SPOTenantSettings

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
IsSingleInstance	Key	String	Specifies the resource is a single instance, the value must be 'Yes'	Yes
EnableAzureADB2BIntegration	Write	Boolean	Enables OneDrive and SharePoint integration with Microsoft Entra B2B.
OneDriveSharingCapability	Write	String	DEPRECATED - Determines what level of sharing is available for OneDrive sites. It corresponds to the SharingCapabilities for OneDrive sites.	ExternalUserAndGuestSharing, Disabled, ExternalUserSharingOnly, ExistingExternalUserSharingOnly
MinCompatibilityLevel	Write	UInt32	Specifies the lower bound on the compatibility level for new sites.
MaxCompatibilityLevel	Write	UInt32	Specifies the upper bound on the compatibility level for new sites.
SearchResolveExactEmailOrUPN	Write	Boolean	Removes the search capability from People Picker. Note, recently resolved names will still appear in the list until browser cache is cleared or expired.
OfficeClientADALDisabled	Write	Boolean	When set to true this will disable the ability to use Modern Authentication that leverages ADAL across the tenant.
LegacyAuthProtocolsEnabled	Write	Boolean	Setting this parameter prevents Office clients using non-modern authentication protocols from accessing SharePoint Online resources.
SignInAccelerationDomain	Write	String	Specifies the home realm discovery value to be sent to Azure Active Directory (AAD) during the user sign-in process.
UsePersistentCookiesForExplorerView	Write	Boolean	Lets SharePoint issue a special cookie that will allow this feature to work even when Keep Me Signed In is not selected.
PublicCdnEnabled	Write	Boolean	Configure PublicCDN
PublicCdnAllowedFileTypes	Write	String	Configure filetypes allowed for PublicCDN
UseFindPeopleInPeoplePicker	Write	Boolean	When set to $true, users aren't able to share with security groups or SharePoint groups.
NotificationsInSharePointEnabled	Write	Boolean	When set to $true, users aren't able to share with security groups or SharePoint groups.
OwnerAnonymousNotification	Write	Boolean	Specifies whether an email notification should be sent to the OneDrive for Business owners when an anonymous links are created or changed.
ApplyAppEnforcedRestrictionsToAdHocRecipients	Write	Boolean	When the feature is enabled, all guest users are subject to conditional access policy. By default guest users who are accessing SharePoint Online files with pass code are exempt from the conditional access policy.
FilePickerExternalImageSearchEnabled	Write	Boolean	Sets whether webparts that support inserting images, like for example Image or Hero webpart, the Web search (Powered by Bing) should allow choosing external images.
HideDefaultThemes	Write	Boolean	Defines if the default themes are visible or hidden
HideSyncButtonOnTeamSite	Write	Boolean	To enable or disable Sync button on Team sites
MarkNewFilesSensitiveByDefault	Write	String	Allow or block external sharing until at least one Office DLP policy scans the content of the file.	AllowExternalSharing, BlockExternalSharing
DisabledWebPartIds	Write	StringArray[]	Provide GUID for the Web Parts that are to be disabled on the Sharepoint Site
SocialBarOnSitePagesDisabled	Write	Boolean	Disables or enables the Social Bar. It will give users the ability to like a page, see the number of views, likes, and comments on a page, and see the people who have liked a page.
CommentsOnSitePagesDisabled	Write	Boolean	Set to false to enable a comment section on all site pages, users who have access to the pages can leave comments. Set to true to disable this feature.
EnableAIPIntegration	Write	Boolean	Boolean indicating if Azure Information Protection (AIP) should be enabled on the tenant.
ExemptNativeUsersFromTenantLevelRestricedAccessControl	Write	Boolean	Determines whether or not we need to include external participants in shared channels for SharePoint access restriction.
AllowSelectSGsInODBListInTenant	Write	StringArray[]	List of security groups to include in OneDrive access restrictions
DenySelectSGsInODBListInTenant	Write	StringArray[]	List of security groups to exclude in OneDrive access restrictions
DenySelectSecurityGroupsInSPSitesList	Write	StringArray[]	List of security groups to exclude in SharePoint access restrictions
AllowSelectSecurityGroupsInSPSitesList	Write	StringArray[]	List of security groups to include in SharePoint access restrictions.
TenantDefaultTimezone	Write	String	The default timezone of a tenant for newly created sites.
MobileFriendlyUrlEnabledInTenant	Write	Boolean	Gets or sets a value to specify if user checks handle mobile friendly url.
AllowDownloadingNonWebViewableFiles	Write	Boolean	Gets or sets a value to specify the advanced setting of the conditional access policy.
AllowEditing	Write	Boolean	Prevents users from editing Office files in the browser and copying and pasting Office file contents out of the browser window.
HideSyncButtonOnODB	Write	Boolean	Set whether to hide the sync button on OneDrive for Business sites.
DisableCustomAppAuthentication	Write	Boolean	Configure if ACS-based app-only authentication should be disabled or not.
DisabledModernListTemplateIds	Write	StringArray[]	Guids of out of the box modern list templates to hide when creating a new list.
DisablePersonalListCreation	Write	Boolean	Allows configuring whether personal lists created within the OneDrive for Business site of the user is enabled or disabled in the tenant. If set to $false, personal lists will be allowed to be created in the tenant. If set to $true, it will be disabled in the tenant.
DisplayNamesOfFileViewersInSpo	Write	Boolean	Allows configuring whether display name of people who view the file are visible in the property pane of the site in SharePoint site collection.
IsFluidEnabled	Write	Boolean	Allows configuration on whether Fluid components are enabled or disabled in the tenant. If set to $true, then this feature will be enabled on all sites in the tenant. If set to $false, it will be disabled on all sites in the tenant.
IsLoopEnabled	Write	Boolean	Allows configuring whether loop components are enabled or disabled in the tenant. If set to $true, loop components will be allowed to be created in the tenant. If set to $false, it will be disabled in the tenant.
IsSharePointNewsfeedEnabled	Write	Boolean	Indicates whether the newsfeed is allowed on the modern site pages in SharePoint.
IsSiteCreationEnabled	Write	Boolean	Indicates whether users are allowed to create sites.
IsSiteCreationUiEnabled	Write	Boolean	Indicates whether the UI commands for creating sites are shown.
IsSitePagesCreationEnabled	Write	Boolean	Indicates whether creating new modern pages is allowed on SharePoint sites.
NoAccessRedirectUrl	Write	String	Specifies the URL of the redirected site for those site collections which have the locked state 'NoAccess'. The valid values are: '' (default) - Blank by default, this will also remove or clear any value that has been set. Full URL - Example: https://contoso.sharepoint.com/Pages/Locked.aspx
RequireAcceptingAccountMatchInvitedAccount	Write	Boolean	Ensures that an external user can only accept an external sharing invitation with an account matching the invited email address. Note, this only applies to new external users accepting new sharing invitations. Also, the resource owner must share with an organizational or Microsoft account or the external user will be unable to access the resource.
SpecialCharactersStateInFileFolderNames	Write	String	Permits the use of special characters in file and folder names in SharePoint Online and OneDrive for Business document libraries. The only two characters that can be managed at this time are the # and % characters.	NoPreference, Allowed, Disallowed
Ensure	Write	String	Only accepted value is 'Present'.	Present, Absent
Credential	Write	PSCredential	Credentials of the account to authenticate with.
ApplicationId	Write	String	Id of the Azure Active Directory application to authenticate with.
ApplicationSecret	Write	PSCredential	Secret of the Azure Active Directory application to authenticate with.
TenantId	Write	String	Name of the Azure Active Directory tenant used for authentication. Format contoso.onmicrosoft.com
CertificatePassword	Write	PSCredential	Username can be made up to anything but password will be used for certificatePassword
CertificatePath	Write	String	Path to certificate used in service principal usually a PFX file.
CertificateThumbprint	Write	String	Thumbprint of the Azure Active Directory application's authentication certificate to use for authentication.
ManagedIdentity	Write	Boolean	Managed ID being used for authentication.
AccessTokens	Write	StringArray[]	Access token used for authentication.

SPO Tenant Settings

Description

This resource allows users to configure and monitor the tenant settings for their SPO tenant settings.

Permissions

Microsoft Graph

To authenticate with the Microsoft Graph API, this resource required the following permissions:

Delegated permissions

• Read

  • Domain.Read.All, SharePointTenantSettings.Read.All

• Update

  • Domain.Read.All, SharePointTenantSettings.ReadWrite.All

Application permissions

• Read

  • Domain.Read.All, SharePointTenantSettings.Read.All

• Update

  • Domain.Read.All, SharePointTenantSettings.ReadWrite.All

Microsoft SharePoint

To authenticate with the SharePoint API, this resource required the following permissions:

Delegated permissions

• Read

  • Sites.FullControl.All

• Update

  • Sites.FullControl.All

Application permissions

• Read

  • Sites.FullControl.All

• Update

  • Sites.FullControl.All

Examples

Example 1

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param(
        [Parameter(Mandatory = $true)]
        [PSCredential]
        $Credscredential
    )
    Import-DscResource -ModuleName Microsoft365DSC

    node localhost
    {
        SPOTenantSettings 'ConfigureTenantSettings'
        {
            IsSingleInstance                              = 'Yes'
            MinCompatibilityLevel                         = 16
            MaxCompatibilityLevel                         = 16
            SearchResolveExactEmailOrUPN                  = $false
            OfficeClientADALDisabled                      = $false
            LegacyAuthProtocolsEnabled                    = $true
            SignInAccelerationDomain                      = ''
            UsePersistentCookiesForExplorerView           = $false
            PublicCdnEnabled                              = $false
            PublicCdnAllowedFileTypes                     = 'CSS,EOT,GIF,ICO,JPEG,JPG,JS,MAP,PNG,SVG,TTF,WOFF'
            UseFindPeopleInPeoplePicker                   = $false
            NotificationsInSharePointEnabled              = $true
            OwnerAnonymousNotification                    = $true
            ApplyAppEnforcedRestrictionsToAdHocRecipients = $true
            FilePickerExternalImageSearchEnabled          = $true
            HideDefaultThemes                             = $false
            MarkNewFilesSensitiveByDefault                = 'AllowExternalSharing'
            CommentsOnSitePagesDisabled                   = $false
            SocialBarOnSitePagesDisabled                  = $false
            Ensure                                        = 'Present'
            Credential                                    = $Credscredential
        }
    }
}