessControl.md} (100%) rename sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/{get-spotenantrestrictedappaccesscontrol.md => Get-SPOTenantRestrictedAppAccessControl.md} (100%) rename sharepoint/sharepoint-ps/{set-spositerestrictedappaccesscontrollist.md => Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlList.md} (100%) rename sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/{set-spositerestrictedappaccesscontrolmode.md => Set-SPOSiteRestrictedAppAccessControlMode.md} (100%) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControLlist.md similarity index 100% rename from sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrollist.md rename to sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControLlist.md diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrolpolicy.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlPolicy.md similarity index 100% rename from sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spositerestrictedappaccesscontrolpolicy.md rename to sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlPolicy.md diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spotenantrestrictedappaccesscontrolpolicy.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOTenantRestrictedAppAccessControlPolicy.md similarity index 100% rename from sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/clear-spotenantrestrictedappaccesscontrolpolicy.md rename to sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOTenantRestrictedAppAccessControlPolicy.md diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spositerestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOSiteRestrictedAppAccessControl.md similarity index 100% rename from sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spositerestrictedappaccesscontrol.md rename to sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOSiteRestrictedAppAccessControl.md diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spotenantrestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOTenantRestrictedAppAccessControl.md similarity index 100% rename from sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/disable-spotenantrestrictedappaccesscontrol.md rename to sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOTenantRestrictedAppAccessControl.md diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spotenantrestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOTenantRestrictedAppAccessControl.md similarity index 100% rename from sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spotenantrestrictedappaccesscontrol.md rename to sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOTenantRestrictedAppAccessControl.md diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spositerestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/EnableSPOSiteRestrictedAppAccessControl.md similarity index 100% rename from sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/enable-spositerestrictedappaccesscontrol.md rename to sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/EnableSPOSiteRestrictedAppAccessControl.md diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spotenantrestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOTenantRestrictedAppAccessControl.md similarity index 100% rename from sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spotenantrestrictedappaccesscontrol.md rename to sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOTenantRestrictedAppAccessControl.md diff --git a/sharepoint/sharepoint-ps/set-spositerestrictedappaccesscontrollist.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlList.md similarity index 100% rename from sharepoint/sharepoint-ps/set-spositerestrictedappaccesscontrollist.md rename to sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlList.md diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrolmode.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlMode.md similarity index 100% rename from sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrolmode.md rename to sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlMode.md From 5520da8285be2bea6c5ef6b3ac654f8353f7847c Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 17:39:02 -0500 Subject: [PATCH 22/43] Update 2 files in OfficeDocs-Sharepoint-PowerShell --- ...paccesscontrol.md => Get-SPOSiteRestrictedAppAccessControl.md} | 0 ...trollist.md => Set-SPOTenantRestrictedAppAccessControlList.md} | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/{get-spositerestrictedappaccesscontrol.md => Get-SPOSiteRestrictedAppAccessControl.md} (100%) rename sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/{set-spotenantrestrictedappaccesscontrollist.md => Set-SPOTenantRestrictedAppAccessControlList.md} (100%) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spositerestrictedappaccesscontrol.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md similarity index 100% rename from sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/get-spositerestrictedappaccesscontrol.md rename to sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spotenantrestrictedappaccesscontrollist.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOTenantRestrictedAppAccessControlList.md similarity index 100% rename from sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spotenantrestrictedappaccesscontrollist.md rename to sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOTenantRestrictedAppAccessControlList.md From 98bfd3fc05cb009ee2749d45d38cc8b00f5f2189 Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 17:45:42 -0500 Subject: [PATCH 23/43] Update 6 files in OfficeDocs-Sharepoint-PowerShell --- .../Clear-SPOSiteRestrictedAppAccessControlPolicy.md | 2 +- .../Disable-SPOSiteRestrictedAppAccessControl.md | 2 +- .../EnableSPOSiteRestrictedAppAccessControl.md | 2 +- .../Get-SPOSiteRestrictedAppAccessControl.md | 2 +- .../Set-SPOSiteRestrictedAppAccessControlList.md | 4 ++-- .../Set-SPOSiteRestrictedAppAccessControlMode.md | 4 ++-- 6 files changed, 8 insertions(+), 8 deletions(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlPolicy.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlPolicy.md index 95681abfb..4e7c70e2a 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlPolicy.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlPolicy.md @@ -81,7 +81,7 @@ Specifies the site whose policy is cleared. Provide either the site URL or the s ```yaml Type: String Parameter Sets: (All) -Aliases: +Aliases: [] Applicable: SharePoint Online Required: True Position: Named diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOSiteRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOSiteRestrictedAppAccessControl.md index f3e746f0c..ac1c49335 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOSiteRestrictedAppAccessControl.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOSiteRestrictedAppAccessControl.md @@ -79,7 +79,7 @@ Specifies the site to disable. Provide either the site URL or the site ID. ```yaml Type: String Parameter Sets: (All) -Aliases: +Aliases: [] Applicable: SharePoint Online Required: True Position: Named diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/EnableSPOSiteRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/EnableSPOSiteRestrictedAppAccessControl.md index 5d6db1a22..de7ed0233 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/EnableSPOSiteRestrictedAppAccessControl.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/EnableSPOSiteRestrictedAppAccessControl.md @@ -94,7 +94,7 @@ Specifies the site to enable. Provide either the site URL or the site ID. ```yaml Type: String Parameter Sets: (All) -Aliases: +Aliases: [] Applicable: SharePoint Online Required: True Position: Named diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md index 0c9db65f5..b78f15b80 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md @@ -103,7 +103,7 @@ Specifies the site to read. You can specify either the site URL or the site ID. ```yaml Type: String Parameter Sets: (All) -Aliases: +Aliases: [] Applicable: SharePoint Online Required: True Position: 0 diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlList.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlList.md index 93b343eb2..62588e3e0 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlList.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlList.md @@ -99,7 +99,7 @@ Specifies the site to configure. You can specify either the site URL or the site ```yaml Type: String Parameter Sets: (All) -Aliases: +Aliases: [] Applicable: SharePoint Online Required: True Position: 0 @@ -115,7 +115,7 @@ Specifies the list to change. Valid values are `AllowList` and `DenyList`. Entry ```yaml Type: String Parameter Sets: (All) -Aliases: +Aliases: [] Applicable: SharePoint Online Accepted values: AllowList, DenyList Required: True diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlMode.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlMode.md index 37887386f..5ca68fc00 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlMode.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlMode.md @@ -96,7 +96,7 @@ Specifies the site to configure. You can specify either the site URL or the site ```yaml Type: String Parameter Sets: (All) -Aliases: +Aliases: [] Applicable: SharePoint Online Required: True Position: 0 @@ -114,7 +114,7 @@ When the mode is `Allow`, applications in the allow list are allowed and all oth ```yaml Type: String Parameter Sets: (All) -Aliases: +Aliases: [] Applicable: SharePoint Online Accepted values: Allow, Deny Required: True From bf6142e3236198d9d9beb65d8e6de1d4e843a43b Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Fri, 9 Oct 2026 17:59:31 -0500 Subject: [PATCH 24/43] Update EnableSPOSiteRestrictedAppAccessControl.md --- ...cessControl.md => Enable-SPOSiteRestrictedAppAccessControl.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/{EnableSPOSiteRestrictedAppAccessControl.md => Enable-SPOSiteRestrictedAppAccessControl.md} (100%) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/EnableSPOSiteRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOSiteRestrictedAppAccessControl.md similarity index 100% rename from sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/EnableSPOSiteRestrictedAppAccessControl.md rename to sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOSiteRestrictedAppAccessControl.md From 88b8593bfb418420a99fe39b03a7827f1bb35194 Mon Sep 17 00:00:00 2001 From: Gary Moore <5432776+garycentric@users.noreply.github.com> Date: Mon, 12 Oct 2026 07:51:47 -0700 Subject: [PATCH 25/43] Correct capitalization in file name Clear-SPOSiteRestrictedAppAccessControlList.md instead of Clear-SPOSiteRestrictedAppAccessControLlist.md --- ...troLlist.md => Clear-SPOSiteRestrictedAppAccessControlList.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/{Clear-SPOSiteRestrictedAppAccessControLlist.md => Clear-SPOSiteRestrictedAppAccessControlList.md} (100%) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControLlist.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlList.md similarity index 100% rename from sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControLlist.md rename to sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlList.md From 1e8db394b8a63c549de58b48586cec44afb5356c Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Mon, 12 Oct 2026 13:04:03 -0500 Subject: [PATCH 26/43] Update 2 files in OfficeDocs-Sharepoint-PowerShell --- .../Clear-SPOSiteRestrictedAppAccessControlList.md | 9 ++++----- .../Clear-SPOSiteRestrictedAppAccessControlPolicy.md | 4 ++-- 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlList.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlList.md index 740abc1a9..be3f39cd1 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlList.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlList.md @@ -8,7 +8,7 @@ schema: 2.0.0 ms.author: neilh ms.reviewer: neilh description: Clear-SPOSiteRestrictedAppAccessControlList removes all entries from a site's allow or deny list in SharePoint Online. Learn syntax, examples, and parameters. -ms.date: 10/09/2026 +ms.date: 10/12/2026 ms.topic: concept-article --- @@ -21,8 +21,7 @@ Removes every entry from one app restrictions list on a site, preserving the oth ## SYNTAX ``` -Clear-SPOSiteRestrictedAppAccessControlList -Identity -ListType [-WhatIf] [-Confirm] - [] +Clear-SPOSiteRestrictedAppAccessControlList -Identity -ListType [-WhatIf] [-Confirm] [] ``` ## DESCRIPTION @@ -95,7 +94,7 @@ Specifies the site to change. Provide either the site URL or the site ID. ```yaml Type: String Parameter Sets: (All) -Aliases: [] +Aliases: Applicable: SharePoint Online Required: True Position: Named @@ -114,7 +113,7 @@ Specifies which list to clear. Entry mutations must explicitly identify the targ ```yaml Type: String Parameter Sets: (All) -Aliases: [] +Aliases: Accepted values: AllowList, DenyList Applicable: SharePoint Online Required: True diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlPolicy.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlPolicy.md index 4e7c70e2a..fbd6e0249 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlPolicy.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlPolicy.md @@ -8,7 +8,7 @@ schema: 2.0.0 ms.author: neilh ms.reviewer: neilh description: Clear-SPOSiteRestrictedAppAccessControlPolicy removes a site's App Restrictions policy, disabling enforcement and clearing lists. Learn syntax and examples. -ms.date: 10/09/2026 +ms.date: 10/12/2026 ms.topic: concept-article --- @@ -81,7 +81,7 @@ Specifies the site whose policy is cleared. Provide either the site URL or the s ```yaml Type: String Parameter Sets: (All) -Aliases: [] +Aliases: Applicable: SharePoint Online Required: True Position: Named From 8e30ddf31e56b4f78ee10b7dbc28b9fc622e05c4 Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Mon, 12 Oct 2026 13:47:08 -0500 Subject: [PATCH 27/43] Refactor Clear-SPOSiteRestrictedAppAccessControlList documentation Updated parameter types and descriptions for clarity. Changed topic from concept-article to reference. --- ...r-SPOSiteRestrictedAppAccessControlList.md | 45 +++++++++++-------- 1 file changed, 26 insertions(+), 19 deletions(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlList.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlList.md index be3f39cd1..1df24ff33 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlList.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlList.md @@ -9,7 +9,7 @@ ms.author: neilh ms.reviewer: neilh description: Clear-SPOSiteRestrictedAppAccessControlList removes all entries from a site's allow or deny list in SharePoint Online. Learn syntax, examples, and parameters. ms.date: 10/12/2026 -ms.topic: concept-article +ms.topic: reference --- # Clear-SPOSiteRestrictedAppAccessControlList @@ -89,13 +89,15 @@ This example clears the deny list without an interactive confirmation prompt, fo ### -Identity +> Applicable: SharePoint Online + Specifies the site to change. Provide either the site URL or the site ID. ```yaml -Type: String +Type: System.String Parameter Sets: (All) Aliases: -Applicable: SharePoint Online + Required: True Position: Named Default value: None @@ -105,17 +107,19 @@ Accept wildcard characters: False ### -ListType +> Applicable: SharePoint Online + Specifies which list to clear. Entry mutations must explicitly identify the target list. The valid values are: - `AllowList` - `DenyList` ```yaml -Type: String +Type: System.String Parameter Sets: (All) Aliases: Accepted values: AllowList, DenyList -Applicable: SharePoint Online + Required: True Position: Named Default value: None @@ -123,34 +127,38 @@ Accept pipeline input: False Accept wildcard characters: False ``` -### -WhatIf +### -Confirm -Shows what would happen if the cmdlet runs. The cmdlet isn't run. +> Applicable: SharePoint Online + +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. ```yaml -Type: SwitchParameter +Type: System.Management.Automation.SwitchParameter Parameter Sets: (All) -Aliases: wi -Applicable: SharePoint Online +Aliases: cf + Required: False Position: Named -Default value: False +Default value: None Accept pipeline input: False Accept wildcard characters: False ``` -### -Confirm +### -WhatIf -Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. +> Applicable: SharePoint Online + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. ```yaml -Type: SwitchParameter +Type: System.Management.Automation.SwitchParameter Parameter Sets: (All) -Aliases: cf -Applicable: SharePoint Online +Aliases: wi + Required: False Position: Named -Default value: True +Default value: None Accept pipeline input: False Accept wildcard characters: False ``` @@ -178,9 +186,8 @@ This cmdlet doesn't return an object. Use `Get-SPOSiteRestrictedAppAccessControl - The tenant switch gates all site enforcement, so a site policy has no effect while the tenant switch is off. The tenant deny list can't be overridden by a site allow list. - App Restrictions never grants permissions. A request must still pass existing SharePoint authorization. - This cmdlet supports `-WhatIf` and `-Confirm` with `ConfirmImpact.High`. `-Confirm:$false` is allowed for automation and doesn't bypass validation, authorization, auditing, or first-party protection. -- [Add the exact warning and error text emitted by the cmdlet.] -## Related links +## RELATED LINKS [Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) From 0f11afa6ad2dac267a5e93c7546fc00ec988d901 Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Mon, 12 Oct 2026 13:54:41 -0500 Subject: [PATCH 28/43] Refactor Clear-SPOSiteRestrictedAppAccessControlPolicy.md Updated parameter descriptions and types for clarity. Changed ms.topic from 'concept-article' to 'reference'. --- ...SPOSiteRestrictedAppAccessControlPolicy.md | 39 +++++++++++-------- 1 file changed, 22 insertions(+), 17 deletions(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlPolicy.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlPolicy.md index fbd6e0249..ff53fbdcf 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlPolicy.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlPolicy.md @@ -9,7 +9,7 @@ ms.author: neilh ms.reviewer: neilh description: Clear-SPOSiteRestrictedAppAccessControlPolicy removes a site's App Restrictions policy, disabling enforcement and clearing lists. Learn syntax and examples. ms.date: 10/12/2026 -ms.topic: concept-article +ms.topic: reference --- # Clear-SPOSiteRestrictedAppAccessControlPolicy @@ -76,13 +76,15 @@ This example removes an existing policy and then rebuilds it from scratch. Becau ### -Identity +> Applicable: SharePoint Online + Specifies the site whose policy is cleared. Provide either the site URL or the site ID. ```yaml -Type: String +Type: System.String Parameter Sets: (All) Aliases: -Applicable: SharePoint Online + Required: True Position: Named Default value: None @@ -90,34 +92,38 @@ Accept pipeline input: False Accept wildcard characters: False ``` -### -WhatIf +### -Confirm -Shows what would happen if the cmdlet runs. The cmdlet isn't run. +> Applicable: SharePoint Online + +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. ```yaml -Type: SwitchParameter +Type: System.Management.Automation.SwitchParameter Parameter Sets: (All) -Aliases: wi -Applicable: SharePoint Online +Aliases: cf + Required: False Position: Named -Default value: False +Default value: None Accept pipeline input: False Accept wildcard characters: False ``` -### -Confirm +### -WhatIf -Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. +> Applicable: SharePoint Online + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. ```yaml -Type: SwitchParameter +Type: System.Management.Automation.SwitchParameter Parameter Sets: (All) -Aliases: cf -Applicable: SharePoint Online +Aliases: wi + Required: False Position: Named -Default value: True +Default value: None Accept pipeline input: False Accept wildcard characters: False ``` @@ -145,9 +151,8 @@ This cmdlet doesn't return an object. Use `Get-SPOSiteRestrictedAppAccessControl - The tenant switch gates all site enforcement, so a site policy has no effect while the tenant switch is off. The tenant deny list can't be overridden by a site allow list. - App Restrictions never grants permissions. A request must still pass existing SharePoint authorization. - This cmdlet supports `-WhatIf` and `-Confirm` with `ConfirmImpact.High`. `-Confirm:$false` is allowed for automation and doesn't bypass validation, authorization, auditing, or first-party protection. -- [Add the exact warning and error text emitted by the cmdlet.] -## Related links +## RELATED LINKS [Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) From 10fbea2dfa34ee6d4e67e1476470db3c31a7e5ec Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Mon, 12 Oct 2026 13:56:03 -0500 Subject: [PATCH 29/43] Revise documentation for Clear-SPOTenantRestrictedAppAccessControlPolicy Updated the documentation for Clear-SPOTenantRestrictedAppAccessControlPolicy, including changes to dates, topics, and example formatting. --- ...OTenantRestrictedAppAccessControlPolicy.md | 38 ++++++++++--------- 1 file changed, 21 insertions(+), 17 deletions(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOTenantRestrictedAppAccessControlPolicy.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOTenantRestrictedAppAccessControlPolicy.md index de062a4f6..a9bedd4f4 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOTenantRestrictedAppAccessControlPolicy.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOTenantRestrictedAppAccessControlPolicy.md @@ -8,8 +8,8 @@ schema: 2.0.0 ms.author: neilh ms.reviewer: neilh description: Clear-SPOTenantRestrictedAppAccessControlPolicy disables tenant App Restrictions enforcement and clears the deny list. Learn syntax, parameters, and examples. -ms.date: 10/09/2026 -ms.topic: concept-article +ms.date: 10/12/2026 +ms.topic: reference --- # Clear-SPOTenantRestrictedAppAccessControlPolicy @@ -40,11 +40,11 @@ Removing IDs doesn't require Microsoft Graph, so stale or deleted applications o Tenant App Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. App Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. -You must be at least a SharePoint Administrator or to run this cmdlet. +You must be at least a SharePoint Administrator to run this cmdlet. For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). -## Examples +## EXAMPLES ### Example 1 @@ -64,7 +64,7 @@ This example shows what would happen if the tenant policy were cleared, without ### Example 3 -```powershell +``` Get-SPOTenantRestrictedAppAccessControl Clear-SPOTenantRestrictedAppAccessControlPolicy -Confirm:$false Get-SPOTenantRestrictedAppAccessControl @@ -72,17 +72,19 @@ Get-SPOTenantRestrictedAppAccessControl This example records the current tenant policy, clears it without prompting for confirmation, and then reads the policy again to confirm that `Enabled` is `False` and that `RestrictedAppIds` is empty. Suppressing the prompt doesn't bypass validation, authorization, or auditing. -## Parameters +## PARAMETERS -### -WhatIf +### -Confirm -Shows what would happen if the cmdlet runs. The cmdlet isn't run. +> Applicable: SharePoint Online + +Prompts you for confirmation before running the cmdlet. This cmdlet has a confirm impact of High, so it prompts by default. Automation can use `-Confirm:$false` to suppress the prompt. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. ```yaml -Type: SwitchParameter +Type: System.Management.Automation.SwitchParameter Parameter Sets: (All) -Aliases: wi -Applicable: SharePoint Online +Aliases: cf + Required: False Position: Named Default value: None @@ -90,15 +92,17 @@ Accept pipeline input: False Accept wildcard characters: False ``` -### -Confirm +### -WhatIf -Prompts you for confirmation before running the cmdlet. This cmdlet has a confirm impact of High, so it prompts by default. Automation can use `-Confirm:$false` to suppress the prompt. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. +> Applicable: SharePoint Online + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. ```yaml -Type: SwitchParameter +Type: System.Management.Automation.SwitchParameter Parameter Sets: (All) -Aliases: cf -Applicable: SharePoint Online +Aliases: wi + Required: False Position: Named Default value: None @@ -128,7 +132,7 @@ This cmdlet doesn't return an output object. Use `Get-SPOTenantRestrictedAppAcce - Clearing doesn't call Microsoft Graph, so stale or deleted application IDs are removed with the rest of the list. - This cmdlet doesn't remove site policy configuration. Use `Clear-SPOSiteRestrictedAppAccessControlPolicy` to clear the policy for an individual site. -## Related links +## RELATED LINKS [Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) From 43c6423bade74821d0ca9f0880a81f637cb4f562 Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Mon, 12 Oct 2026 13:57:37 -0500 Subject: [PATCH 30/43] Update documentation for Disable-SPOSiteRestrictedAppAccessControl Updated the documentation for Disable-SPOSiteRestrictedAppAccessControl, including changes to the date, topic type, and parameter descriptions. --- ...sable-SPOSiteRestrictedAppAccessControl.md | 45 ++++++++++--------- 1 file changed, 25 insertions(+), 20 deletions(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOSiteRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOSiteRestrictedAppAccessControl.md index ac1c49335..6eb0bccba 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOSiteRestrictedAppAccessControl.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOSiteRestrictedAppAccessControl.md @@ -8,8 +8,8 @@ schema: 2.0.0 ms.author: neilh ms.reviewer: neilh description: Learn how to use Disable-SPOSiteRestrictedAppAccessControl in SharePoint Online PowerShell to pause site-level app access enforcement without losing saved settings. -ms.date: 10/09/2026 -ms.topic: concept-article +ms.date: 10/12/2026 +ms.topic: reference --- # Disable-SPOSiteRestrictedAppAccessControl @@ -36,9 +36,9 @@ While the site is disabled, no site-level App Restrictions decision applies to r App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions, so disabling a site policy doesn't grant any application access it doesn't already have. -App Restrictions for Apps administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. App Restrictions is fully decoupled from `SiteProperties`, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated App Restrictions cmdlets listed in [Related Links](#related-links). +Site App Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. App Restrictions is fully decoupled from `SiteProperties`, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated App Restrictions cmdlets listed in [Related Links](#related-links). -You must be at least a SharePoint Administrator or to run this cmdlet. +You must be at least a SharePoint Administrator to run this cmdlet. For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). @@ -74,13 +74,15 @@ This example disables enforcement without an interactive prompt and then reads t ### -Identity +> Applicable: SharePoint Online + Specifies the site to disable. Provide either the site URL or the site ID. ```yaml -Type: String +Type: System.String Parameter Sets: (All) -Aliases: [] -Applicable: SharePoint Online +Aliases: + Required: True Position: Named Default value: None @@ -88,34 +90,38 @@ Accept pipeline input: False Accept wildcard characters: False ``` -### -WhatIf +### -Confirm -Shows what would happen if the cmdlet runs. The cmdlet isn't run. +> Applicable: SharePoint Online + +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. ```yaml -Type: SwitchParameter +Type: System.Management.Automation.SwitchParameter Parameter Sets: (All) -Aliases: wi -Applicable: SharePoint Online +Aliases: cf + Required: False Position: Named -Default value: False +Default value: None Accept pipeline input: False Accept wildcard characters: False ``` -### -Confirm +### -WhatIf -Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. +> Applicable: SharePoint Online + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. ```yaml -Type: SwitchParameter +Type: System.Management.Automation.SwitchParameter Parameter Sets: (All) -Aliases: cf -Applicable: SharePoint Online +Aliases: wi + Required: False Position: Named -Default value: True +Default value: None Accept pipeline input: False Accept wildcard characters: False ``` @@ -141,7 +147,6 @@ This cmdlet doesn't return an object. Use `Get-SPOSiteRestrictedAppAccessControl - The tenant switch gates all site enforcement, so a site policy has no effect while the tenant switch is off. The tenant deny list can't be overridden by a site allow list. - App Restrictions never grants permissions. A request must still pass existing SharePoint authorization. - This cmdlet supports `-WhatIf` and `-Confirm` with `ConfirmImpact.High`. `-Confirm:$false` is allowed for automation and doesn't bypass validation, authorization, auditing, or first-party protection. -- [Add the exact warning and error text emitted by the cmdlet.] ## RELATED LINKS From d9c5b7fb8871536f171acccde484c19fb6c65a11 Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Mon, 12 Oct 2026 13:58:45 -0500 Subject: [PATCH 31/43] Update documentation for Disable-SPOTenantRestrictedAppAccessControl Updated the documentation for the Disable-SPOTenantRestrictedAppAccessControl cmdlet, including changes to parameters and descriptions. --- ...ble-SPOTenantRestrictedAppAccessControl.md | 30 +++++++++++-------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOTenantRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOTenantRestrictedAppAccessControl.md index 570ee9d3a..ae5aa2426 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOTenantRestrictedAppAccessControl.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOTenantRestrictedAppAccessControl.md @@ -8,8 +8,8 @@ schema: 2.0.0 ms.author: neilh ms.reviewer: neilh description: Disable-SPOTenantRestrictedAppAccessControl turns off tenant-wide App Restrictions enforcement while keeping your deny list intact. Learn the syntax and examples. -ms.date: 10/09/2026 -ms.topic: concept-article +ms.date: 10/12/2026 +ms.topic: reference --- # Disable-SPOTenantRestrictedAppAccessControl @@ -38,7 +38,7 @@ Configuration and enablement are orthogonal: this cmdlet changes only the switch The tenant scope is deny-only and has a single list, so there's no mode cmdlet and no `-ListType` parameter at tenant scope. -App Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. App Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. +Tenant App Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. App Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. You must be at least a SharePoint Administrator to run this cmdlet. @@ -73,15 +73,17 @@ This example turns off the tenant switch without prompting, which is useful in a ## PARAMETERS -### -WhatIf +### -Confirm -Shows what would happen if the cmdlet runs. The cmdlet isn't run. +> Applicable: SharePoint Online + +Prompts you for confirmation before running the cmdlet. This cmdlet has a confirm impact of High, so it prompts by default. Automation can use `-Confirm:$false` to suppress the prompt. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. ```yaml -Type: SwitchParameter +Type: System.Management.Automation.SwitchParameter Parameter Sets: (All) -Aliases: wi -Applicable: SharePoint Online +Aliases: cf + Required: False Position: Named Default value: None @@ -89,15 +91,17 @@ Accept pipeline input: False Accept wildcard characters: False ``` -### -Confirm +### -WhatIf -Prompts you for confirmation before running the cmdlet. This cmdlet has a confirm impact of High, so it prompts by default. Automation can use `-Confirm:$false` to suppress the prompt. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. +> Applicable: SharePoint Online + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. ```yaml -Type: SwitchParameter +Type: System.Management.Automation.SwitchParameter Parameter Sets: (All) -Aliases: cf -Applicable: SharePoint Online +Aliases: wi + Required: False Position: Named Default value: None From b7236c6719e4c02d1009ff5a2aefcd3ff3f7239e Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Mon, 12 Oct 2026 13:59:39 -0500 Subject: [PATCH 32/43] Update Get-SPOSiteRestrictedAppAccessControl documentation Updated the date and topic for the Get-SPOSiteRestrictedAppAccessControl documentation. Removed outdated sections and added clarifications on site enforcement and policy management. --- .../Get-SPOSiteRestrictedAppAccessControl.md | 135 +----------------- 1 file changed, 3 insertions(+), 132 deletions(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md index b78f15b80..7bb63ea94 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md @@ -8,8 +8,8 @@ schema: 2.0.0 ms.author: neilh ms.reviewer: neilh description: Learn how to use Get-SPOSiteRestrictedAppAccessControl to read a SharePoint site's App Restrictions policy and check enforcement status with PowerShell. -ms.date: 10/09/2026 -ms.topic: concept-article +ms.date: 10/12/2026 +ms.topic: reference --- # Get-SPOSiteRestrictedAppAccessControl @@ -33,133 +33,4 @@ App Restrictions adds a SharePoint authorization boundary for applications that A site policy has four parts: - **Enabled** - whether site enforcement is turned on. Site enforcement is turned on only by `Enable-SPOSiteRestrictedAppAccessControl`. Mode and list changes are configuration-only and preserve the current enablement state. -- **Mode** - the active mode. When the mode is `Allow`, applications in the allow list are allowed and all other governed apps are denied. When the mode is `Deny`, applications in the deny list are denied and all other governed apps are allowed. `Allow` is the default mode when a site is enabled without existing configuration. -- **AllowList** - the persistent list used when the mode is `Allow`. -- **DenyList** - the persistent list used when the mode is `Deny`. - -Both lists are always stored and can be managed regardless of which mode is active. Only the list selected by the active mode participates in runtime enforcement. The inactive list is preserved for future mode changes and has no runtime effect. An empty active allow list blocks all governed third-party and agentic apps. An empty active deny list allows all governed apps. - -`AllowList` and `DenyList` are returned as GUID arrays. Each list can contain both concrete application IDs and parent agent blueprint IDs, and a blueprint ID applies to the blueprint application itself and to every current or future agent app created from that blueprint. The cmdlet doesn't require you to distinguish between the two: each property merges its internally typed application and blueprint entries into one stable, duplicate-free list of GUIDs. - -This cmdlet performs an uncached read and always returns the authoritative stored policy rather than a cached copy. - -Site enforcement is gated by the tenant switch. While the tenant switch is off, no site policy is enforced, even when a site policy reports `Enabled` as `True`. While the tenant switch is on, the tenant deny list takes precedence and can't be overridden by a site allow list. Use `Get-SPOTenantRestrictedAppAccessControl` to read the tenant switch and the tenant deny list. - -Site App Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. App Restrictions is fully decoupled from site properties, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated App Restrictions cmdlets listed in [Related Links](#related-links). - -You must be at least a SharePoint Administrator to run this cmdlet. -Microsoft first-party and core applications are excluded from App Restrictions configuration and enforcement and never appear in a site list. - -For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). - -## EXAMPLES - -### Example 1 - -``` -Get-SPOSiteRestrictedAppAccessControl -Identity https://contoso.sharepoint.com/sites/Finance -``` - -This example returns the complete Restricted App Access Control policy for the Finance site, bound by site URL. - -### Example 2 - -``` -Get-SPOSiteRestrictedAppAccessControl -Identity 8a1e30f6-2f52-4b9e-9d1b-2e9f6c1d40aa -``` - -This example returns the same policy for a site bound by site ID. The returned object carries `SiteUrl`, so it identifies its own site even when you don't know the URL. - -### Example 3 - -``` -$policy = Get-SPOSiteRestrictedAppAccessControl -Identity https://contoso.sharepoint.com/sites/Finance -if ($policy.Mode -eq "Allow") { - $policy.AllowList -} else { - $policy.DenyList -} -``` - -This example returns only the list that the active mode enforces. The other list is still stored and preserved, but it has no runtime effect until you change the mode. - -### Example 4 - -``` -$policy = Get-SPOSiteRestrictedAppAccessControl -Identity https://contoso.sharepoint.com/sites/Finance -if ($policy.Enabled -and $policy.Mode -eq "Allow" -and $policy.AllowList.Count -eq 0) { - Write-Host "Enforcement is on with an empty active allow list, which blocks all governed third-party and agentic apps." -} -``` - -This example identifies the state where enforcement is enabled, the active mode is `Allow`, and the active allow list is empty. In that state, all governed third-party and agentic apps are blocked from the site while the tenant switch is on. - -## PARAMETERS - -### -Identity - -Specifies the site to read. You can specify either the site URL or the site ID. - -```yaml -Type: String -Parameter Sets: (All) -Aliases: [] -Applicable: SharePoint Online -Required: True -Position: 0 -Default value: None -Accept pipeline input: True -Accept wildcard characters: False -``` - -### CommonParameters - -This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). - -## INPUTS - -### System.String - -## OUTPUTS - -### SPORestrictedAppAccessControlSitePolicy - -Returns an `SPORestrictedAppAccessControlSitePolicy` object with the following properties. - -| Property | Type | Description | -|---|---|---| -| `SiteUrl` | String | The URL of the site the policy belongs to. This property is carried so the returned object identifies its own site, which matters when sites are piped into the cmdlet and when you bound the site by ID. | -| `Enabled` | Boolean | Indicates whether site enforcement is turned on. Site enforcement is also gated by the tenant switch. | -| `Mode` | String | The active mode, `Allow` or `Deny`. Only the list selected by this mode is enforced. | -| `AllowList` | Guid[] | The persistent allow list, returned as one stable, duplicate-free list of application IDs and parent agent blueprint IDs. | -| `DenyList` | Guid[] | The persistent deny list, returned as one stable, duplicate-free list of application IDs and parent agent blueprint IDs. | - -When the stored policy data is malformed, the cmdlet emits a warning and the returned object includes `IsPolicyDataMalformed = true`. Healthy output omits that property. - -## NOTES - -- Getters return authoritative uncached state. -- Both lists are always stored. Only the list selected by the active mode is enforced; the inactive list is preserved and has no runtime effect. -- Each list has a hard maximum of 100 entries, and the two lists combined have a hard maximum of 200 entries. -- A parent agent blueprint ID entry applies to the blueprint application itself and to every current or future agent app created from that blueprint. -- The tenant switch gates all site enforcement. While the tenant switch is on, the tenant deny list can't be overridden by a site allow list. -- Configuration and enablement are orthogonal: mode and list changes never turn enforcement on. The only combination the backend rejects is enabled with mode `None`. -- Use `Get-SPOTenantRestrictedAppAccessControl` to read the tenant-level policy. - -## RELATED LINKS - -[Set-SPOSiteRestrictedAppAccessControlMode](Set-SPOSiteRestrictedAppAccessControlMode.md) - -[Set-SPOSiteRestrictedAppAccessControlList](Set-SPOSiteRestrictedAppAccessControlList.md) - -[Enable-SPOSiteRestrictedAppAccessControl](Enable-SPOSiteRestrictedAppAccessControl.md) - -[Disable-SPOSiteRestrictedAppAccessControl](Disable-SPOSiteRestrictedAppAccessControl.md) - -[Clear-SPOSiteRestrictedAppAccessControlList](Clear-SPOSiteRestrictedAppAccessControlList.md) - -[Clear-SPOSiteRestrictedAppAccessControlPolicy](Clear-SPOSiteRestrictedAppAccessControlPolicy.md) - -[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) - -[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) +- **Mode** - the active mode. When the mode is `Allow`, applications in the allow list are allowed and all other governed ap From c922b1e4e87aed95a2cc78daa9b674aa03d1299b Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Mon, 12 Oct 2026 14:00:45 -0500 Subject: [PATCH 33/43] Revise documentation for Enable-SPOSiteRestrictedAppAccessControl Updated the documentation for Enable-SPOSiteRestrictedAppAccessControl, including changes to the date and topic. Removed outdated examples and added relevant notes. --- ...nable-SPOSiteRestrictedAppAccessControl.md | 115 +----------------- 1 file changed, 5 insertions(+), 110 deletions(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOSiteRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOSiteRestrictedAppAccessControl.md index de7ed0233..31bb1b26f 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOSiteRestrictedAppAccessControl.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOSiteRestrictedAppAccessControl.md @@ -8,8 +8,8 @@ schema: 2.0.0 ms.author: neilh ms.reviewer: neilh description: Enable-SPOSiteRestrictedAppAccessControl turns on App Restrictions enforcement for a SharePoint site using its existing mode and lists. Learn syntax and examples. -ms.date: 10/09/2026 -ms.topic: concept-article +ms.date: 10/12/2026 +ms.topic: reference --- # Enable-SPOSiteRestrictedAppAccessControl @@ -43,7 +43,8 @@ App Restrictions adds a SharePoint authorization boundary for applications that Site App Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. App Restrictions is fully decoupled from `SiteProperties`, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated App Restrictions cmdlets listed in [Related Links](#related-links). -You must be at least a SharePoint Administrator to run this cmdlet. +You must be at least a SharePoint Administrator to run this cmdlet. + Microsoft first-party and core applications are excluded from App Restrictions configuration and enforcement. For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). @@ -69,110 +70,4 @@ This example turns on enforcement for the same site by using its site ID. Every ### Example 3 ``` -$url = "https://contoso.sharepoint.com/sites/Finance" -Set-SPOSiteRestrictedAppAccessControlMode -Identity $url -Mode Allow -Set-SPOSiteRestrictedAppAccessControlList -Identity $url -ListType AllowList -AddRestrictedAppIds "11111111-1111-1111-1111-111111111111" -Enable-SPOSiteRestrictedAppAccessControl -Identity $url -``` - -This example stages a policy and then enables it explicitly. The mode and list changes are configuration-only and don't turn enforcement on, so nothing is enforced until the final command runs. - -### Example 4 - -``` -Enable-SPOSiteRestrictedAppAccessControl -Identity "https://contoso.sharepoint.com/sites/Finance" -Confirm:$false -``` - -This example turns on enforcement without an interactive confirmation prompt, for use in automation. Using `-Confirm:$false` doesn't bypass validation, authorization, auditing, or first-party protection. - -## PARAMETERS - -### -Identity - -Specifies the site to enable. Provide either the site URL or the site ID. - -```yaml -Type: String -Parameter Sets: (All) -Aliases: [] -Applicable: SharePoint Online -Required: True -Position: Named -Default value: None -Accept pipeline input: False -Accept wildcard characters: False -``` - -### -WhatIf - -Shows what would happen if the cmdlet runs. The cmdlet isn't run. - -```yaml -Type: SwitchParameter -Parameter Sets: (All) -Aliases: wi -Applicable: SharePoint Online -Required: False -Position: Named -Default value: False -Accept pipeline input: False -Accept wildcard characters: False -``` - -### -Confirm - -Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. - -```yaml -Type: SwitchParameter -Parameter Sets: (All) -Aliases: cf -Applicable: SharePoint Online -Required: False -Position: Named -Default value: True -Accept pipeline input: False -Accept wildcard characters: False -``` - -### CommonParameters - -This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). - -## INPUTS - -### None - -## OUTPUTS - -### None - -This cmdlet doesn't return an object. Use `Get-SPOSiteRestrictedAppAccessControl` to read the resulting policy. - -## NOTES - -- This cmdlet fails when no mode is set on the site. Enabled with mode `None` is the only combination that the backend rejects. -- Site enforcement is turned on only by this cmdlet. Mode and list changes are configuration-only and preserve the current enablement state. -- An empty active allow list blocks all governed third-party and agentic apps. Review the active list with `Get-SPOSiteRestrictedAppAccessControl` before you enable a site. -- The tenant switch gates all site enforcement, so a site policy has no effect while the tenant switch is off. The tenant deny list can't be overridden by a site allow list. -- App Restrictions never grants permissions. A request must still pass existing SharePoint authorization. -- This cmdlet supports `-WhatIf` and `-Confirm` with `ConfirmImpact.High`. `-Confirm:$false` is allowed for automation and doesn't bypass validation, authorization, auditing, or first-party protection. -- [Add the exact warning and error text emitted by the cmdlet.] - -## RELATED LINKS - -[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) - -[Set-SPOSiteRestrictedAppAccessControlMode](Set-SPOSiteRestrictedAppAccessControlMode.md) - -[Set-SPOSiteRestrictedAppAccessControlList](Set-SPOSiteRestrictedAppAccessControlList.md) - -[Disable-SPOSiteRestrictedAppAccessControl](Disable-SPOSiteRestrictedAppAccessControl.md) - -[Clear-SPOSiteRestrictedAppAccessControlList](Clear-SPOSiteRestrictedAppAccessControlList.md) - -[Clear-SPOSiteRestrictedAppAccessControlPolicy](Clear-SPOSiteRestrictedAppAccessControlPolicy.md) - -[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) - -[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) +$url = "https://contoso.sharepoint. From 16cb58420140b66a1591464b5f6192119346bf3c Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Mon, 12 Oct 2026 14:06:23 -0500 Subject: [PATCH 34/43] Update documentation for Enable-SPOTenantRestrictedAppAccessControl --- ...ble-SPOTenantRestrictedAppAccessControl.md | 28 +++++++++++-------- 1 file changed, 16 insertions(+), 12 deletions(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOTenantRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOTenantRestrictedAppAccessControl.md index 43366404f..88c6e7da0 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOTenantRestrictedAppAccessControl.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOTenantRestrictedAppAccessControl.md @@ -8,8 +8,8 @@ schema: 2.0.0 ms.author: neilh ms.reviewer: neilh description: Learn how to use Enable-SPOTenantRestrictedAppAccessControl to activate the master enforcement switch for App Restrictions across your SharePoint Online tenant. -ms.date: 10/09/2026 -ms.topic: concept-article +ms.date: 10/12/2026 +ms.topic: reference --- # Enable-SPOTenantRestrictedAppAccessControl @@ -81,15 +81,17 @@ This example turns on the tenant switch without prompting for confirmation, whic ## PARAMETERS -### -WhatIf +### -Confirm -Shows what would happen if the cmdlet runs. The cmdlet isn't run. +> Applicable: SharePoint Online + +Prompts you for confirmation before running the cmdlet. This cmdlet has a confirm impact of High, so it prompts by default. Automation can use `-Confirm:$false` to suppress the prompt. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. ```yaml -Type: SwitchParameter +Type: System.Management.Automation.SwitchParameter Parameter Sets: (All) -Aliases: wi -Applicable: SharePoint Online +Aliases: cf + Required: False Position: Named Default value: None @@ -97,15 +99,17 @@ Accept pipeline input: False Accept wildcard characters: False ``` -### -Confirm +### -WhatIf -Prompts you for confirmation before running the cmdlet. This cmdlet has a confirm impact of High, so it prompts by default. Automation can use `-Confirm:$false` to suppress the prompt. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. +> Applicable: SharePoint Online + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. ```yaml -Type: SwitchParameter +Type: System.Management.Automation.SwitchParameter Parameter Sets: (All) -Aliases: cf -Applicable: SharePoint Online +Aliases: wi + Required: False Position: Named Default value: None From ef3bc427238083686dcada691ab26a0f03ea9c95 Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Mon, 12 Oct 2026 14:07:37 -0500 Subject: [PATCH 35/43] Revise description and update metadata for cmdlet Updated the description and metadata for Get-SPOTenantRestrictedAppAccessControl. --- .../Get-SPOTenantRestrictedAppAccessControl.md | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOTenantRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOTenantRestrictedAppAccessControl.md index 244daa8dd..80d797991 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOTenantRestrictedAppAccessControl.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOTenantRestrictedAppAccessControl.md @@ -7,9 +7,9 @@ title: Get-SPOTenantRestrictedAppAccessControl schema: 2.0.0 ms.author: neilh ms.reviewer: neilh -description: Get-SPOTenantRestrictedAppAccessControl retrieves your tenant's App Restrictionsolicy, including enforcement status and the deny list. Learn how. -ms.date: 10/09/2026 -ms.topic: concept-article +description: Get-SPOTenantRestrictedAppAccessControl retrieves your tenant's App Restrictions policy, including enforcement status and the deny list. Learn how. +ms.date: 10/12/2026 +ms.topic: reference --- # Get-SPOTenantRestrictedAppAccessControl @@ -32,7 +32,7 @@ App Restrictions adds a SharePoint authorization boundary for applications that The tenant policy has two parts: -- **Enabled** - the master enforcement switch for App Restrictions. When this switch is off, no RAC for Apps policy is enforced, including the tenant deny list and any site-level policies. Stored tenant and site configuration is preserved, so enforcement resumes with the same configuration when the switch is turned on again. +- **Enabled** - the master enforcement switch for App Restrictions. When this switch is off, no App Restrictions policy is enforced, including the tenant deny list and any site-level policies. Stored tenant and site configuration is preserved, so enforcement resumes with the same configuration when the switch is turned on again. - **RestrictedAppIds** - the tenant-wide emergency deny list. When the switch is on, applications in this list are denied and the list can't be overridden by a site-level allow list. The tenant deny list can contain both concrete application IDs and parent agent blueprint IDs. A blueprint ID applies to the blueprint application itself and to every current or future agent app created from that blueprint. The cmdlet doesn't require you to distinguish between the two: `RestrictedAppIds` merges the internally typed entries into one stable, duplicate-free list of GUIDs. IDs are stored as lowercase canonical GUID strings and sorted, so output is stable between calls. @@ -89,8 +89,6 @@ This example identifies the state where enforcement is enabled but the tenant de ## PARAMETERS -This cmdlet has no parameters. - ### CommonParameters This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). From 3d6e39b9f80b45f83508b02378c809863d608bb7 Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Mon, 12 Oct 2026 14:09:16 -0500 Subject: [PATCH 36/43] Fix formatting in Get-SPOTenantRestrictedAppAccessControl.md From 61cf51d936b20c156d96be61ae9de7407a7bbdcc Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Mon, 12 Oct 2026 14:10:31 -0500 Subject: [PATCH 37/43] Revise Set-SPOSiteRestrictedAppAccessControlMode documentation Updated metadata and descriptions for clarity. --- ...t-SPOSiteRestrictedAppAccessControlMode.md | 57 +++++++++++-------- 1 file changed, 32 insertions(+), 25 deletions(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlMode.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlMode.md index 5ca68fc00..ac93b3dd5 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlMode.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlMode.md @@ -8,8 +8,8 @@ schema: 2.0.0 ms.author: neilh ms.reviewer: neilh description: Set-SPOSiteRestrictedAppAccessControlMode switches a site between Allow and Deny modes while preserving both app lists. Learn the syntax and examples. -ms.date: 10/09/2026 -ms.topic: concept-article +ms.date: 10/12/2026 +ms.topic: reference --- # Set-SPOSiteRestrictedAppAccessControlMode @@ -21,15 +21,14 @@ Sets the active mode of the site-level App Restrictions policy to `Allow` or `De ## SYNTAX ``` -Set-SPOSiteRestrictedAppAccessControlMode [-Identity] -Mode [-WhatIf] [-Confirm] - [] +Set-SPOSiteRestrictedAppAccessControlMode [-Identity] -Mode [-WhatIf] [-Confirm] [] ``` ## DESCRIPTION Use the `Set-SPOSiteRestrictedAppAccessControlMode` cmdlet to change which list a site enforces. This cmdlet changes the active mode only. It preserves site enablement and both the allow list and the deny list. -Restricted App Access Control (RAC for Apps) adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and RAC for Apps. +App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions. The active mode selects the list that is enforced: @@ -46,7 +45,7 @@ Site enforcement is also gated by the tenant switch. While the tenant switch is Automation can use the standard `-Confirm:$false`. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. -Site App Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated RAC for Apps cmdlets listed in [Related Links](#related-links). +Site App Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated App Restrictions cmdlets listed in [Related Links](#related-links). You must be at least a SharePoint Administrator to run this cmdlet. @@ -91,32 +90,36 @@ This example stages the mode first and then turns enforcement on explicitly. A m ### -Identity +> Applicable: SharePoint Online + Specifies the site to configure. You can specify either the site URL or the site ID. ```yaml -Type: String +Type: System.String Parameter Sets: (All) -Aliases: [] -Applicable: SharePoint Online +Aliases: + Required: True Position: 0 Default value: None -Accept pipeline input: True +Accept pipeline input: True (ByValue) Accept wildcard characters: False ``` ### -Mode +> Applicable: SharePoint Online + Specifies the active mode of the site policy. Valid values are `Allow` and `Deny`. When the mode is `Allow`, applications in the allow list are allowed and all other governed apps are denied. When the mode is `Deny`, applications in the deny list are denied and all other governed apps are allowed. Both lists are preserved either way. ```yaml -Type: String +Type: System.String Parameter Sets: (All) -Aliases: [] -Applicable: SharePoint Online +Aliases: Accepted values: Allow, Deny + Required: True Position: Named Default value: None @@ -124,34 +127,38 @@ Accept pipeline input: False Accept wildcard characters: False ``` -### -WhatIf +### -Confirm -Shows what would happen if the cmdlet runs. The cmdlet isn't run. `-WhatIf` displays the same mode-switch impact as the confirmation warning without changing the policy. +> Applicable: SharePoint Online + +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. ```yaml -Type: SwitchParameter +Type: System.Management.Automation.SwitchParameter Parameter Sets: (All) -Aliases: wi -Applicable: SharePoint Online +Aliases: cf + Required: False Position: Named -Default value: False +Default value: None Accept pipeline input: False Accept wildcard characters: False ``` -### -Confirm +### -WhatIf -Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. +> Applicable: SharePoint Online + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. `-WhatIf` displays the same mode-switch impact as the confirmation warning without changing the policy. ```yaml -Type: SwitchParameter +Type: System.Management.Automation.SwitchParameter Parameter Sets: (All) -Aliases: cf -Applicable: SharePoint Online +Aliases: wi + Required: False Position: Named -Default value: True +Default value: None Accept pipeline input: False Accept wildcard characters: False ``` From a862293bde7ddec0deb38fba8c43b3e6b6f76049 Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Mon, 12 Oct 2026 14:14:19 -0500 Subject: [PATCH 38/43] Update documentation for Set-SPOSiteRestrictedAppAccessControlList Updated the description and topic of the Set-SPOSiteRestrictedAppAccessControlList documentation. Removed outdated examples and clarified parameter details. --- ...t-SPOSiteRestrictedAppAccessControlList.md | 86 +++++++++---------- 1 file changed, 39 insertions(+), 47 deletions(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlList.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlList.md index 62588e3e0..a7bd9d150 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlList.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlList.md @@ -8,8 +8,8 @@ schema: 2.0.0 ms.author: neilh ms.reviewer: neilh description: Learn how to use Set-SPOSiteRestrictedAppAccessControlList to manage site-level allow and deny lists for App Restrictions in SharePoint Online. -ms.date: 10/09/2026 -ms.topic: concept-article +ms.date: 10/12/2026 +ms.topic: reference --- # Set-SPOSiteRestrictedAppAccessControlList @@ -21,9 +21,7 @@ Adds application IDs to, or removes application IDs from, the allow list or the ## SYNTAX ``` -Set-SPOSiteRestrictedAppAccessControlList [-Identity] -ListType - [-AddRestrictedAppIds ] [-RemoveRestrictedAppIds ] [-WhatIf] [-Confirm] - [] +Set-SPOSiteRestrictedAppAccessControlList [-Identity] -ListType [-AddRestrictedAppIds ] [-RemoveRestrictedAppIds ] [-WhatIf] [-Confirm] [] ``` ## DESCRIPTION @@ -69,55 +67,41 @@ This example adds one application ID to the allow list of the Finance site. The ### Example 2 ``` -Set-SPOSiteRestrictedAppAccessControlList -Identity https://contoso.sharepoint.com/sites/Finance -ListType DenyList -AddRestrictedAppIds 22222222-2222-2222-2222-222222222222,33333333-3333-3333-3333-333333333333 -RemoveRestrictedAppIds 44444444-4444-4444-4444-444444444444 +Set-SPOSiteRestrictedAppAccessControlList -Identity https://contoso.sharepoint.com/sites/Finance -ListType DenyList -AddRestrictedAppIds 22222222-2222-2222-2222-222222222222,33333333-3333-3333-3333-333333333333 -RemoveRestrictedAppIds 44444444-4444-4444-4444-444 ``` -This example adds two IDs to the deny list and removes one ID from the deny list in a single atomic update. Removals are applied before additions, and the bulk add is all-or-none. - -### Example 3 - -``` -Set-SPOSiteRestrictedAppAccessControlList -Identity 8a1e30f6-2f52-4b9e-9d1b-2e9f6c1d40aa -ListType AllowList -RemoveRestrictedAppIds 55555555-5555-5555-5555-555555555555 -Confirm:$false -``` - -This example removes a stale application ID from the allow list of a site bound by site ID, without prompting. Removal doesn't call Microsoft Graph, so IDs for deleted applications can still be removed. If the ID isn't present in the list, the cmdlet returns a validation error. - -### Example 4 - -``` -Set-SPOSiteRestrictedAppAccessControlList -Identity https://contoso.sharepoint.com/sites/Finance -ListType DenyList -AddRestrictedAppIds 66666666-6666-6666-6666-666666666666 -WhatIf -``` - -This example shows what would change without modifying the policy. Adding a parent agent blueprint ID to a deny list blocks the blueprint application and every current or future agent app created from it. - ## PARAMETERS ### -Identity +> Applicable: SharePoint Online + Specifies the site to configure. You can specify either the site URL or the site ID. ```yaml -Type: String +Type: System.String Parameter Sets: (All) -Aliases: [] -Applicable: SharePoint Online +Aliases: + Required: True Position: 0 Default value: None -Accept pipeline input: True +Accept pipeline input: True (ByValue) Accept wildcard characters: False ``` ### -ListType +> Applicable: SharePoint Online + Specifies the list to change. Valid values are `AllowList` and `DenyList`. Entry mutations must explicitly identify the target list. ```yaml -Type: String +Type: System.String Parameter Sets: (All) -Aliases: [] -Applicable: SharePoint Online +Aliases: Accepted values: AllowList, DenyList + Required: True Position: Named Default value: None @@ -127,6 +111,8 @@ Accept wildcard characters: False ### -AddRestrictedAppIds +> Applicable: SharePoint Online + Specifies the application IDs to add to the list identified by `-ListType`. You supply application IDs only; the backend classifies each added ID as a regular application or a parent agent blueprint and stores the type internally. Adds use the shared bulk Microsoft Graph classification. First-party or core applications and unclassifiable IDs are rejected, and a bulk add is all-or-none. @@ -134,10 +120,10 @@ Adds use the shared bulk Microsoft Graph classification. First-party or core app At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, and an ID can't appear in both. ```yaml -Type: Guid[] +Type: System.Guid[] Parameter Sets: (All) Aliases: -Applicable: SharePoint Online + Required: False Position: Named Default value: None @@ -147,6 +133,8 @@ Accept wildcard characters: False ### -RemoveRestrictedAppIds +> Applicable: SharePoint Online + Specifies the application IDs to remove from the list identified by `-ListType`. Removals are applied before additions. Removing entries doesn't call Microsoft Graph, so deleted or stale application IDs can still be removed. If a supplied ID isn't present in the target list, the cmdlet returns a validation error. @@ -154,10 +142,10 @@ Removing entries doesn't call Microsoft Graph, so deleted or stale application I At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, and an ID can't appear in both. ```yaml -Type: Guid[] +Type: System.Guid[] Parameter Sets: (All) Aliases: -Applicable: SharePoint Online + Required: False Position: Named Default value: None @@ -165,34 +153,38 @@ Accept pipeline input: False Accept wildcard characters: False ``` -### -WhatIf +### -Confirm -Shows what would happen if the cmdlet runs. The cmdlet isn't run. +> Applicable: SharePoint Online + +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. ```yaml -Type: SwitchParameter +Type: System.Management.Automation.SwitchParameter Parameter Sets: (All) -Aliases: wi -Applicable: SharePoint Online +Aliases: cf + Required: False Position: Named -Default value: False +Default value: None Accept pipeline input: False Accept wildcard characters: False ``` -### -Confirm +### -WhatIf -Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. +> Applicable: SharePoint Online + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. ```yaml -Type: SwitchParameter +Type: System.Management.Automation.SwitchParameter Parameter Sets: (All) -Aliases: cf -Applicable: SharePoint Online +Aliases: wi + Required: False Position: Named -Default value: True +Default value: None Accept pipeline input: False Accept wildcard characters: False ``` From 37044470f08d22573d7ed172b44c59d16f8e73f5 Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Mon, 12 Oct 2026 14:16:17 -0500 Subject: [PATCH 39/43] Revise documentation for Set-SPOTenantRestrictedAppAccessControlList Updated the documentation for Set-SPOTenantRestrictedAppAccessControlList to reflect changes in date, topic, and descriptions. Adjusted parameter details and examples for clarity. --- ...SPOTenantRestrictedAppAccessControlList.md | 57 +++++++++++-------- 1 file changed, 32 insertions(+), 25 deletions(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOTenantRestrictedAppAccessControlList.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOTenantRestrictedAppAccessControlList.md index a58fd9e80..8593ec464 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOTenantRestrictedAppAccessControlList.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOTenantRestrictedAppAccessControlList.md @@ -8,8 +8,8 @@ schema: 2.0.0 ms.author: neilh ms.reviewer: neilh description: Set-SPOTenantRestrictedAppAccessControlList lets you add or remove app IDs from the tenant deny list in one atomic update. Learn syntax and examples. -ms.date: 10/09/2026 -ms.topic: concept-article +ms.date: 10/12/2026 +ms.topic: reference --- # Set-SPOTenantRestrictedAppAccessControlList @@ -21,15 +21,14 @@ Adds application IDs to and removes application IDs from the tenant-wide App Res ## SYNTAX ``` -Set-SPOTenantRestrictedAppAccessControlList [-AddRestrictedAppIds ] - [-RemoveRestrictedAppIds ] [-WhatIf] [-Confirm] [] +Set-SPOTenantRestrictedAppAccessControlList [-AddRestrictedAppIds ] [-RemoveRestrictedAppIds ] [-WhatIf] [-Confirm] [] ``` ## DESCRIPTION Use the `Set-SPOTenantRestrictedAppAccessControlList` cmdlet to change the tenant-wide emergency deny list for Restricted App Access Control. -App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and RAC for Apps. +App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions. Both parameters are applied in one atomic update that preserves the tenant enforcement switch. At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, and the same ID can't appear in both parameters. Removals are applied before additions. @@ -49,7 +48,7 @@ Tenant App Restrictions administration is isolated from the general-purpose `Get You must be at least a SharePoint Administrator to run this cmdlet. -For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/connect-sharepoint-online). +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). ## EXAMPLES @@ -89,15 +88,17 @@ This example shows what would happen if the application ID were added, without c ### -AddRestrictedAppIds +> Applicable: SharePoint Online + Specifies the application IDs to add to the tenant deny list. Each supplied ID is classified by using Microsoft Graph and stored internally as either a regular application or a parent agent blueprint. First-party/core and unclassifiable IDs are rejected, and the add is all-or-none. At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, and an ID can't appear in both parameters. The combined tenant deny list can't exceed 100 IDs. ```yaml -Type: Guid[] +Type: System.Guid[] Parameter Sets: (All) Aliases: -Applicable: SharePoint Online + Required: False Position: Named Default value: None @@ -107,15 +108,17 @@ Accept wildcard characters: False ### -RemoveRestrictedAppIds +> Applicable: SharePoint Online + Specifies the application IDs to remove from the tenant deny list. Removals are applied before additions and don't use Microsoft Graph, so stale or deleted application IDs can always be removed. At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, and an ID can't appear in both parameters. ```yaml -Type: Guid[] +Type: System.Guid[] Parameter Sets: (All) Aliases: -Applicable: SharePoint Online + Required: False Position: Named Default value: None @@ -123,15 +126,17 @@ Accept pipeline input: False Accept wildcard characters: False ``` -### -WhatIf +### -Confirm -Shows what would happen if the cmdlet runs. The cmdlet isn't run. +> Applicable: SharePoint Online + +Prompts you for confirmation before running the cmdlet. This cmdlet has a confirm impact of High, so it prompts by default. Automation can use `-Confirm:$false` to suppress the prompt. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. ```yaml -Type: SwitchParameter +Type: System.Management.Automation.SwitchParameter Parameter Sets: (All) -Aliases: wi -Applicable: SharePoint Online +Aliases: cf + Required: False Position: Named Default value: None @@ -139,15 +144,17 @@ Accept pipeline input: False Accept wildcard characters: False ``` -### -Confirm +### -WhatIf -Prompts you for confirmation before running the cmdlet. This cmdlet has a confirm impact of High, so it prompts by default. Automation can use `-Confirm:$false` to suppress the prompt. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. +> Applicable: SharePoint Online + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. ```yaml -Type: SwitchParameter +Type: System.Management.Automation.SwitchParameter Parameter Sets: (All) -Aliases: cf -Applicable: SharePoint Online +Aliases: wi + Required: False Position: Named Default value: None @@ -182,14 +189,14 @@ This cmdlet doesn't return an output object. Use `Get-SPOTenantRestrictedAppAcce ## RELATED LINKS -[Get-SPOTenantRestrictedAppAccessControl](/powershell/module/microsoft.online.sharepoint.powershell/Get-SPOTenantRestrictedAppAccessControl) +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) -[Enable-SPOTenantRestrictedAppAccessControl](/powershell/module/microsoft.online.sharepoint.powershell/Enable-SPOTenantRestrictedAppAccessControl) +[Enable-SPOTenantRestrictedAppAccessControl](Enable-SPOTenantRestrictedAppAccessControl.md) -[Disable-SPOTenantRestrictedAppAccessControl](/powershell/module/microsoft.online.sharepoint.powershell/Disable-SPOTenantRestrictedAppAccessControl) +[Disable-SPOTenantRestrictedAppAccessControl](Disable-SPOTenantRestrictedAppAccessControl.md) -[Clear-SPOTenantRestrictedAppAccessControlPolicy](/powershell/module/microsoft.online.sharepoint.powershell/Clear-SPOTenantRestrictedAppAccessControlPolicy) +[Clear-SPOTenantRestrictedAppAccessControlPolicy](Clear-SPOTenantRestrictedAppAccessControlPolicy.md) -[Get-SPOSiteRestrictedAppAccessControl](/powershell/module/microsoft.online.sharepoint.powershell/Get-SPOSiteRestrictedAppAccessControl) +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) From 1e4324ecdd8c3d1c6c37daf5283c10d115f3ae71 Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Mon, 12 Oct 2026 14:35:59 -0500 Subject: [PATCH 40/43] Rename Get-SPOSiteRestrictedAppAccessControl to Set-SPOTenantRestrictedAppAccessControlList Update documentation for Set-SPOTenantRestrictedAppAccessControlList cmdlet with new parameters and examples. --- .../Get-SPOSiteRestrictedAppAccessControl.md | 186 +++++++++++++++++- 1 file changed, 176 insertions(+), 10 deletions(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md index 7bb63ea94..8593ec464 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md @@ -1,36 +1,202 @@ --- external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml Module Name: Microsoft.Online.SharePoint.PowerShell -online version: https://learn.microsoft.com/powershell/module/sharepoint-online/get-spositerestrictedappaccesscontrol +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/set-spotenantrestrictedappaccesscontrollist applicable: SharePoint Online -title: Get-SPOSiteRestrictedAppAccessControl +title: Set-SPOTenantRestrictedAppAccessControlList schema: 2.0.0 ms.author: neilh ms.reviewer: neilh -description: Learn how to use Get-SPOSiteRestrictedAppAccessControl to read a SharePoint site's App Restrictions policy and check enforcement status with PowerShell. +description: Set-SPOTenantRestrictedAppAccessControlList lets you add or remove app IDs from the tenant deny list in one atomic update. Learn syntax and examples. ms.date: 10/12/2026 ms.topic: reference --- -# Get-SPOSiteRestrictedAppAccessControl +# Set-SPOTenantRestrictedAppAccessControlList ## SYNOPSIS -Returns the complete site-level App Restrictions policy for a site, including enablement, active mode, and both the allow list and the deny list. +Adds application IDs to and removes application IDs from the tenant-wide App Restrictions deny list in a single atomic update. ## SYNTAX ``` -Get-SPOSiteRestrictedAppAccessControl [-Identity] [] +Set-SPOTenantRestrictedAppAccessControlList [-AddRestrictedAppIds ] [-RemoveRestrictedAppIds ] [-WhatIf] [-Confirm] [] ``` ## DESCRIPTION -Use the `Get-SPOSiteRestrictedAppAccessControl` cmdlet to read the complete Restricted App Access Control policy stored for a single site. +Use the `Set-SPOTenantRestrictedAppAccessControlList` cmdlet to change the tenant-wide emergency deny list for Restricted App Access Control. App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions. -A site policy has four parts: +Both parameters are applied in one atomic update that preserves the tenant enforcement switch. At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, and the same ID can't appear in both parameters. Removals are applied before additions. -- **Enabled** - whether site enforcement is turned on. Site enforcement is turned on only by `Enable-SPOSiteRestrictedAppAccessControl`. Mode and list changes are configuration-only and preserve the current enablement state. -- **Mode** - the active mode. When the mode is `Allow`, applications in the allow list are allowed and all other governed ap +You supply application IDs only. You don't identify whether an ID is a regular application or a parent agent blueprint: the backend classifies each added ID and stores it in the appropriate internal list. A parent agent blueprint ID on the tenant deny list blocks the blueprint application itself and every current or future agent app created from that blueprint. + +Added IDs are classified by using Microsoft Graph. Microsoft first-party and core applications and IDs that can't be classified are rejected, and a bulk add is all-or-none: if any supplied ID is rejected, no IDs are persisted. Removals don't use Microsoft Graph, so stale or deleted application IDs can always be removed. + +The combined tenant deny list has a hard maximum of 100 application IDs. + +Configuration and enablement are orthogonal: list changes never turn the tenant switch on or off. Use `Enable-SPOTenantRestrictedAppAccessControl` and `Disable-SPOTenantRestrictedAppAccessControl` to change enforcement. + +Removing the last entry leaves an enabled switch with an empty deny list, which denies nothing. That state is allowed because it's legitimate during cleanup, but the cmdlet warns and points you to `Disable-SPOTenantRestrictedAppAccessControl` or `Clear-SPOTenantRestrictedAppAccessControlPolicy` for turning the feature off explicitly. + +The tenant scope is deny-only and has a single list, so there's no mode cmdlet, no `-ListType` parameter, and no separate clear-list cmdlet. + +Tenant App Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. App Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. + +You must be at least a SharePoint Administrator to run this cmdlet. + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +``` +Set-SPOTenantRestrictedAppAccessControlList -AddRestrictedAppIds 11111111-1111-1111-1111-111111111111 +``` + +This example adds one application ID to the tenant deny list. The backend classifies the ID and stores it as either a regular application or a parent agent blueprint. The tenant enforcement switch isn't changed. + +### Example 2 + +``` +Set-SPOTenantRestrictedAppAccessControlList -AddRestrictedAppIds 11111111-1111-1111-1111-111111111111, 22222222-2222-2222-2222-222222222222 -RemoveRestrictedAppIds 33333333-3333-3333-3333-333333333333 +``` + +This example adds two application IDs and removes a third in a single atomic update. The removal is applied before the additions. If either added ID is a first-party or core application, or can't be classified, the complete operation fails and nothing is persisted. + +### Example 3 + +``` +Set-SPOTenantRestrictedAppAccessControlList -RemoveRestrictedAppIds 33333333-3333-3333-3333-333333333333 -Confirm:$false +``` + +This example removes an application ID without prompting for confirmation, which is useful in automation. Removals don't call Microsoft Graph, so an ID for a deleted or stale application can still be removed. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. + +### Example 4 + +``` +Set-SPOTenantRestrictedAppAccessControlList -AddRestrictedAppIds 44444444-4444-4444-4444-444444444444 -WhatIf +``` + +This example shows what would happen if the application ID were added, without changing the stored tenant policy. + +## PARAMETERS + +### -AddRestrictedAppIds + +> Applicable: SharePoint Online + +Specifies the application IDs to add to the tenant deny list. Each supplied ID is classified by using Microsoft Graph and stored internally as either a regular application or a parent agent blueprint. First-party/core and unclassifiable IDs are rejected, and the add is all-or-none. + +At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, and an ID can't appear in both parameters. The combined tenant deny list can't exceed 100 IDs. + +```yaml +Type: System.Guid[] +Parameter Sets: (All) +Aliases: + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -RemoveRestrictedAppIds + +> Applicable: SharePoint Online + +Specifies the application IDs to remove from the tenant deny list. Removals are applied before additions and don't use Microsoft Graph, so stale or deleted application IDs can always be removed. + +At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, and an ID can't appear in both parameters. + +```yaml +Type: System.Guid[] +Parameter Sets: (All) +Aliases: + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm + +> Applicable: SharePoint Online + +Prompts you for confirmation before running the cmdlet. This cmdlet has a confirm impact of High, so it prompts by default. Automation can use `-Confirm:$false` to suppress the prompt. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: cf + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf + +> Applicable: SharePoint Online + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: wi + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### None + +## OUTPUTS + +### None + +This cmdlet doesn't return an output object. Use `Get-SPOTenantRestrictedAppAccessControl` to read the resulting tenant policy. + +## NOTES + +- Adds and removes are applied as one atomic update. Removals are applied before additions. +- A bulk add is all-or-none. If any supplied ID is a first-party/core application or can't be classified, no IDs are persisted. +- The combined tenant deny list has a hard maximum of 100 application IDs. +- The administrator supplies IDs only. The backend classifies each added ID and stores it as either a regular application or a parent agent blueprint. +- A parent agent blueprint ID blocks the blueprint application and every current or future agent app created from it. +- Configuration and enablement are orthogonal: list changes never flip the tenant switch. +- Removing the last entry leaves an enabled switch with an empty deny list that denies nothing. The cmdlet warns and points to `Disable-SPOTenantRestrictedAppAccessControl` or `Clear-SPOTenantRestrictedAppAccessControlPolicy`. +- Use `Set-SPOSiteRestrictedAppAccessControlList` to change the lists for an individual site. + +## RELATED LINKS + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Enable-SPOTenantRestrictedAppAccessControl](Enable-SPOTenantRestrictedAppAccessControl.md) + +[Disable-SPOTenantRestrictedAppAccessControl](Disable-SPOTenantRestrictedAppAccessControl.md) + +[Clear-SPOTenantRestrictedAppAccessControlPolicy](Clear-SPOTenantRestrictedAppAccessControlPolicy.md) + +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) From 5b24fd66699588ec4f7f7660c1345c5b79cbb8ba Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Mon, 12 Oct 2026 14:48:38 -0500 Subject: [PATCH 41/43] Rename cmdlet to Get-SPOSiteRestrictedAppAccessControl Updated the cmdlet name and description to reflect the correct functionality of retrieving site-level App Restrictions policy. --- .../Get-SPOSiteRestrictedAppAccessControl.md | 188 ++---------------- 1 file changed, 12 insertions(+), 176 deletions(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md index 8593ec464..1eebe4b00 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md @@ -1,202 +1,38 @@ --- external help file: Microsoft.Online.SharePoint.PowerShell.dll-help.xml Module Name: Microsoft.Online.SharePoint.PowerShell -online version: https://learn.microsoft.com/powershell/module/sharepoint-online/set-spotenantrestrictedappaccesscontrollist +online version: https://learn.microsoft.com/powershell/module/sharepoint-online/get-spositerestrictedappaccesscontrol applicable: SharePoint Online -title: Set-SPOTenantRestrictedAppAccessControlList +title: Get-SPOSiteRestrictedAppAccessControl schema: 2.0.0 ms.author: neilh ms.reviewer: neilh -description: Set-SPOTenantRestrictedAppAccessControlList lets you add or remove app IDs from the tenant deny list in one atomic update. Learn syntax and examples. +description: Learn how to use Get-SPOSiteRestrictedAppAccessControl to read a SharePoint site's App Restrictions policy and check enforcement status with PowerShell. ms.date: 10/12/2026 ms.topic: reference --- -# Set-SPOTenantRestrictedAppAccessControlList +# Get-SPOSiteRestrictedAppAccessControl ## SYNOPSIS -Adds application IDs to and removes application IDs from the tenant-wide App Restrictions deny list in a single atomic update. +Returns the complete site-level App Restrictions policy for a site, including enablement, active mode, and both the allow list and the deny list. ## SYNTAX ``` -Set-SPOTenantRestrictedAppAccessControlList [-AddRestrictedAppIds ] [-RemoveRestrictedAppIds ] [-WhatIf] [-Confirm] [] +Get-SPOSiteRestrictedAppAccessControl [-Identity] [] ``` ## DESCRIPTION -Use the `Set-SPOTenantRestrictedAppAccessControlList` cmdlet to change the tenant-wide emergency deny list for Restricted App Access Control. +Use the `Get-SPOSiteRestrictedAppAccessControl` cmdlet to read the complete Restricted App Access Control policy stored for a single site. App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions. -Both parameters are applied in one atomic update that preserves the tenant enforcement switch. At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, and the same ID can't appear in both parameters. Removals are applied before additions. +A site policy has four parts: -You supply application IDs only. You don't identify whether an ID is a regular application or a parent agent blueprint: the backend classifies each added ID and stores it in the appropriate internal list. A parent agent blueprint ID on the tenant deny list blocks the blueprint application itself and every current or future agent app created from that blueprint. - -Added IDs are classified by using Microsoft Graph. Microsoft first-party and core applications and IDs that can't be classified are rejected, and a bulk add is all-or-none: if any supplied ID is rejected, no IDs are persisted. Removals don't use Microsoft Graph, so stale or deleted application IDs can always be removed. - -The combined tenant deny list has a hard maximum of 100 application IDs. - -Configuration and enablement are orthogonal: list changes never turn the tenant switch on or off. Use `Enable-SPOTenantRestrictedAppAccessControl` and `Disable-SPOTenantRestrictedAppAccessControl` to change enforcement. - -Removing the last entry leaves an enabled switch with an empty deny list, which denies nothing. That state is allowed because it's legitimate during cleanup, but the cmdlet warns and points you to `Disable-SPOTenantRestrictedAppAccessControl` or `Clear-SPOTenantRestrictedAppAccessControlPolicy` for turning the feature off explicitly. - -The tenant scope is deny-only and has a single list, so there's no mode cmdlet, no `-ListType` parameter, and no separate clear-list cmdlet. - -Tenant App Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. App Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. - -You must be at least a SharePoint Administrator to run this cmdlet. - -For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). - -## EXAMPLES - -### Example 1 - -``` -Set-SPOTenantRestrictedAppAccessControlList -AddRestrictedAppIds 11111111-1111-1111-1111-111111111111 -``` - -This example adds one application ID to the tenant deny list. The backend classifies the ID and stores it as either a regular application or a parent agent blueprint. The tenant enforcement switch isn't changed. - -### Example 2 - -``` -Set-SPOTenantRestrictedAppAccessControlList -AddRestrictedAppIds 11111111-1111-1111-1111-111111111111, 22222222-2222-2222-2222-222222222222 -RemoveRestrictedAppIds 33333333-3333-3333-3333-333333333333 -``` - -This example adds two application IDs and removes a third in a single atomic update. The removal is applied before the additions. If either added ID is a first-party or core application, or can't be classified, the complete operation fails and nothing is persisted. - -### Example 3 - -``` -Set-SPOTenantRestrictedAppAccessControlList -RemoveRestrictedAppIds 33333333-3333-3333-3333-333333333333 -Confirm:$false -``` - -This example removes an application ID without prompting for confirmation, which is useful in automation. Removals don't call Microsoft Graph, so an ID for a deleted or stale application can still be removed. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. - -### Example 4 - -``` -Set-SPOTenantRestrictedAppAccessControlList -AddRestrictedAppIds 44444444-4444-4444-4444-444444444444 -WhatIf -``` - -This example shows what would happen if the application ID were added, without changing the stored tenant policy. - -## PARAMETERS - -### -AddRestrictedAppIds - -> Applicable: SharePoint Online - -Specifies the application IDs to add to the tenant deny list. Each supplied ID is classified by using Microsoft Graph and stored internally as either a regular application or a parent agent blueprint. First-party/core and unclassifiable IDs are rejected, and the add is all-or-none. - -At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, and an ID can't appear in both parameters. The combined tenant deny list can't exceed 100 IDs. - -```yaml -Type: System.Guid[] -Parameter Sets: (All) -Aliases: - -Required: False -Position: Named -Default value: None -Accept pipeline input: False -Accept wildcard characters: False -``` - -### -RemoveRestrictedAppIds - -> Applicable: SharePoint Online - -Specifies the application IDs to remove from the tenant deny list. Removals are applied before additions and don't use Microsoft Graph, so stale or deleted application IDs can always be removed. - -At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, and an ID can't appear in both parameters. - -```yaml -Type: System.Guid[] -Parameter Sets: (All) -Aliases: - -Required: False -Position: Named -Default value: None -Accept pipeline input: False -Accept wildcard characters: False -``` - -### -Confirm - -> Applicable: SharePoint Online - -Prompts you for confirmation before running the cmdlet. This cmdlet has a confirm impact of High, so it prompts by default. Automation can use `-Confirm:$false` to suppress the prompt. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. - -```yaml -Type: System.Management.Automation.SwitchParameter -Parameter Sets: (All) -Aliases: cf - -Required: False -Position: Named -Default value: None -Accept pipeline input: False -Accept wildcard characters: False -``` - -### -WhatIf - -> Applicable: SharePoint Online - -Shows what would happen if the cmdlet runs. The cmdlet isn't run. - -```yaml -Type: System.Management.Automation.SwitchParameter -Parameter Sets: (All) -Aliases: wi - -Required: False -Position: Named -Default value: None -Accept pipeline input: False -Accept wildcard characters: False -``` - -### CommonParameters - -This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). - -## INPUTS - -### None - -## OUTPUTS - -### None - -This cmdlet doesn't return an output object. Use `Get-SPOTenantRestrictedAppAccessControl` to read the resulting tenant policy. - -## NOTES - -- Adds and removes are applied as one atomic update. Removals are applied before additions. -- A bulk add is all-or-none. If any supplied ID is a first-party/core application or can't be classified, no IDs are persisted. -- The combined tenant deny list has a hard maximum of 100 application IDs. -- The administrator supplies IDs only. The backend classifies each added ID and stores it as either a regular application or a parent agent blueprint. -- A parent agent blueprint ID blocks the blueprint application and every current or future agent app created from it. -- Configuration and enablement are orthogonal: list changes never flip the tenant switch. -- Removing the last entry leaves an enabled switch with an empty deny list that denies nothing. The cmdlet warns and points to `Disable-SPOTenantRestrictedAppAccessControl` or `Clear-SPOTenantRestrictedAppAccessControlPolicy`. -- Use `Set-SPOSiteRestrictedAppAccessControlList` to change the lists for an individual site. - -## RELATED LINKS - -[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) - -[Enable-SPOTenantRestrictedAppAccessControl](Enable-SPOTenantRestrictedAppAccessControl.md) - -[Disable-SPOTenantRestrictedAppAccessControl](Disable-SPOTenantRestrictedAppAccessControl.md) - -[Clear-SPOTenantRestrictedAppAccessControlPolicy](Clear-SPOTenantRestrictedAppAccessControlPolicy.md) - -[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) - -[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) +- **Enabled** - whether site enforcement is turned on. Site enforcement is turned on only by `Enable-SPOSiteRestrictedAppAccessControl`. Mode and list changes are configuration-only and preserve the current enablement state. +- **Mode** - the active mode. When the mode is `Allow`, applications in the allow list are allowed and all other governed apps are denied. When the mode is `Deny`, applications in the deny list are denied and all other governed apps are allowed. `Allow` is the default mode when a site is enabled without existing configuration. +- **AllowList** - the persistent list used when the mode is `Allow`. +- **DenyList** - the persistent l From 76943568725d6a969bc3cf2b82040648bec62c59 Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Mon, 12 Oct 2026 14:59:18 -0500 Subject: [PATCH 42/43] Enhance documentation for Get-SPOSiteRestrictedAppAccessControl Expanded documentation for Get-SPOSiteRestrictedAppAccessControl cmdlet, detailing parameters, examples, and output properties. --- .../Get-SPOSiteRestrictedAppAccessControl.md | 131 +++++++++++++++++- 1 file changed, 130 insertions(+), 1 deletion(-) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md index 1eebe4b00..d4b72db47 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md @@ -35,4 +35,133 @@ A site policy has four parts: - **Enabled** - whether site enforcement is turned on. Site enforcement is turned on only by `Enable-SPOSiteRestrictedAppAccessControl`. Mode and list changes are configuration-only and preserve the current enablement state. - **Mode** - the active mode. When the mode is `Allow`, applications in the allow list are allowed and all other governed apps are denied. When the mode is `Deny`, applications in the deny list are denied and all other governed apps are allowed. `Allow` is the default mode when a site is enabled without existing configuration. - **AllowList** - the persistent list used when the mode is `Allow`. -- **DenyList** - the persistent l +- **DenyList** - the persistent list used when the mode is `Deny`. + +Both lists are always stored and can be managed regardless of which mode is active. Only the list selected by the active mode participates in runtime enforcement. The inactive list is preserved for future mode changes and has no runtime effect. An empty active allow list blocks all governed third-party and agentic apps. An empty active deny list allows all governed apps. + +`AllowList` and `DenyList` are returned as GUID arrays. Each list can contain both concrete application IDs and parent agent blueprint IDs, and a blueprint ID applies to the blueprint application itself and to every current or future agent app created from that blueprint. The cmdlet doesn't require you to distinguish between the two: each property merges its internally typed application and blueprint entries into one stable, duplicate-free list of GUIDs. + +This cmdlet performs an uncached read and always returns the authoritative stored policy rather than a cached copy. + +Site enforcement is gated by the tenant switch. While the tenant switch is off, no site policy is enforced, even when a site policy reports `Enabled` as `True`. While the tenant switch is on, the tenant deny list takes precedence and can't be overridden by a site allow list. Use `Get-SPOTenantRestrictedAppAccessControl` to read the tenant switch and the tenant deny list. + +Site App Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. App Restrictions is fully decoupled from site properties, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated App Restrictions cmdlets listed in [Related Links](#related-links). + +You must be at least a SharePoint Administrator to run this cmdlet. + +Microsoft first-party and core applications are excluded from App Restrictions configuration and enforcement and never appear in a site list. + +For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). + +## EXAMPLES + +### Example 1 + +``` +Get-SPOSiteRestrictedAppAccessControl -Identity https://contoso.sharepoint.com/sites/Finance +``` + +This example returns the complete Restricted App Access Control policy for the Finance site, bound by site URL. + +### Example 2 + +``` +Get-SPOSiteRestrictedAppAccessControl -Identity 8a1e30f6-2f52-4b9e-9d1b-2e9f6c1d40aa +``` + +This example returns the same policy for a site bound by site ID. The returned object carries `SiteUrl`, so it identifies its own site even when you don't know the URL. + +### Example 3 + +``` +$policy = Get-SPOSiteRestrictedAppAccessControl -Identity https://contoso.sharepoint.com/sites/Finance +if ($policy.Mode -eq "Allow") { + $policy.AllowList +} else { + $policy.DenyList +} +``` + +This example returns only the list that the active mode enforces. The other list is still stored and preserved, but it has no runtime effect until you change the mode. + +### Example 4 + +``` +$policy = Get-SPOSiteRestrictedAppAccessControl -Identity https://contoso.sharepoint.com/sites/Finance +if ($policy.Enabled -and $policy.Mode -eq "Allow" -and $policy.AllowList.Count -eq 0) { + Write-Host "Enforcement is on with an empty active allow list, which blocks all governed third-party and agentic apps." +} +``` + +This example identifies the state where enforcement is enabled, the active mode is `Allow`, and the active allow list is empty. In that state, all governed third-party and agentic apps are blocked from the site while the tenant switch is on. + +## PARAMETERS + +### -Identity + +> Applicable: SharePoint Online + +Specifies the site to read. You can specify either the site URL or the site ID. + +```yaml +Type: System.String +Parameter Sets: (All) +Aliases: + +Required: True +Position: 0 +Default value: None +Accept pipeline input: True (ByValue) +Accept wildcard characters: False +``` + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### System.String + +## OUTPUTS + +### SPORestrictedAppAccessControlSitePolicy + +Returns an `SPORestrictedAppAccessControlSitePolicy` object with the following properties. + +| Property | Type | Description | +|---|---|---| +| `SiteUrl` | String | The URL of the site the policy belongs to. This property is carried so the returned object identifies its own site, which matters when sites are piped into the cmdlet and when you bound the site by ID. | +| `Enabled` | Boolean | Indicates whether site enforcement is turned on. Site enforcement is also gated by the tenant switch. | +| `Mode` | String | The active mode, `Allow` or `Deny`. Only the list selected by this mode is enforced. | +| `AllowList` | Guid[] | The persistent allow list, returned as one stable, duplicate-free list of application IDs and parent agent blueprint IDs. | +| `DenyList` | Guid[] | The persistent deny list, returned as one stable, duplicate-free list of application IDs and parent agent blueprint IDs. | + +## NOTES + +- Getters return authoritative uncached state. +- When the stored policy data is malformed, the cmdlet emits a warning and the returned object includes `IsPolicyDataMalformed = true`. Healthy output omits that property. +- Both lists are always stored. Only the list selected by the active mode is enforced; the inactive list is preserved and has no runtime effect. +- Each list has a hard maximum of 100 entries, and the two lists combined have a hard maximum of 200 entries. +- A parent agent blueprint ID entry applies to the blueprint application itself and to every current or future agent app created from that blueprint. +- The tenant switch gates all site enforcement. While the tenant switch is on, the tenant deny list can't be overridden by a site allow list. +- Configuration and enablement are orthogonal: mode and list changes never turn enforcement on. The only combination the backend rejects is enabled with mode `None`. +- Use `Get-SPOTenantRestrictedAppAccessControl` to read the tenant-level policy. + +## RELATED LINKS + +[Set-SPOSiteRestrictedAppAccessControlMode](Set-SPOSiteRestrictedAppAccessControlMode.md) + +[Set-SPOSiteRestrictedAppAccessControlList](Set-SPOSiteRestrictedAppAccessControlList.md) + +[Enable-SPOSiteRestrictedAppAccessControl](Enable-SPOSiteRestrictedAppAccessControl.md) + +[Disable-SPOSiteRestrictedAppAccessControl](Disable-SPOSiteRestrictedAppAccessControl.md) + +[Clear-SPOSiteRestrictedAppAccessControlList](Clear-SPOSiteRestrictedAppAccessControlList.md) + +[Clear-SPOSiteRestrictedAppAccessControlPolicy](Clear-SPOSiteRestrictedAppAccessControlPolicy.md) + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) From b4efa3e42f80b8dbaee723144518fa7554990730 Mon Sep 17 00:00:00 2001 From: Neil Hodgkinson Date: Tue, 13 Oct 2026 11:18:06 -0500 Subject: [PATCH 43/43] Address review feedback for Application Restrictions cmdlets Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 68099f8e-14cf-42d5-bb9d-d634bcb30ab6 --- sharepoint/TOC.yml | 2 - ...r-SPOSiteRestrictedAppAccessControlList.md | 36 ++--- ...SPOSiteRestrictedAppAccessControlPolicy.md | 26 ++- ...OTenantRestrictedAppAccessControlPolicy.md | 34 ++-- ...sable-SPOSiteRestrictedAppAccessControl.md | 30 ++-- ...ble-SPOTenantRestrictedAppAccessControl.md | 34 ++-- ...nable-SPOSiteRestrictedAppAccessControl.md | 148 +++++++++++++++--- ...ble-SPOTenantRestrictedAppAccessControl.md | 40 +++-- .../Get-SPOSiteRestrictedAppAccessControl.md | 45 +++--- ...Get-SPOTenantRestrictedAppAccessControl.md | 46 +++--- .../Microsoft.Online.SharePoint.PowerShell.md | 36 +++++ ...t-SPOSiteRestrictedAppAccessControlList.md | 30 ++-- ...t-SPOSiteRestrictedAppAccessControlMode.md | 39 +++-- ...SPOTenantRestrictedAppAccessControlList.md | 36 ++--- 14 files changed, 354 insertions(+), 228 deletions(-) diff --git a/sharepoint/TOC.yml b/sharepoint/TOC.yml index c02991ea8..e66b729f6 100644 --- a/sharepoint/TOC.yml +++ b/sharepoint/TOC.yml @@ -22,7 +22,5 @@ href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrollist.md - name: Set-SPOSiteRestrictedAppAccessControlMode href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrolmode.md -- name: Set-SPOSiteRestrictedAppAccessControlList - href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spositerestrictedappaccesscontrollist.md - name: Set-SPOTenantRestrictedAppAccessControlList href: sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/set-spotenantrestrictedappaccesscontrollist.md diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlList.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlList.md index 1df24ff33..84d66d8fb 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlList.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlList.md @@ -8,7 +8,7 @@ schema: 2.0.0 ms.author: neilh ms.reviewer: neilh description: Clear-SPOSiteRestrictedAppAccessControlList removes all entries from a site's allow or deny list in SharePoint Online. Learn syntax, examples, and parameters. -ms.date: 10/12/2026 +ms.date: 10/13/2026 ms.topic: reference --- @@ -16,24 +16,24 @@ ms.topic: reference ## SYNOPSIS -Removes every entry from one app restrictions list on a site, preserving the other list, the active mode, and site enablement. +Clears a site's Application Restrictions allow or deny list while preserving the other list, active mode, and site enablement. ## SYNTAX -``` +```powershell Clear-SPOSiteRestrictedAppAccessControlList -Identity -ListType [-WhatIf] [-Confirm] [] ``` ## DESCRIPTION -Use the `Clear-SPOSiteRestrictedAppAccessControlList` cmdlet to clear the allow list or the deny list on a single site. Clearing one list always clears it, and preserves the other list, the active mode, and site enablement. To remove both lists and the mode and clear the stored site policy, use `Clear-SPOSiteRestrictedAppAccessControlPolicy` instead. +Use the `Clear-SPOSiteRestrictedAppAccessControlList` cmdlet to clear the allow list or deny list on a single site. Clearing one list preserves the other list, active mode, and site enablement. To remove the complete policy, use `Clear-SPOSiteRestrictedAppAccessControlPolicy`. A site stores both lists, but only the list selected by the active mode participates in enforcement: -- **Allow** mode enforces the allow list. Subjects in the allow list are allowed and all other governed apps are denied. -- **Deny** mode enforces the deny list. Subjects in the deny list are denied and all other governed apps are allowed. +- **Allow** mode enforces the allow list. Listed applications pass the Application Restrictions check, and all other governed applications are denied by the site policy. +- **Deny** mode enforces the deny list. Listed applications are denied by the site policy, and all other governed applications pass the Application Restrictions check. -When the cleared list is the one the active mode enforces, the cmdlet emits a warning before confirmation. Clearing the active allow list means no third-party applications can access the site, because an empty active allow list blocks all governed third-party and agentic apps. Clearing the active deny list means all of them can. The warning also states whether the change takes effect immediately or when enforcement is next enabled. +When the cleared list is the one the active mode enforces, the cmdlet emits a warning before confirmation. Clearing the active allow list causes the site policy to deny all governed third-party and agentic applications. Clearing the active deny list means the site policy no longer denies any governed applications. This warning describes only the Application Restrictions policy decision and never means that an application is granted access. Existing Microsoft Entra consent and SharePoint authorization still apply. The warning also states whether the change takes effect immediately or when enforcement is next enabled. Clearing an inactive list doesn't change current enforcement, but it still supports `-WhatIf` and `-Confirm`, and it's audited. @@ -41,11 +41,9 @@ Configuration and enablement are orthogonal. List changes never turn enforcement The tenant switch gates all site enforcement. A site policy has no effect while the tenant switch is off, and the tenant deny list can't be overridden by a site allow list, so clearing a site deny list never restores access for an application that the tenant denies. -App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions. - -Site App Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. App Restrictions is fully decoupled from `SiteProperties`, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated App Restrictions cmdlets listed in [Related Links](#related-links). +Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and Application Restrictions. -You must be at least a SharePoint Administrator to run this cmdlet. +Site Application Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. Application Restrictions is fully decoupled from `SiteProperties`, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated Application Restrictions cmdlets listed in [Related Links](#related-links). For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). @@ -53,23 +51,23 @@ For permissions and the most current information about Windows PowerShell for Sh ### Example 1 -``` +```powershell Clear-SPOSiteRestrictedAppAccessControlList -Identity "https://contoso.sharepoint.com/sites/Finance" -ListType DenyList ``` -This example clears the deny list on the Finance site. It preserves the allow list, the active mode, and site enablement. If `Deny` is the active mode, the cmdlet warns that clearing the active deny list means all governed third-party applications can access the site. +This example clears the deny list on the Finance site. It preserves the allow list, active mode, and site enablement. If `Deny` is the active mode, the cmdlet warns that the site policy no longer denies governed applications in that list. Existing Microsoft Entra consent and SharePoint authorization still apply. ### Example 2 -``` +```powershell Clear-SPOSiteRestrictedAppAccessControlList -Identity "e1b2c3d4-5678-4abc-9def-0123456789ab" -ListType AllowList -WhatIf ``` -This example identifies the site by site ID and previews clearing the allow list without changing the policy. Every site App Restrictions cmdlet accepts `-Identity` as either a site URL or a site ID. +This example identifies the site by site ID and previews clearing the allow list without changing the policy. Every site Application Restrictions cmdlet accepts `-Identity` as either a site URL or a site ID. ### Example 3 -``` +```powershell $url = "https://contoso.sharepoint.com/sites/Finance" Clear-SPOSiteRestrictedAppAccessControlList -Identity $url -ListType AllowList Set-SPOSiteRestrictedAppAccessControlList -Identity $url -ListType AllowList -AddRestrictedAppIds "11111111-1111-1111-1111-111111111111" @@ -79,7 +77,7 @@ This example rebuilds an allow list from scratch. Because list changes are confi ### Example 4 -``` +```powershell Clear-SPOSiteRestrictedAppAccessControlList -Identity "https://contoso.sharepoint.com/sites/Finance" -ListType DenyList -Confirm:$false ``` @@ -180,11 +178,11 @@ This cmdlet doesn't return an object. Use `Get-SPOSiteRestrictedAppAccessControl ## NOTES - Clearing one list preserves the other list, the active mode, and site enablement. -- Clearing the list that the active mode enforces changes the effective decision for the site: an empty active allow list blocks all governed third-party and agentic apps, and an empty active deny list allows all of them. The cmdlet warns before confirmation and states whether the change takes effect immediately or when enforcement is next enabled. +- Clearing the list that the active mode enforces changes the Application Restrictions policy decision. An empty active allow list causes the site policy to deny all governed third-party and agentic applications. An empty active deny list means the site policy denies none of them. Existing Microsoft Entra consent and SharePoint authorization still apply. The cmdlet warns before confirmation and states whether the change takes effect immediately or when enforcement is next enabled. - Clearing an inactive list doesn't change current enforcement, but the operation still supports `-WhatIf` and `-Confirm` and is audited. - List changes never turn enforcement on. Site enforcement is turned on only by `Enable-SPOSiteRestrictedAppAccessControl`. - The tenant switch gates all site enforcement, so a site policy has no effect while the tenant switch is off. The tenant deny list can't be overridden by a site allow list. -- App Restrictions never grants permissions. A request must still pass existing SharePoint authorization. +- Application Restrictions never grants permissions. A request must still pass existing SharePoint authorization. - This cmdlet supports `-WhatIf` and `-Confirm` with `ConfirmImpact.High`. `-Confirm:$false` is allowed for automation and doesn't bypass validation, authorization, auditing, or first-party protection. ## RELATED LINKS diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlPolicy.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlPolicy.md index ff53fbdcf..a14e16bea 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlPolicy.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOSiteRestrictedAppAccessControlPolicy.md @@ -7,8 +7,8 @@ title: Clear-SPOSiteRestrictedAppAccessControlPolicy schema: 2.0.0 ms.author: neilh ms.reviewer: neilh -description: Clear-SPOSiteRestrictedAppAccessControlPolicy removes a site's App Restrictions policy, disabling enforcement and clearing lists. Learn syntax and examples. -ms.date: 10/12/2026 +description: Clear-SPOSiteRestrictedAppAccessControlPolicy removes a site's Application Restrictions policy, disabling enforcement and clearing lists. Learn syntax and examples. +ms.date: 10/13/2026 ms.topic: reference --- @@ -16,11 +16,11 @@ ms.topic: reference ## SYNOPSIS -Removes the complete app restrictions policy from a site. The cmdlet disables enforcement, and removes the active mode and both lists. +Removes the complete Application Restrictions policy from a site. The cmdlet disables enforcement and removes the active mode and both lists. ## SYNTAX -``` +```powershell Clear-SPOSiteRestrictedAppAccessControlPolicy -Identity [-WhatIf] [-Confirm] [] ``` @@ -34,11 +34,9 @@ Because the mode is removed along with the lists, a cleared site can't be enable Clearing a site policy affects only that site. The tenant switch gates all site enforcement, and the tenant deny list can't be overridden by a site allow list, so clearing a site policy never restores access for an application that the tenant denies. Use `Clear-SPOTenantRestrictedAppAccessControlPolicy` for the tenant scope. -App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions, so clearing a site policy doesn't grant any application access it doesn't already have. - -Site App Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. App Restrictions is fully decoupled from `SiteProperties`, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated App Restrictions cmdlets listed in [Related Links](#related-links). +Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and Application Restrictions, so clearing a site policy doesn't grant any application access it doesn't already have. -You must be at least a SharePoint Administrator to run this cmdlet. +Site Application Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. Application Restrictions is fully decoupled from `SiteProperties`, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated Application Restrictions cmdlets listed in [Related Links](#related-links). For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). @@ -46,23 +44,23 @@ For permissions and the most current information about Windows PowerShell for Sh ### Example 1 -``` +```powershell Clear-SPOSiteRestrictedAppAccessControlPolicy -Identity "https://contoso.sharepoint.com/sites/Finance" ``` -This example removes the complete App Restrictions policy from the Finance site. It disables enforcement and removes the active mode, allow list, and deny list. +This example removes the complete Application Restrictions policy from the Finance site. It disables enforcement and removes the active mode, allow list, and deny list. ### Example 2 -``` +```powershell Clear-SPOSiteRestrictedAppAccessControlPolicy -Identity "e1b2c3d4-5678-4abc-9def-0123456789ab" -WhatIf ``` -This example identifies the site by site ID and previews the change without modifying the policy. Every site App Restrictions cmdlet accepts `-Identity` as either a site URL or a site ID. +This example identifies the site by site ID and previews the change without modifying the policy. Every site Application Restrictions cmdlet accepts `-Identity` as either a site URL or a site ID. ### Example 3 -``` +```powershell $url = "https://contoso.sharepoint.com/sites/Finance" Clear-SPOSiteRestrictedAppAccessControlPolicy -Identity $url -Confirm:$false Set-SPOSiteRestrictedAppAccessControlMode -Identity $url -Mode Deny @@ -149,7 +147,7 @@ This cmdlet doesn't return an object. Use `Get-SPOSiteRestrictedAppAccessControl - To clear only one list, use `Clear-SPOSiteRestrictedAppAccessControlList`, which preserves the other list, the active mode, and site enablement. - After clearing, the site can't be enabled until a mode is set. `Enable-SPOSiteRestrictedAppAccessControl` fails when no mode is set. - The tenant switch gates all site enforcement, so a site policy has no effect while the tenant switch is off. The tenant deny list can't be overridden by a site allow list. -- App Restrictions never grants permissions. A request must still pass existing SharePoint authorization. +- Application Restrictions never grants permissions. A request must still pass existing SharePoint authorization. - This cmdlet supports `-WhatIf` and `-Confirm` with `ConfirmImpact.High`. `-Confirm:$false` is allowed for automation and doesn't bypass validation, authorization, auditing, or first-party protection. ## RELATED LINKS diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOTenantRestrictedAppAccessControlPolicy.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOTenantRestrictedAppAccessControlPolicy.md index a9bedd4f4..c6b166fd6 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOTenantRestrictedAppAccessControlPolicy.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Clear-SPOTenantRestrictedAppAccessControlPolicy.md @@ -7,8 +7,8 @@ title: Clear-SPOTenantRestrictedAppAccessControlPolicy schema: 2.0.0 ms.author: neilh ms.reviewer: neilh -description: Clear-SPOTenantRestrictedAppAccessControlPolicy disables tenant App Restrictions enforcement and clears the deny list. Learn syntax, parameters, and examples. -ms.date: 10/12/2026 +description: Clear-SPOTenantRestrictedAppAccessControlPolicy disables tenant Application Restrictions enforcement and clears the deny list. Learn syntax, parameters, and examples. +ms.date: 10/13/2026 ms.topic: reference --- @@ -16,31 +16,29 @@ ms.topic: reference ## SYNOPSIS -Turns off the tenant App Restrictions enforcement switch and clears the tenant-wide deny list. +Turns off the tenant Application Restrictions enforcement switch and clears the tenant-wide deny list. ## SYNTAX -``` +```powershell Clear-SPOTenantRestrictedAppAccessControlPolicy [-WhatIf] [-Confirm] [] ``` ## DESCRIPTION -Use the `Clear-SPOTenantRestrictedAppAccessControlPolicy` cmdlet to reset the tenant Restricted App Access Control policy. The cmdlet disables the tenant enforcement switch and clears the tenant-wide deny list in one operation. +Use the `Clear-SPOTenantRestrictedAppAccessControlPolicy` cmdlet to reset the tenant Application Restrictions policy. The cmdlet disables the tenant enforcement switch and clears the tenant-wide deny list in one operation. -App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions. +Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and Application Restrictions. -This cmdlet warns that the tenant switch gates all site-level enforcement, so turning it off stops every configured site policy from enforcing, not just the tenant deny list. +The tenant switch gates the tenant deny list and all site-level enforcement. Turning it off stops enforcement for every site policy whose site-level `Enabled` flag is `True`, not only the tenant deny list. The cmdlet warns about this effect before confirmation. -The tenant scope is deny-only with a single list, so there's no separate clear-list cmdlet. Clearing the only list while leaving the switch on would be indistinguishable from the feature being off, so `Clear-SPOTenantRestrictedAppAccessControlPolicy` covers that intent. +The tenant scope is deny-only with a single list, so there's no separate clear-list cmdlet. To empty the deny list while keeping the tenant switch on for enabled site policies, remove its application IDs with `Set-SPOTenantRestrictedAppAccessControlList`. Use `Clear-SPOTenantRestrictedAppAccessControlPolicy` to remove the tenant policy entirely. Use this cmdlet when you want to remove the tenant configuration entirely. If you want to stop enforcement but keep the deny list for later, use `Disable-SPOTenantRestrictedAppAccessControl` instead. If you want to remove only selected application IDs, use `Set-SPOTenantRestrictedAppAccessControlList` with `-RemoveRestrictedAppIds`. Removing IDs doesn't require Microsoft Graph, so stale or deleted applications on the tenant deny list are cleared along with the rest of the list. -Tenant App Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. App Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. - -You must be at least a SharePoint Administrator to run this cmdlet. +Tenant Application Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. Application Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). @@ -48,15 +46,15 @@ For permissions and the most current information about Windows PowerShell for Sh ### Example 1 -``` +```powershell Clear-SPOTenantRestrictedAppAccessControlPolicy ``` -This example turns off the tenant enforcement switch and clears the tenant deny list. The cmdlet warns that the tenant switch gates all site-level enforcement, and then prompts for confirmation. +This example turns off the tenant enforcement switch and clears the tenant deny list. The cmdlet warns that this also stops enforcement for every site policy whose site-level `Enabled` flag is `True`, and then prompts for confirmation. ### Example 2 -``` +```powershell Clear-SPOTenantRestrictedAppAccessControlPolicy -WhatIf ``` @@ -64,13 +62,13 @@ This example shows what would happen if the tenant policy were cleared, without ### Example 3 -``` +```powershell Get-SPOTenantRestrictedAppAccessControl Clear-SPOTenantRestrictedAppAccessControlPolicy -Confirm:$false Get-SPOTenantRestrictedAppAccessControl ``` -This example records the current tenant policy, clears it without prompting for confirmation, and then reads the policy again to confirm that `Enabled` is `False` and that `RestrictedAppIds` is empty. Suppressing the prompt doesn't bypass validation, authorization, or auditing. +This example reads the current tenant policy, clears it without prompting for confirmation, and reads the policy again to confirm that `Enabled` is `False` and `RestrictedAppIds` is empty. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. ## PARAMETERS @@ -78,7 +76,7 @@ This example records the current tenant policy, clears it without prompting for > Applicable: SharePoint Online -Prompts you for confirmation before running the cmdlet. This cmdlet has a confirm impact of High, so it prompts by default. Automation can use `-Confirm:$false` to suppress the prompt. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. ```yaml Type: System.Management.Automation.SwitchParameter @@ -127,7 +125,7 @@ This cmdlet doesn't return an output object. Use `Get-SPOTenantRestrictedAppAcce ## NOTES - This cmdlet disables the tenant switch and clears the tenant deny list. To stop enforcement while preserving the deny list, use `Disable-SPOTenantRestrictedAppAccessControl`. -- The cmdlet warns that the tenant switch gates all site-level enforcement, so turning it off stops every configured site policy from enforcing, not just the tenant deny list. +- The tenant switch gates the tenant deny list and all site-level enforcement. Turning it off stops enforcement for every site policy whose site-level `Enabled` flag is `True`, not only the tenant deny list. The cmdlet warns about this effect before confirmation. - The tenant scope is deny-only with a single list, so there's no separate clear-list cmdlet at tenant scope. - Clearing doesn't call Microsoft Graph, so stale or deleted application IDs are removed with the rest of the list. - This cmdlet doesn't remove site policy configuration. Use `Clear-SPOSiteRestrictedAppAccessControlPolicy` to clear the policy for an individual site. diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOSiteRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOSiteRestrictedAppAccessControl.md index 6eb0bccba..888b050c2 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOSiteRestrictedAppAccessControl.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOSiteRestrictedAppAccessControl.md @@ -7,8 +7,8 @@ title: Disable-SPOSiteRestrictedAppAccessControl schema: 2.0.0 ms.author: neilh ms.reviewer: neilh -description: Learn how to use Disable-SPOSiteRestrictedAppAccessControl in SharePoint Online PowerShell to pause site-level app access enforcement without losing saved settings. -ms.date: 10/12/2026 +description: Learn how to use Disable-SPOSiteRestrictedAppAccessControl to turn off site-level Application Restrictions enforcement without losing saved settings. +ms.date: 10/13/2026 ms.topic: reference --- @@ -16,29 +16,27 @@ ms.topic: reference ## SYNOPSIS -Turns off App Restrictions enforcement for a site while preserving the site's active mode and both lists. +Turns off Application Restrictions enforcement for a site while preserving the active mode and both lists. ## SYNTAX -``` +```powershell Disable-SPOSiteRestrictedAppAccessControl -Identity [-WhatIf] [-Confirm] [] ``` ## DESCRIPTION -Use the `Disable-SPOSiteRestrictedAppAccessControl` cmdlet to turn off App Restrictions enforcement for a single site. The cmdlet disables enforcement while preserving the active mode and both lists. A stored site policy with enforcement disabled keeps its active mode and both lists staged and preserved, so you can re-enable the same configuration later with `Enable-SPOSiteRestrictedAppAccessControl`. +Use the `Disable-SPOSiteRestrictedAppAccessControl` cmdlet to turn off Application Restrictions enforcement for a single site while preserving the active mode and both lists. You can re-enable the same configuration later with `Enable-SPOSiteRestrictedAppAccessControl`. Disabling a site is different from clearing it. To remove the mode and both lists and clear the stored site policy entirely, use `Clear-SPOSiteRestrictedAppAccessControlPolicy`. Configuration and enablement are orthogonal. Mode and list changes never turn enforcement on, so after you disable a site you can continue to stage changes with `Set-SPOSiteRestrictedAppAccessControlMode` and `Set-SPOSiteRestrictedAppAccessControlList` without reactivating enforcement. Site enforcement is turned on only by `Enable-SPOSiteRestrictedAppAccessControl`. -While the site is disabled, no site-level App Restrictions decision applies to requests for that site. Tenant-level policy is unaffected: the tenant switch gates all site enforcement, and the tenant deny list can't be overridden by a site allow list. - -App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions, so disabling a site policy doesn't grant any application access it doesn't already have. +While the site is disabled, no site-level Application Restrictions decision applies to requests for that site. Tenant-level policy is unaffected: the tenant switch gates all site enforcement, and the tenant deny list can't be overridden by a site allow list. -Site App Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. App Restrictions is fully decoupled from `SiteProperties`, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated App Restrictions cmdlets listed in [Related Links](#related-links). +Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and Application Restrictions, so disabling a site policy doesn't grant any application access it doesn't already have. -You must be at least a SharePoint Administrator to run this cmdlet. +Site Application Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. Application Restrictions is fully decoupled from `SiteProperties`, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated Application Restrictions cmdlets listed in [Related Links](#related-links). For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). @@ -46,23 +44,23 @@ For permissions and the most current information about Windows PowerShell for Sh ### Example 1 -``` +```powershell Disable-SPOSiteRestrictedAppAccessControl -Identity "https://contoso.sharepoint.com/sites/Finance" ``` -This example turns off App Restrictions enforcement for the Finance site. The site's active mode, allow list, and deny list are preserved. +This example turns off Application Restrictions enforcement for the Finance site. The active mode, allow list, and deny list are preserved. ### Example 2 -``` +```powershell Disable-SPOSiteRestrictedAppAccessControl -Identity "e1b2c3d4-5678-4abc-9def-0123456789ab" -WhatIf ``` -This example uses a site ID and shows what would happen without changing the policy. Every site App Restrictions cmdlet accepts `-Identity` as either a site URL or a site ID. +This example uses a site ID and shows what would happen without changing the policy. Every site Application Restrictions cmdlet accepts `-Identity` as either a site URL or a site ID. ### Example 3 -``` +```powershell $url = "https://contoso.sharepoint.com/sites/Finance" Disable-SPOSiteRestrictedAppAccessControl -Identity $url -Confirm:$false Get-SPOSiteRestrictedAppAccessControl -Identity $url @@ -145,7 +143,7 @@ This cmdlet doesn't return an object. Use `Get-SPOSiteRestrictedAppAccessControl - Disabling preserves the active mode and both lists. Use `Clear-SPOSiteRestrictedAppAccessControlPolicy` to remove the mode and lists and clear the stored site policy. - Site enforcement is turned on again only by `Enable-SPOSiteRestrictedAppAccessControl`. Mode and list changes never turn enforcement on. - The tenant switch gates all site enforcement, so a site policy has no effect while the tenant switch is off. The tenant deny list can't be overridden by a site allow list. -- App Restrictions never grants permissions. A request must still pass existing SharePoint authorization. +- Application Restrictions never grants permissions. A request must still pass existing SharePoint authorization. - This cmdlet supports `-WhatIf` and `-Confirm` with `ConfirmImpact.High`. `-Confirm:$false` is allowed for automation and doesn't bypass validation, authorization, auditing, or first-party protection. ## RELATED LINKS diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOTenantRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOTenantRestrictedAppAccessControl.md index ae5aa2426..383a5fb84 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOTenantRestrictedAppAccessControl.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Disable-SPOTenantRestrictedAppAccessControl.md @@ -7,8 +7,8 @@ title: Disable-SPOTenantRestrictedAppAccessControl schema: 2.0.0 ms.author: neilh ms.reviewer: neilh -description: Disable-SPOTenantRestrictedAppAccessControl turns off tenant-wide App Restrictions enforcement while keeping your deny list intact. Learn the syntax and examples. -ms.date: 10/12/2026 +description: Disable-SPOTenantRestrictedAppAccessControl turns off tenant-wide Application Restrictions enforcement while keeping your deny list intact. Learn the syntax and examples. +ms.date: 10/13/2026 ms.topic: reference --- @@ -16,21 +16,21 @@ ms.topic: reference ## SYNOPSIS -Turns off the tenant App Restrictions enforcement switch, while preserving the tenant deny list. +Turns off the tenant Application Restrictions enforcement switch while preserving the tenant deny list. ## SYNTAX -``` +```powershell Disable-SPOTenantRestrictedAppAccessControl [-WhatIf] [-Confirm] [] ``` ## DESCRIPTION -Use the `Disable-SPOTenantRestrictedAppAccessControl` cmdlet to turn off the tenant enforcement switch for App Restrictions without discarding your configuration. +Use the `Disable-SPOTenantRestrictedAppAccessControl` cmdlet to turn off the tenant enforcement switch for Application Restrictions without discarding your configuration. -App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions. +Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and Application Restrictions. -The tenant switch is the master enforcement switch for the feature. This cmdlet warns that the tenant switch gates all site-level enforcement, so turning it off stops every configured site policy from enforcing, not just the tenant deny list. +The tenant switch is the master enforcement switch for Application Restrictions. It gates the tenant deny list and all site-level enforcement. Turning it off stops enforcement for every site policy whose site-level `Enabled` flag is `True`, not only the tenant deny list. The cmdlet warns about this effect before confirmation. The tenant deny list is preserved. Stored tenant and site configuration remains in place, so enforcement resumes with the same configuration when you run `Enable-SPOTenantRestrictedAppAccessControl` again. If you want to disable the switch *and* clear the tenant deny list, use `Clear-SPOTenantRestrictedAppAccessControlPolicy` instead. @@ -38,9 +38,7 @@ Configuration and enablement are orthogonal: this cmdlet changes only the switch The tenant scope is deny-only and has a single list, so there's no mode cmdlet and no `-ListType` parameter at tenant scope. -Tenant App Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. App Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. - -You must be at least a SharePoint Administrator to run this cmdlet. +Tenant Application Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. Application Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). @@ -48,15 +46,15 @@ For permissions and the most current information about Windows PowerShell for Sh ### Example 1 -``` +```powershell Disable-SPOTenantRestrictedAppAccessControl ``` -This example turns off the tenant enforcement switch and preserves the tenant deny list. The cmdlet warns that the tenant switch gates all site-level enforcement, and then prompts for confirmation. +This example turns off the tenant enforcement switch and preserves the tenant deny list. The cmdlet warns that this also stops enforcement for every site policy whose site-level `Enabled` flag is `True`, and then prompts for confirmation. ### Example 2 -``` +```powershell Disable-SPOTenantRestrictedAppAccessControl -WhatIf ``` @@ -64,12 +62,12 @@ This example shows what would happen if the tenant switch were turned off, witho ### Example 3 -``` +```powershell Disable-SPOTenantRestrictedAppAccessControl -Confirm:$false Get-SPOTenantRestrictedAppAccessControl ``` -This example turns off the tenant switch without prompting, which is useful in automation, and then reads the tenant policy to confirm that `Enabled` is `False` and that `RestrictedAppIds` still contains the preserved deny list. Suppressing the prompt doesn't bypass validation, authorization, or auditing. +This example turns off the tenant switch without prompting, which is useful in automation, and then reads the tenant policy to confirm that `Enabled` is `False` and that `RestrictedAppIds` still contains the preserved deny list. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. ## PARAMETERS @@ -77,7 +75,7 @@ This example turns off the tenant switch without prompting, which is useful in a > Applicable: SharePoint Online -Prompts you for confirmation before running the cmdlet. This cmdlet has a confirm impact of High, so it prompts by default. Automation can use `-Confirm:$false` to suppress the prompt. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. ```yaml Type: System.Management.Automation.SwitchParameter @@ -125,8 +123,8 @@ This cmdlet doesn't return an output object. Use `Get-SPOTenantRestrictedAppAcce ## NOTES -- The cmdlet warns that the tenant switch gates all site-level enforcement, so turning it off stops every configured site policy from enforcing, not just the tenant deny list. -- The tenant deny list is preserved, and stored tenant and site configuration is preserved, so enforcement resumes with the same configuration when the switch is turned on again. +- The tenant switch gates the tenant deny list and all site-level enforcement. Turning it off stops enforcement for every site policy whose site-level `Enabled` flag is `True`, not only the tenant deny list. +- The tenant deny list and all stored tenant and site configuration are preserved. Enforcement resumes with the same configuration when the switch is turned on again. - Configuration and enablement are orthogonal: this cmdlet doesn't change the deny list. - To disable the switch and clear the tenant deny list in one operation, use `Clear-SPOTenantRestrictedAppAccessControlPolicy`. - Use `Disable-SPOSiteRestrictedAppAccessControl` to turn off enforcement for an individual site. diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOSiteRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOSiteRestrictedAppAccessControl.md index 31bb1b26f..5cad468fd 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOSiteRestrictedAppAccessControl.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOSiteRestrictedAppAccessControl.md @@ -7,8 +7,8 @@ title: Enable-SPOSiteRestrictedAppAccessControl schema: 2.0.0 ms.author: neilh ms.reviewer: neilh -description: Enable-SPOSiteRestrictedAppAccessControl turns on App Restrictions enforcement for a SharePoint site using its existing mode and lists. Learn syntax and examples. -ms.date: 10/12/2026 +description: Enable-SPOSiteRestrictedAppAccessControl turns on Application Restrictions enforcement for a SharePoint site using its configured mode and lists. Learn syntax and examples. +ms.date: 10/13/2026 ms.topic: reference --- @@ -16,36 +16,34 @@ ms.topic: reference ## SYNOPSIS -Turns on App Restrictions enforcement for a site, using the mode and lists that are already configured on that site. +Turns on Application Restrictions enforcement for a site using its configured mode and lists. ## SYNTAX -``` +```powershell Enable-SPOSiteRestrictedAppAccessControl -Identity [-WhatIf] [-Confirm] [] ``` ## DESCRIPTION -Use the `Enable-SPOSiteRestrictedAppAccessControl` cmdlet to turn on App Restrictions enforcement for a single site. The cmdlet enables enforcement using the mode and lists that are already configured on the site, and it fails when no mode is set. The only combination that the backend rejects is enabled with mode `None`. +Use the `Enable-SPOSiteRestrictedAppAccessControl` cmdlet to turn on Application Restrictions enforcement for a single site. A mode must already be configured with `Set-SPOSiteRestrictedAppAccessControlMode`; the cmdlet fails when no mode is set. -Site enforcement is turned on only by this cmdlet. Configuration and enablement are orthogonal: mode and list changes never turn enforcement on, so an administrator can stage a policy with `Set-SPOSiteRestrictedAppAccessControlMode` and `Set-SPOSiteRestrictedAppAccessControlList` and then enable it explicitly. This avoids the dangerous case where adding a single ID to an unconfigured site would immediately activate an allow list and block every other application. +Site enforcement is turned on only by this cmdlet. Configuration and enablement are independent: mode and list changes never turn enforcement on. An administrator can stage a policy with `Set-SPOSiteRestrictedAppAccessControlMode` and `Set-SPOSiteRestrictedAppAccessControlList` and then enable it explicitly. -The active mode determines what enforcement does once the site is enabled: +The active mode determines the site policy decision: -- **Allow** - subjects in the allow list are allowed and all other governed apps are denied. `Allow` is the default mode when a site is enabled without existing configuration. An empty active allow list blocks all governed third-party and agentic apps. -- **Deny** - subjects in the deny list are denied and all other governed apps are allowed. +- **Allow** - applications in the allow list pass the Application Restrictions check, and all other governed applications are denied by the site policy. An empty active allow list causes the site policy to deny all governed third-party and agentic applications. +- **Deny** - applications in the deny list are denied by the site policy, and all other governed applications pass the Application Restrictions check. The inactive list is preserved and has no runtime effect. The tenant switch gates all site enforcement. A site policy has no effect while the tenant switch is off, and the tenant deny list can't be overridden by a site allow list. Use `Get-SPOTenantRestrictedAppAccessControl` to confirm the tenant switch before you rely on a site policy. -App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions. - -Site App Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. App Restrictions is fully decoupled from `SiteProperties`, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated App Restrictions cmdlets listed in [Related Links](#related-links). +Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Microsoft Entra consent. A request must pass both the existing permission model and Application Restrictions. -You must be at least a SharePoint Administrator to run this cmdlet. +Site Application Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. Application Restrictions is fully decoupled from `SiteProperties`, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated Application Restrictions cmdlets listed in [Related Links](#related-links). -Microsoft first-party and core applications are excluded from App Restrictions configuration and enforcement. +Microsoft first-party and core applications are excluded from Application Restrictions configuration and enforcement. For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). @@ -53,21 +51,133 @@ For permissions and the most current information about Windows PowerShell for Sh ### Example 1 -``` +```powershell Enable-SPOSiteRestrictedAppAccessControl -Identity "https://contoso.sharepoint.com/sites/Finance" ``` -This example turns on App Restrictions enforcement for the Finance site by using its site URL. Enforcement uses the mode and lists that are already configured on the site. +This example turns on Application Restrictions enforcement for the Finance site identified by its URL. Enforcement uses the mode and lists that are already configured on the site. ### Example 2 -``` +```powershell Enable-SPOSiteRestrictedAppAccessControl -Identity "e1b2c3d4-5678-4abc-9def-0123456789ab" ``` -This example turns on enforcement for the same site by using its site ID. Every site App Restrictions cmdlet accepts `-Identity` as either a site URL or a site ID. +This example turns on enforcement for a site identified by its ID. Every site Application Restrictions cmdlet accepts `-Identity` as either a site URL or a site ID. ### Example 3 +```powershell +$url = "https://contoso.sharepoint.com/sites/Finance" +Set-SPOSiteRestrictedAppAccessControlMode -Identity $url -Mode Allow +Set-SPOSiteRestrictedAppAccessControlList -Identity $url -ListType AllowList -AddRestrictedAppIds "11111111-1111-1111-1111-111111111111" +Enable-SPOSiteRestrictedAppAccessControl -Identity $url +``` + +This example configures a mode and allow list and then enables the policy explicitly. The mode and list changes don't turn enforcement on, so nothing is enforced until the final command runs. Applications in the allow list pass the Application Restrictions check; all other governed applications are denied by the site policy. Existing Microsoft Entra consent and SharePoint authorization still apply. + +### Example 4 + +```powershell +Enable-SPOSiteRestrictedAppAccessControl -Identity "https://contoso.sharepoint.com/sites/Finance" -Confirm:$false +``` + +This example turns on enforcement without an interactive confirmation prompt, for use in automation. Using `-Confirm:$false` doesn't bypass validation, authorization, auditing, or first-party protection. + +## PARAMETERS + +### -Identity + +> Applicable: SharePoint Online + +Specifies the site to enable. Provide either the site URL or the site ID. + +```yaml +Type: System.String +Parameter Sets: (All) +Aliases: + +Required: True +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -Confirm + +> Applicable: SharePoint Online + +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: cf + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False +``` + +### -WhatIf + +> Applicable: SharePoint Online + +Shows what would happen if the cmdlet runs. The cmdlet isn't run. + +```yaml +Type: System.Management.Automation.SwitchParameter +Parameter Sets: (All) +Aliases: wi + +Required: False +Position: Named +Default value: None +Accept pipeline input: False +Accept wildcard characters: False ``` -$url = "https://contoso.sharepoint. + +### CommonParameters + +This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVariable`, `-InformationAction`, `-InformationVariable`, `-OutVariable`, `-OutBuffer`, `-PipelineVariable`, `-Verbose`, `-WarningAction`, and `-WarningVariable`. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). + +## INPUTS + +### None + +## OUTPUTS + +### None + +This cmdlet doesn't return an object. Use `Get-SPOSiteRestrictedAppAccessControl` to read the resulting policy. + +## NOTES + +- This cmdlet fails when no mode is configured on the site. Set the mode to `Allow` or `Deny` before enabling the policy. +- Site enforcement is turned on only by this cmdlet. Mode and list changes preserve the current enablement state. +- An empty active allow list causes the site policy to deny all governed third-party and agentic applications. Review the active list with `Get-SPOSiteRestrictedAppAccessControl` before you enable a site. +- In `Deny` mode, applications represented in the deny list are denied by the site policy. All other governed applications pass the Application Restrictions check. +- The tenant switch gates all site enforcement, so a site policy has no effect while the tenant switch is off. The tenant deny list can't be overridden by a site allow list. +- Application Restrictions never grants permissions. A request must still pass existing SharePoint authorization. +- This cmdlet supports `-WhatIf` and `-Confirm` with `ConfirmImpact.High`. `-Confirm:$false` is allowed for automation and doesn't bypass validation, authorization, auditing, or first-party protection. + +## RELATED LINKS + +[Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) + +[Set-SPOSiteRestrictedAppAccessControlMode](Set-SPOSiteRestrictedAppAccessControlMode.md) + +[Set-SPOSiteRestrictedAppAccessControlList](Set-SPOSiteRestrictedAppAccessControlList.md) + +[Disable-SPOSiteRestrictedAppAccessControl](Disable-SPOSiteRestrictedAppAccessControl.md) + +[Clear-SPOSiteRestrictedAppAccessControlList](Clear-SPOSiteRestrictedAppAccessControlList.md) + +[Clear-SPOSiteRestrictedAppAccessControlPolicy](Clear-SPOSiteRestrictedAppAccessControlPolicy.md) + +[Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) + +[Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell) diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOTenantRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOTenantRestrictedAppAccessControl.md index 88c6e7da0..1496c621b 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOTenantRestrictedAppAccessControl.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Enable-SPOTenantRestrictedAppAccessControl.md @@ -7,8 +7,8 @@ title: Enable-SPOTenantRestrictedAppAccessControl schema: 2.0.0 ms.author: neilh ms.reviewer: neilh -description: Learn how to use Enable-SPOTenantRestrictedAppAccessControl to activate the master enforcement switch for App Restrictions across your SharePoint Online tenant. -ms.date: 10/12/2026 +description: Learn how to use Enable-SPOTenantRestrictedAppAccessControl to activate the master enforcement switch for Application Restrictions across your SharePoint Online tenant. +ms.date: 10/13/2026 ms.topic: reference --- @@ -16,21 +16,21 @@ ms.topic: reference ## SYNOPSIS -Turns on the tenant App Restrictions enforcement switch for your organization. +Turns on the tenant Application Restrictions enforcement switch for your organization. ## SYNTAX -``` +```powershell Enable-SPOTenantRestrictedAppAccessControl [-WhatIf] [-Confirm] [] ``` ## DESCRIPTION -Use the `Enable-SPOTenantRestrictedAppAccessControl` cmdlet to turn on the tenant enforcement switch for Restricted App Access Control. +Use the `Enable-SPOTenantRestrictedAppAccessControl` cmdlet to turn on the tenant enforcement switch for Application Restrictions. -App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions. +Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and Application Restrictions. -The tenant switch is the master enforcement switch for the feature. While it's off, no App Restrictions policy is enforced, including the tenant deny list and every configured site policy. This cmdlet warns that enforcement begins tenant-wide, including all configured site policies. Review the stored tenant deny list with `Get-SPOTenantRestrictedAppAccessControl` and review your site policies before you enable the switch. +The tenant switch is the master enforcement switch for Application Restrictions. While it's off, the tenant deny list isn't enforced, and no site-level policy is enforced. Turning on the switch starts tenant deny-list enforcement and site-level enforcement only for site policies whose site-level `Enabled` flag is `True`. Disabled site policies don't begin enforcing. Review the stored tenant deny list with `Get-SPOTenantRestrictedAppAccessControl` and review enabled site policies before you enable the switch. Enabling the switch doesn't change the stored deny list. Configuration and enablement are orthogonal: this cmdlet changes only the switch, and list changes made with `Set-SPOTenantRestrictedAppAccessControlList` never flip the switch. Enforcement resumes with the configuration that was preserved while the switch was off. @@ -38,9 +38,7 @@ An enabled switch with an empty tenant deny list is a valid state, but the tenan The tenant scope is deny-only and has a single list, so there's no mode cmdlet and no `-ListType` parameter at tenant scope. -Tenant App Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. App Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. - -You must be at least a SharePoint Administrator to run this cmdlet. +Tenant Application Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. Application Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). @@ -48,24 +46,24 @@ For permissions and the most current information about Windows PowerShell for Sh ### Example 1 -``` +```powershell Enable-SPOTenantRestrictedAppAccessControl ``` -This example turns on the tenant enforcement switch. The cmdlet warns that enforcement begins tenant-wide, including all configured site policies, and then prompts for confirmation. +This example turns on the tenant enforcement switch. Tenant deny-list enforcement starts, along with site-level enforcement for site policies whose site-level `Enabled` flag is `True`. Disabled site policies don't begin enforcing. The cmdlet warns about this effect and then prompts for confirmation. ### Example 2 -``` +```powershell Get-SPOTenantRestrictedAppAccessControl Enable-SPOTenantRestrictedAppAccessControl ``` -This example reviews the stored tenant policy first, so you can see which application IDs are on the deny list, and then turns on enforcement. +This example reviews the stored tenant policy first so you can see which application IDs are on the deny list, and then turns on enforcement. Site-level enforcement starts only for site policies whose site-level `Enabled` flag is `True`. ### Example 3 -``` +```powershell Enable-SPOTenantRestrictedAppAccessControl -WhatIf ``` @@ -73,11 +71,11 @@ This example shows what would happen if the tenant switch were turned on, withou ### Example 4 -``` +```powershell Enable-SPOTenantRestrictedAppAccessControl -Confirm:$false ``` -This example turns on the tenant switch without prompting for confirmation, which is useful in automation. Suppressing the prompt doesn't bypass validation, authorization, or auditing. +This example turns on the tenant switch without prompting for confirmation, which is useful in automation. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. ## PARAMETERS @@ -85,7 +83,7 @@ This example turns on the tenant switch without prompting for confirmation, whic > Applicable: SharePoint Online -Prompts you for confirmation before running the cmdlet. This cmdlet has a confirm impact of High, so it prompts by default. Automation can use `-Confirm:$false` to suppress the prompt. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. ```yaml Type: System.Management.Automation.SwitchParameter @@ -133,11 +131,11 @@ This cmdlet doesn't return an output object. Use `Get-SPOTenantRestrictedAppAcce ## NOTES -- The cmdlet warns that enforcement begins tenant-wide, including all configured site policies. -- The tenant switch is the master enforcement switch. While it's off, no App Restrictions policy is enforced, including the tenant deny list and all site policies. +- Turning on the tenant switch starts tenant deny-list enforcement and site-level enforcement only for site policies whose site-level `Enabled` flag is `True`. Disabled site policies don't begin enforcing. +- The tenant switch is the master enforcement switch. While it's off, the tenant deny list and all site-level policies aren't enforced. - Enabling the switch doesn't change the stored deny list. Configuration and enablement are orthogonal. - An enabled switch with an empty deny list is allowed, but the tenant deny list denies nothing until an application ID is added. -- Microsoft first-party and core applications are excluded from App Restrictions configuration and enforcement. +- Microsoft first-party and core applications are excluded from Application Restrictions configuration and enforcement. - Use `Enable-SPOSiteRestrictedAppAccessControl` to turn on enforcement for an individual site. ## RELATED LINKS diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md index d4b72db47..2a4a1fdf5 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSiteRestrictedAppAccessControl.md @@ -7,8 +7,8 @@ title: Get-SPOSiteRestrictedAppAccessControl schema: 2.0.0 ms.author: neilh ms.reviewer: neilh -description: Learn how to use Get-SPOSiteRestrictedAppAccessControl to read a SharePoint site's App Restrictions policy and check enforcement status with PowerShell. -ms.date: 10/12/2026 +description: Learn how to use Get-SPOSiteRestrictedAppAccessControl to read a SharePoint site's Application Restrictions policy and check enforcement status with PowerShell. +ms.date: 10/13/2026 ms.topic: reference --- @@ -16,28 +16,28 @@ ms.topic: reference ## SYNOPSIS -Returns the complete site-level App Restrictions policy for a site, including enablement, active mode, and both the allow list and the deny list. +Returns the complete site-level Application Restrictions policy for a site, including enablement, active mode, and both the allow list and the deny list. ## SYNTAX -``` +```powershell Get-SPOSiteRestrictedAppAccessControl [-Identity] [] ``` ## DESCRIPTION -Use the `Get-SPOSiteRestrictedAppAccessControl` cmdlet to read the complete Restricted App Access Control policy stored for a single site. +Use the `Get-SPOSiteRestrictedAppAccessControl` cmdlet to read the complete Application Restrictions policy stored for a single site. -App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions. +Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and Application Restrictions. A site policy has four parts: - **Enabled** - whether site enforcement is turned on. Site enforcement is turned on only by `Enable-SPOSiteRestrictedAppAccessControl`. Mode and list changes are configuration-only and preserve the current enablement state. -- **Mode** - the active mode. When the mode is `Allow`, applications in the allow list are allowed and all other governed apps are denied. When the mode is `Deny`, applications in the deny list are denied and all other governed apps are allowed. `Allow` is the default mode when a site is enabled without existing configuration. +- **Mode** - the active mode. When the mode is `Allow`, applications in the allow list pass the Application Restrictions check and all other governed applications are denied by the site policy. When the mode is `Deny`, applications in the deny list are denied by the site policy and all other governed applications pass the Application Restrictions check. A mode must be explicitly configured before the site policy can be enabled. - **AllowList** - the persistent list used when the mode is `Allow`. - **DenyList** - the persistent list used when the mode is `Deny`. -Both lists are always stored and can be managed regardless of which mode is active. Only the list selected by the active mode participates in runtime enforcement. The inactive list is preserved for future mode changes and has no runtime effect. An empty active allow list blocks all governed third-party and agentic apps. An empty active deny list allows all governed apps. +Both lists are always stored and can be managed regardless of which mode is active. Only the list selected by the active mode participates in runtime enforcement. The inactive list is preserved for future mode changes and has no runtime effect. An empty active allow list causes the site policy to deny all governed third-party and agentic applications. An empty active deny list means the site policy denies none of them. Existing Microsoft Entra consent and SharePoint authorization still apply. `AllowList` and `DenyList` are returned as GUID arrays. Each list can contain both concrete application IDs and parent agent blueprint IDs, and a blueprint ID applies to the blueprint application itself and to every current or future agent app created from that blueprint. The cmdlet doesn't require you to distinguish between the two: each property merges its internally typed application and blueprint entries into one stable, duplicate-free list of GUIDs. @@ -45,11 +45,9 @@ This cmdlet performs an uncached read and always returns the authoritative store Site enforcement is gated by the tenant switch. While the tenant switch is off, no site policy is enforced, even when a site policy reports `Enabled` as `True`. While the tenant switch is on, the tenant deny list takes precedence and can't be overridden by a site allow list. Use `Get-SPOTenantRestrictedAppAccessControl` to read the tenant switch and the tenant deny list. -Site App Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. App Restrictions is fully decoupled from site properties, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated App Restrictions cmdlets listed in [Related Links](#related-links). - -You must be at least a SharePoint Administrator to run this cmdlet. +Site Application Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. Application Restrictions is fully decoupled from site properties, so `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated Application Restrictions cmdlets listed in [Related Links](#related-links). -Microsoft first-party and core applications are excluded from App Restrictions configuration and enforcement and never appear in a site list. +Microsoft first-party and core applications are excluded from Application Restrictions configuration and enforcement and never appear in a site list. For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). @@ -57,23 +55,23 @@ For permissions and the most current information about Windows PowerShell for Sh ### Example 1 -``` +```powershell Get-SPOSiteRestrictedAppAccessControl -Identity https://contoso.sharepoint.com/sites/Finance ``` -This example returns the complete Restricted App Access Control policy for the Finance site, bound by site URL. +This example returns the complete Application Restrictions policy for the Finance site identified by its URL. The returned object includes `SiteUrl`. ### Example 2 -``` +```powershell Get-SPOSiteRestrictedAppAccessControl -Identity 8a1e30f6-2f52-4b9e-9d1b-2e9f6c1d40aa ``` -This example returns the same policy for a site bound by site ID. The returned object carries `SiteUrl`, so it identifies its own site even when you don't know the URL. +This example returns the same policy for a site identified by its ID. The returned object includes `SiteUrl`, so the result remains identifiable even when the input is a site ID. ### Example 3 -``` +```powershell $policy = Get-SPOSiteRestrictedAppAccessControl -Identity https://contoso.sharepoint.com/sites/Finance if ($policy.Mode -eq "Allow") { $policy.AllowList @@ -86,14 +84,15 @@ This example returns only the list that the active mode enforces. The other list ### Example 4 -``` +```powershell +$tenantPolicy = Get-SPOTenantRestrictedAppAccessControl $policy = Get-SPOSiteRestrictedAppAccessControl -Identity https://contoso.sharepoint.com/sites/Finance -if ($policy.Enabled -and $policy.Mode -eq "Allow" -and $policy.AllowList.Count -eq 0) { +if ($tenantPolicy.Enabled -and $policy.Enabled -and $policy.Mode -eq "Allow" -and $policy.AllowList.Count -eq 0) { Write-Host "Enforcement is on with an empty active allow list, which blocks all governed third-party and agentic apps." } ``` -This example identifies the state where enforcement is enabled, the active mode is `Allow`, and the active allow list is empty. In that state, all governed third-party and agentic apps are blocked from the site while the tenant switch is on. +This example identifies the state where the tenant switch and site policy are enabled, the active mode is `Allow`, and the active allow list is empty. In that state, the site policy blocks all governed third-party and agentic apps. ## PARAMETERS @@ -131,7 +130,7 @@ Returns an `SPORestrictedAppAccessControlSitePolicy` object with the following p | Property | Type | Description | |---|---|---| -| `SiteUrl` | String | The URL of the site the policy belongs to. This property is carried so the returned object identifies its own site, which matters when sites are piped into the cmdlet and when you bound the site by ID. | +| `SiteUrl` | String | The URL of the site the policy belongs to. This property keeps results identifiable when sites are piped into the cmdlet or when the input is a site ID. | | `Enabled` | Boolean | Indicates whether site enforcement is turned on. Site enforcement is also gated by the tenant switch. | | `Mode` | String | The active mode, `Allow` or `Deny`. Only the list selected by this mode is enforced. | | `AllowList` | Guid[] | The persistent allow list, returned as one stable, duplicate-free list of application IDs and parent agent blueprint IDs. | @@ -139,13 +138,13 @@ Returns an `SPORestrictedAppAccessControlSitePolicy` object with the following p ## NOTES -- Getters return authoritative uncached state. +- This cmdlet returns the authoritative, uncached policy state. - When the stored policy data is malformed, the cmdlet emits a warning and the returned object includes `IsPolicyDataMalformed = true`. Healthy output omits that property. - Both lists are always stored. Only the list selected by the active mode is enforced; the inactive list is preserved and has no runtime effect. - Each list has a hard maximum of 100 entries, and the two lists combined have a hard maximum of 200 entries. - A parent agent blueprint ID entry applies to the blueprint application itself and to every current or future agent app created from that blueprint. - The tenant switch gates all site enforcement. While the tenant switch is on, the tenant deny list can't be overridden by a site allow list. -- Configuration and enablement are orthogonal: mode and list changes never turn enforcement on. The only combination the backend rejects is enabled with mode `None`. +- Configuration and enablement are orthogonal: mode and list changes never turn enforcement on. A mode must be explicitly configured before `Enable-SPOSiteRestrictedAppAccessControl` succeeds. - Use `Get-SPOTenantRestrictedAppAccessControl` to read the tenant-level policy. ## RELATED LINKS diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOTenantRestrictedAppAccessControl.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOTenantRestrictedAppAccessControl.md index 80d797991..27b645bfe 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOTenantRestrictedAppAccessControl.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOTenantRestrictedAppAccessControl.md @@ -7,8 +7,8 @@ title: Get-SPOTenantRestrictedAppAccessControl schema: 2.0.0 ms.author: neilh ms.reviewer: neilh -description: Get-SPOTenantRestrictedAppAccessControl retrieves your tenant's App Restrictions policy, including enforcement status and the deny list. Learn how. -ms.date: 10/12/2026 +description: Get-SPOTenantRestrictedAppAccessControl retrieves the tenant Application Restrictions enforcement status and deny list. +ms.date: 10/13/2026 ms.topic: reference --- @@ -16,34 +16,32 @@ ms.topic: reference ## SYNOPSIS -Returns the tenant-level App Restrictions policy, including the tenant enforcement switch and the tenant-wide deny list of restricted application IDs. +Returns the tenant-level Application Restrictions policy, including the tenant enforcement switch and the tenant-wide deny list of restricted application IDs. ## SYNTAX -``` +```powershell Get-SPOTenantRestrictedAppAccessControl [] ``` ## DESCRIPTION -Use the `Get-SPOTenantRestrictedAppAccessControl` cmdlet to read the complete tenant Restricted App Access Control policy for your organization. +Use the `Get-SPOTenantRestrictedAppAccessControl` cmdlet to read the complete tenant Application Restrictions policy for your organization. -App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions. +Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and Application Restrictions. The tenant policy has two parts: -- **Enabled** - the master enforcement switch for App Restrictions. When this switch is off, no App Restrictions policy is enforced, including the tenant deny list and any site-level policies. Stored tenant and site configuration is preserved, so enforcement resumes with the same configuration when the switch is turned on again. -- **RestrictedAppIds** - the tenant-wide emergency deny list. When the switch is on, applications in this list are denied and the list can't be overridden by a site-level allow list. - -The tenant deny list can contain both concrete application IDs and parent agent blueprint IDs. A blueprint ID applies to the blueprint application itself and to every current or future agent app created from that blueprint. The cmdlet doesn't require you to distinguish between the two: `RestrictedAppIds` merges the internally typed entries into one stable, duplicate-free list of GUIDs. IDs are stored as lowercase canonical GUID strings and sorted, so output is stable between calls. +- **Enabled** - the master enforcement switch for Application Restrictions. When this switch is off, the tenant deny list and all site-level policies aren't enforced. Stored tenant and site configuration is preserved. When the switch is turned on again, the tenant deny list and site policies whose site-level `Enabled` flag is `True` resume enforcement with the same configuration. +- **RestrictedAppIds** - the tenant-wide deny list. When the switch is on, applications in this list are denied and the list can't be overridden by a site-level allow list. -This cmdlet performs an uncached read and always returns the authoritative, latest stored policy rather than a cached copy. +The tenant deny list can contain both concrete application IDs and parent agent blueprint IDs. A blueprint ID applies to the blueprint application itself and to every current or future agent app created from that blueprint. The cmdlet doesn't require you to distinguish between the two: `RestrictedAppIds` merges the internally typed entries into one stable, duplicate-free `Guid[]`. -Tenant App Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. App Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. Use the dedicated App Restrictions cmdlets listed in [Related Links](#related-links). +This cmdlet returns the authoritative, uncached policy state. -You must be at least a SharePoint Administrator to run this cmdlet. +Tenant Application Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. Application Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. Use the dedicated Application Restrictions cmdlets listed in [Related Links](#related-links). -Microsoft first-party and core applications are excluded from App Restrictions configuration and enforcement and never appear in the tenant deny list. +Microsoft first-party and core applications are excluded from Application Restrictions configuration and enforcement and never appear in the tenant deny list. For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). @@ -51,15 +49,15 @@ For permissions and the most current information about Windows PowerShell for Sh ### Example 1 -``` +```powershell Get-SPOTenantRestrictedAppAccessControl ``` -This example returns the complete tenant Restricted App Access Control policy, showing whether enforcement is enabled and which application IDs are on the tenant deny list. +This example returns the complete tenant Application Restrictions policy, showing whether enforcement is enabled and which application IDs are on the tenant deny list. ### Example 2 -``` +```powershell (Get-SPOTenantRestrictedAppAccessControl).RestrictedAppIds ``` @@ -67,25 +65,25 @@ This example returns only the restricted application IDs from the tenant deny li ### Example 3 -``` +```powershell $policy = Get-SPOTenantRestrictedAppAccessControl if (-not $policy.Enabled) { - Write-Host "App Restrictions enforcement is off. Site policies aren't enforced." + Write-Host "Application Restrictions enforcement is off. Site policies aren't enforced." } ``` -This example stores the tenant policy in a variable and checks the master switch. Because the tenant switch gates all site-level enforcement, a disabled switch means no configured site policy is being enforced. +This example stores the tenant policy in a variable and checks the master switch. Because the tenant switch gates all site-level enforcement, a disabled switch means no site policy is being enforced, including policies whose site-level `Enabled` flag is `True`. ### Example 4 -``` +```powershell $policy = Get-SPOTenantRestrictedAppAccessControl if ($policy.Enabled -and $policy.RestrictedAppIds.Count -eq 0) { Write-Host "Enforcement is on, but the tenant deny list is empty and denies nothing." } ``` -This example identifies the state where enforcement is enabled but the tenant deny list is empty. This state is valid, and often occurs during cleanup, but the tenant deny list has no effect until an application ID is added. +This example identifies an enabled tenant switch with an empty tenant deny list. This state is valid. The tenant deny list denies nothing until an application ID is added; site policies whose site-level `Enabled` flag is `True` can still enforce. ## PARAMETERS @@ -105,12 +103,12 @@ Returns an `SPORestrictedAppAccessControlTenantPolicy` object with the following | Property | Type | Description | |---|---|---| -| `Enabled` | Boolean | Indicates whether the tenant App Restrictions enforcement switch is on. When `False`, no App Restrictions policy is enforced, including the tenant deny list and all site policies. | +| `Enabled` | Boolean | Indicates whether the tenant Application Restrictions enforcement switch is on. When `False`, the tenant deny list and all site-level policies aren't enforced. | | `RestrictedAppIds` | Guid[] | The tenant-wide deny list, returned as one stable, duplicate-free list of application IDs and parent agent blueprint IDs. | ## NOTES -- The tenant switch is the master enforcement switch for the feature. Turning it off stops every configured site policy from enforcing, not just the tenant deny list. +- The tenant switch is the master enforcement switch for Application Restrictions. Turning it off stops enforcement for every site policy whose site-level `Enabled` flag is `True`, not only the tenant deny list. - While the tenant switch is on, the tenant deny list takes precedence over site policy and can't be overridden by a site allow list. - The tenant scope is deny-only and has a single list, so there's no mode and no list-type selection at tenant scope. - The tenant deny list has a hard maximum of 100 application IDs. diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Microsoft.Online.SharePoint.PowerShell.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Microsoft.Online.SharePoint.PowerShell.md index 2a35cd2ab..f98373007 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Microsoft.Online.SharePoint.PowerShell.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Microsoft.Online.SharePoint.PowerShell.md @@ -83,9 +83,18 @@ Approves a permission request for the current tenant's "SharePoint Online Client ### [Approve-SPOTenantServicePrincipalPermissionRequest](Approve-SPOTenantServicePrincipalPermissionRequest.md) Approves a permission request for the current tenant's "SharePoint Online Client" service principal +### [Clear-SPOSiteRestrictedAppAccessControlList](Clear-SPOSiteRestrictedAppAccessControlList.md) +Clears a site's Application Restrictions allow or deny list while preserving the other list, active mode, and site enablement. + +### [Clear-SPOSiteRestrictedAppAccessControlPolicy](Clear-SPOSiteRestrictedAppAccessControlPolicy.md) +Removes the complete Application Restrictions policy from a site, disabling enforcement and removing the active mode and both lists. + ### [Clear-SPOTenantPreAuthSettings](Clear-SPOTenantPreAuthSettings.md) Clears the pre-authentication settings for either the allow or deny list. +### [Clear-SPOTenantRestrictedAppAccessControlPolicy](Clear-SPOTenantRestrictedAppAccessControlPolicy.md) +Turns off the tenant Application Restrictions enforcement switch and clears the tenant-wide deny list. + ### [Connect-SPOService](Connect-SPOService.md) Connects the SharePoint Online Administrator or the SharePoint Embedded Administrator to a SharePoint Online connection (the SharePoint Online Administration Center). This cmdlet must be run before any other SharePoint Online cmdlets can run. @@ -101,12 +110,24 @@ This cmdlet command allows you to relocate existing SharePoint pages by utilizin ### [Deny-SPOTenantServicePrincipalPermissionRequest](Deny-SPOTenantServicePrincipalPermissionRequest.md) Denies a permission request for the current tenant's "SharePoint Online Client" service principal +### [Disable-SPOSiteRestrictedAppAccessControl](Disable-SPOSiteRestrictedAppAccessControl.md) +Turns off Application Restrictions enforcement for a site while preserving the active mode and both lists. + +### [Disable-SPOTenantRestrictedAppAccessControl](Disable-SPOTenantRestrictedAppAccessControl.md) +Turns off the tenant Application Restrictions enforcement switch while preserving the tenant deny list. + ### [Disconnect-SPOService](Disconnect-SPOService.md) Disconnects from a SharePoint Online service. ### [Enable-SPOCommSite](Enable-SPOCommSite.md) Enables the communication site experience on an existing classic team site. Please read instructions in [modernize classic team site](/sharepoint/modernize-classic-team-site) before attempting to execute this cmdlet. +### [Enable-SPOSiteRestrictedAppAccessControl](Enable-SPOSiteRestrictedAppAccessControl.md) +Turns on Application Restrictions enforcement for a site using its configured mode and lists. + +### [Enable-SPOTenantRestrictedAppAccessControl](Enable-SPOTenantRestrictedAppAccessControl.md) +Turns on the tenant Application Restrictions enforcement switch for the organization. + ### [Enable-SPOTenantServicePrincipal](Enable-SPOTenantServicePrincipal.md) Enables the current tenant's "SharePoint Online Client" service principal. @@ -362,6 +383,9 @@ This cmdlet allows you to retrieve all SharePoint pages under a specific SharePo ### [Get-SPOSiteRenameState](Get-SPOSiteRenameState.md) Returns the current rename job state of a SharePoint Online Site. +### [Get-SPOSiteRestrictedAppAccessControl](Get-SPOSiteRestrictedAppAccessControl.md) +Returns the complete site-level Application Restrictions policy for a site, including enablement, active mode, and both lists. + ### [Get-SPOSiteReview](Get-SPOSiteReview.md) Track all site access reviews initiated from Data Access Governance (DAG) reports. @@ -425,6 +449,9 @@ Returns the list of sites that are prioritized for early execution, as part of [ ### [Get-SPOTenantRenameStatus](Get-SPOTenantRenameStatus.md) > [!IMPORTANT] > This feature is currently available to organizations that have no more than 10,000 total SharePoint sites and OneDrive accounts combined. Get the status of the job to change the SharePoint domain name for your organization in Microsoft 365. +### [Get-SPOTenantRestrictedAppAccessControl](Get-SPOTenantRestrictedAppAccessControl.md) +Returns the tenant Application Restrictions enforcement status and deny list. + ### [Get-SPOTenantServicePrincipalPermissionGrants](Get-SPOTenantServicePrincipalPermissionGrants.md) Gets the collection of permission grants for the "SharePoint Online Client" service principal @@ -827,6 +854,12 @@ Updates the SharePoint Online owner and permission levels on a group inside a si ### [Set-SPOSiteOffice365Group](Set-SPOSiteOffice365Group.md) Connects a top-level SPO site collection to a new Microsoft 365 Group. +### [Set-SPOSiteRestrictedAppAccessControlList](Set-SPOSiteRestrictedAppAccessControlList.md) +Adds or removes application IDs in a site's Application Restrictions allow or deny list in one atomic update. + +### [Set-SPOSiteRestrictedAppAccessControlMode](Set-SPOSiteRestrictedAppAccessControlMode.md) +Sets a site's active Application Restrictions mode to Allow or Deny while preserving site enablement and both lists. + ### [Set-SPOSiteScript](Set-SPOSiteScript.md) Updates a previously uploaded site script. @@ -860,6 +893,9 @@ Sets the configuration of pre-authentication. ### [Set-SPOTenantRenameSitePrioritization](Set-SPOTenantRenameSitePrioritization.md) Allows prioritization of a site for early execution, as part of [Advanced Tenant Rename](/sharepoint/change-your-sharepoint-domain-name#advanced-tenant-rename-preview). +### [Set-SPOTenantRestrictedAppAccessControlList](Set-SPOTenantRestrictedAppAccessControlList.md) +Adds or removes application IDs in the tenant-wide Application Restrictions deny list in one atomic update. + ### [Set-SPOTenantSyncClientRestriction](Set-SPOTenantSyncClientRestriction.md) Controls tenant-wide options and restrictions specific to syncing files. diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlList.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlList.md index a7bd9d150..0adcc329e 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlList.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSiteRestrictedAppAccessControlList.md @@ -7,8 +7,8 @@ title: Set-SPOSiteRestrictedAppAccessControlList schema: 2.0.0 ms.author: neilh ms.reviewer: neilh -description: Learn how to use Set-SPOSiteRestrictedAppAccessControlList to manage site-level allow and deny lists for App Restrictions in SharePoint Online. -ms.date: 10/12/2026 +description: Learn how to use Set-SPOSiteRestrictedAppAccessControlList to manage site-level allow and deny lists for Application Restrictions in SharePoint Online. +ms.date: 10/13/2026 ms.topic: reference --- @@ -16,11 +16,11 @@ ms.topic: reference ## SYNOPSIS -Adds application IDs to, or removes application IDs from, the allow list or the deny list of a site-level App Restrictions policy, in one atomic update. +Adds or removes application IDs in a site's Application Restrictions allow or deny list in one atomic update. ## SYNTAX -``` +```powershell Set-SPOSiteRestrictedAppAccessControlList [-Identity] -ListType [-AddRestrictedAppIds ] [-RemoveRestrictedAppIds ] [-WhatIf] [-Confirm] [] ``` @@ -28,29 +28,27 @@ Set-SPOSiteRestrictedAppAccessControlList [-Identity] -ListType -Mode [-WhatIf] [-Confirm] [] ``` @@ -28,14 +28,14 @@ Set-SPOSiteRestrictedAppAccessControlMode [-Identity] -Mode [- Use the `Set-SPOSiteRestrictedAppAccessControlMode` cmdlet to change which list a site enforces. This cmdlet changes the active mode only. It preserves site enablement and both the allow list and the deny list. -App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions. +Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and Application Restrictions. The active mode selects the list that is enforced: -- **Allow** - applications in the allow list are allowed and all other governed apps are denied. An empty active allow list blocks all governed third-party and agentic apps. -- **Deny** - applications in the deny list are denied and all other governed apps are allowed. An empty active deny list allows all governed apps. +- **Allow** - applications in the allow list pass the Application Restrictions check, and all other governed applications are denied by the site policy. An empty active allow list causes the site policy to deny all governed third-party and agentic applications. +- **Deny** - applications in the deny list are denied by the site policy, and all other governed applications pass the Application Restrictions check. An empty active deny list means the site policy denies none of them. -`Allow` is the default mode when a site is enabled without existing configuration. Both lists are always stored and can be managed regardless of which mode is active. Only the list selected by the active mode participates in runtime enforcement. The inactive list is preserved for future mode changes and has no runtime effect. +Both lists are always stored and can be managed regardless of which mode is active. Only the list selected by the active mode participates in runtime enforcement. The inactive list is preserved for future mode changes and has no runtime effect. A mode must be explicitly configured before the site policy can be enabled. Because a mode switch can change the effective decision for every governed application on the site, the cmdlet displays a warning before it makes the change. The warning identifies the current mode, the target mode, the size of the newly active preserved list, and the new default decision, and it clearly states that both lists are preserved. The cmdlet then asks you to confirm. Use `-WhatIf` to display the same impact without changing the policy. @@ -45,9 +45,7 @@ Site enforcement is also gated by the tenant switch. While the tenant switch is Automation can use the standard `-Confirm:$false`. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. -Site App Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated App Restrictions cmdlets listed in [Related Links](#related-links). - -You must be at least a SharePoint Administrator to run this cmdlet. +Site Application Restrictions administration is isolated from the general-purpose `Get-SPOSite` and `Set-SPOSite` cmdlets. `Get-SPOSite` doesn't load site policy data and `Set-SPOSite` can't change it. Use the dedicated Application Restrictions cmdlets listed in [Related Links](#related-links). For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). @@ -55,15 +53,15 @@ For permissions and the most current information about Windows PowerShell for Sh ### Example 1 -``` +```powershell Set-SPOSiteRestrictedAppAccessControlMode -Identity https://contoso.sharepoint.com/sites/Finance -Mode Allow ``` -This example sets the active mode of the Finance site to `Allow`, so only applications in the site allow list can access the site and all other governed apps are denied. The deny list is preserved but becomes inactive. The cmdlet displays the mode-switch warning and asks for confirmation before it applies the change. +This example sets the active mode of the Finance site to `Allow`. Applications in the site allow list pass the Application Restrictions check, and all other governed applications are denied by the site policy. Existing Microsoft Entra consent and SharePoint authorization still apply. The deny list is preserved but becomes inactive. The cmdlet displays the mode-switch warning and asks for confirmation before it applies the change. ### Example 2 -``` +```powershell Set-SPOSiteRestrictedAppAccessControlMode -Identity https://contoso.sharepoint.com/sites/Finance -Mode Deny -WhatIf ``` @@ -71,15 +69,15 @@ This example displays the impact of switching the Finance site to `Deny`, includ ### Example 3 -``` +```powershell Set-SPOSiteRestrictedAppAccessControlMode -Identity 8a1e30f6-2f52-4b9e-9d1b-2e9f6c1d40aa -Mode Deny -Confirm:$false ``` -This example switches a site bound by site ID to `Deny` without prompting, for use in automation. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. +This example switches a site identified by its ID to `Deny` without prompting, for use in automation. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. ### Example 4 -``` +```powershell Set-SPOSiteRestrictedAppAccessControlMode -Identity https://contoso.sharepoint.com/sites/Finance -Mode Allow Enable-SPOSiteRestrictedAppAccessControl -Identity https://contoso.sharepoint.com/sites/Finance ``` @@ -112,7 +110,7 @@ Accept wildcard characters: False Specifies the active mode of the site policy. Valid values are `Allow` and `Deny`. -When the mode is `Allow`, applications in the allow list are allowed and all other governed apps are denied. When the mode is `Deny`, applications in the deny list are denied and all other governed apps are allowed. Both lists are preserved either way. +When the mode is `Allow`, applications in the allow list pass the Application Restrictions check and all other governed applications are denied by the site policy. When the mode is `Deny`, applications in the deny list are denied by the site policy and all other governed applications pass the Application Restrictions check. Both lists are preserved either way. Existing Microsoft Entra consent and SharePoint authorization still apply. ```yaml Type: System.String @@ -178,8 +176,9 @@ This cmdlet supports the common parameters: `-Debug`, `-ErrorAction`, `-ErrorVar ## NOTES - A mode change changes only the active mode. It preserves site enablement and both lists. -- Before the switch, the cmdlet warns with the current mode, the target mode, the size of the newly active preserved list, and the new default decision, states that both lists are preserved, and asks for confirmation. -- An empty active allow list blocks all governed third-party and agentic apps. An empty active deny list allows all governed apps. +- Before the switch, the cmdlet warns with the current mode, target mode, size of the newly active preserved list, and new default decision. +- The warning states that both lists are preserved, and the cmdlet asks for confirmation. +- An empty active allow list causes the site policy to deny all governed third-party and agentic applications. An empty active deny list means the site policy denies none of them. Existing Microsoft Entra consent and SharePoint authorization still apply. - Configuration and enablement are orthogonal. Site enforcement is turned on only by `Enable-SPOSiteRestrictedAppAccessControl`. The only combination the backend rejects is enabled with mode `None`. - The tenant switch gates all site enforcement. While the tenant switch is on, the tenant deny list can't be overridden by a site allow list. - Use `Get-SPOSiteRestrictedAppAccessControl` to confirm the resulting mode and both lists. diff --git a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOTenantRestrictedAppAccessControlList.md b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOTenantRestrictedAppAccessControlList.md index 8593ec464..1d16d0a2d 100644 --- a/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOTenantRestrictedAppAccessControlList.md +++ b/sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOTenantRestrictedAppAccessControlList.md @@ -7,8 +7,8 @@ title: Set-SPOTenantRestrictedAppAccessControlList schema: 2.0.0 ms.author: neilh ms.reviewer: neilh -description: Set-SPOTenantRestrictedAppAccessControlList lets you add or remove app IDs from the tenant deny list in one atomic update. Learn syntax and examples. -ms.date: 10/12/2026 +description: Set-SPOTenantRestrictedAppAccessControlList adds or removes application IDs in the tenant-wide Application Restrictions deny list in one atomic update. +ms.date: 10/13/2026 ms.topic: reference --- @@ -16,37 +16,35 @@ ms.topic: reference ## SYNOPSIS -Adds application IDs to and removes application IDs from the tenant-wide App Restrictions deny list in a single atomic update. +Adds or removes application IDs in the tenant-wide Application Restrictions deny list in one atomic update. ## SYNTAX -``` +```powershell Set-SPOTenantRestrictedAppAccessControlList [-AddRestrictedAppIds ] [-RemoveRestrictedAppIds ] [-WhatIf] [-Confirm] [] ``` ## DESCRIPTION -Use the `Set-SPOTenantRestrictedAppAccessControlList` cmdlet to change the tenant-wide emergency deny list for Restricted App Access Control. +Use the `Set-SPOTenantRestrictedAppAccessControlList` cmdlet to change the tenant-wide deny list for Application Restrictions. -App Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and App Restrictions. +Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and Application Restrictions. Both parameters are applied in one atomic update that preserves the tenant enforcement switch. At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, and the same ID can't appear in both parameters. Removals are applied before additions. You supply application IDs only. You don't identify whether an ID is a regular application or a parent agent blueprint: the backend classifies each added ID and stores it in the appropriate internal list. A parent agent blueprint ID on the tenant deny list blocks the blueprint application itself and every current or future agent app created from that blueprint. -Added IDs are classified by using Microsoft Graph. Microsoft first-party and core applications and IDs that can't be classified are rejected, and a bulk add is all-or-none: if any supplied ID is rejected, no IDs are persisted. Removals don't use Microsoft Graph, so stale or deleted application IDs can always be removed. +Added IDs are classified by using Microsoft Graph. Microsoft first-party and core applications and IDs that can't be classified are rejected. A bulk add is all-or-none: if any supplied ID is rejected, no IDs are persisted. Removals don't use Microsoft Graph, so stale or deleted application IDs can always be removed. The combined tenant deny list has a hard maximum of 100 application IDs. Configuration and enablement are orthogonal: list changes never turn the tenant switch on or off. Use `Enable-SPOTenantRestrictedAppAccessControl` and `Disable-SPOTenantRestrictedAppAccessControl` to change enforcement. -Removing the last entry leaves an enabled switch with an empty deny list, which denies nothing. That state is allowed because it's legitimate during cleanup, but the cmdlet warns and points you to `Disable-SPOTenantRestrictedAppAccessControl` or `Clear-SPOTenantRestrictedAppAccessControlPolicy` for turning the feature off explicitly. +Removing the last entry leaves an enabled switch with an empty deny list, which denies nothing. That state is allowed because it's legitimate during cleanup, but the cmdlet warns and points you to `Disable-SPOTenantRestrictedAppAccessControl` or `Clear-SPOTenantRestrictedAppAccessControlPolicy` for turning Application Restrictions off explicitly. The tenant scope is deny-only and has a single list, so there's no mode cmdlet, no `-ListType` parameter, and no separate clear-list cmdlet. -Tenant App Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. App Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. - -You must be at least a SharePoint Administrator to run this cmdlet. +Tenant Application Restrictions administration is isolated from the general-purpose `Get-SPOTenant` and `Set-SPOTenant` cmdlets. Application Restrictions isn't exposed as a `Tenant` property, so `Get-SPOTenant` doesn't return the policy and `Set-SPOTenant` can't change it. For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell). @@ -54,7 +52,7 @@ For permissions and the most current information about Windows PowerShell for Sh ### Example 1 -``` +```powershell Set-SPOTenantRestrictedAppAccessControlList -AddRestrictedAppIds 11111111-1111-1111-1111-111111111111 ``` @@ -62,15 +60,15 @@ This example adds one application ID to the tenant deny list. The backend classi ### Example 2 -``` +```powershell Set-SPOTenantRestrictedAppAccessControlList -AddRestrictedAppIds 11111111-1111-1111-1111-111111111111, 22222222-2222-2222-2222-222222222222 -RemoveRestrictedAppIds 33333333-3333-3333-3333-333333333333 ``` -This example adds two application IDs and removes a third in a single atomic update. The removal is applied before the additions. If either added ID is a first-party or core application, or can't be classified, the complete operation fails and nothing is persisted. +This example adds two application IDs and removes a third in a single atomic update. The removal is applied before the additions. If either added ID is a first-party or core application or can't be classified, the complete operation fails and nothing is persisted. ### Example 3 -``` +```powershell Set-SPOTenantRestrictedAppAccessControlList -RemoveRestrictedAppIds 33333333-3333-3333-3333-333333333333 -Confirm:$false ``` @@ -78,7 +76,7 @@ This example removes an application ID without prompting for confirmation, which ### Example 4 -``` +```powershell Set-SPOTenantRestrictedAppAccessControlList -AddRestrictedAppIds 44444444-4444-4444-4444-444444444444 -WhatIf ``` @@ -90,7 +88,7 @@ This example shows what would happen if the application ID were added, without c > Applicable: SharePoint Online -Specifies the application IDs to add to the tenant deny list. Each supplied ID is classified by using Microsoft Graph and stored internally as either a regular application or a parent agent blueprint. First-party/core and unclassifiable IDs are rejected, and the add is all-or-none. +Specifies the application IDs to add to the tenant deny list. Each supplied ID is classified by using Microsoft Graph and stored internally as either a regular application or a parent agent blueprint. First-party or core applications and unclassifiable IDs are rejected, and the add is all-or-none. At least one of `-AddRestrictedAppIds` or `-RemoveRestrictedAppIds` is required, and an ID can't appear in both parameters. The combined tenant deny list can't exceed 100 IDs. @@ -130,7 +128,7 @@ Accept wildcard characters: False > Applicable: SharePoint Online -Prompts you for confirmation before running the cmdlet. This cmdlet has a confirm impact of High, so it prompts by default. Automation can use `-Confirm:$false` to suppress the prompt. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. +Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. Suppressing the prompt doesn't bypass validation, authorization, auditing, or first-party protection. ```yaml Type: System.Management.Automation.SwitchParameter @@ -179,7 +177,7 @@ This cmdlet doesn't return an output object. Use `Get-SPOTenantRestrictedAppAcce ## NOTES - Adds and removes are applied as one atomic update. Removals are applied before additions. -- A bulk add is all-or-none. If any supplied ID is a first-party/core application or can't be classified, no IDs are persisted. +- A bulk add is all-or-none. If any supplied ID is a first-party or core application or can't be classified, no IDs are persisted. - The combined tenant deny list has a hard maximum of 100 application IDs. - The administrator supplies IDs only. The backend classifies each added ID and stores it as either a regular application or a parent agent blueprint. - A parent agent blueprint ID blocks the blueprint application and every current or future agent app created from it.