You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
You can use the Set-SPOTenantPreAuthSettings cmdlet to configure or disable the pre-authentication feature within SharePoint Online. The disablement can be combined with switches to support granular pre-authentication management for specific apps and features at the tenant level.
40
+
You can use this cmdlet to configure or disable the pre-authentication feature within SharePoint Online. The disablement can be combined with switches to support granular pre-authentication management for specific apps and features at the tenant level.
47
41
48
-
**What is pre-authentication?**
49
-
50
-
SharePoint includes self-issued tokens in URLs called pre-authentication URLs (also known as tempauth URLs) to provide temporary access to a SharePoint resource, which helps support more rich user experiences. For example, a common scenario is downloading a file using a URL that includes a token in the `tempauth` query parameter like the following:
But this feature is currently being deprecated, so this cmdlet lets you control the use of pre-authentication in various use cases.
42
+
> [!NOTE]
43
+
> **What is pre-authentication?**
44
+
>
45
+
> SharePoint includes self-issued tokens in URLs called pre-authentication URLs (also known as tempauth URLs) to provide temporary access to a SharePoint resource, which helps support more rich user experiences. For example, a common scenario is downloading a file using a URL that includes a token in the `tempauth` query parameter like the following:
> But this feature is currently being deprecated, so this cmdlet lets you control the use of pre-authentication in various use cases.
55
50
56
51
> [!NOTE]
57
52
> The settings leverage an order of precedence:
@@ -60,9 +55,9 @@ But this feature is currently being deprecated, so this cmdlet lets you control
60
55
> 3. IsDisabled
61
56
62
57
> [!NOTE]
63
-
> As the use of this cmdlet can disable functionality in your SharePoint Online Tenant, it is highly recommended to test and evaluate each change in a test tenant ahead of making changes in a production environment.
58
+
> As the use of this cmdlet can disable functionality in your SharePoint Online tenant, it is highly recommended to test and evaluate each change in a test tenant ahead of making changes in a production environment.
64
59
65
-
You must be a SharePoint Online administrator to run the cmdlet.
60
+
You must be a SharePoint Administrator to run the cmdlet.
This example disables pre-authentication overall and allows all apps apart from one to use pre-authentication for all features except for Download and WebRenderingEmbed.
92
+
This example disables pre-authentication overall and allows all apps apart from one to use pre-authentication for all features except for `"Download"` and `"WebRenderingEmbed"`.
98
93
99
-
In this case, the app 029e7c27-4b9c-4f8b-ba32-b96249468d42 will always be denied from using pre-authentication since it is excluded from the allow list setting. Any other app will be allowed to use pre-authentication for any feature apart from Download and WebRenderingEmbed.
94
+
In this case, the app `"029e7c27-4b9c-4f8b-ba32-b96249468d42"` will always be denied from using pre-authentication since it is excluded from the allow list setting. Any other app will be allowed to use pre-authentication for any feature apart from `"Download"` and `"WebRenderingEmbed"`.
This example disables pre-authentication overall but contains an overlap between the settings in the Allow list and Deny list. It first allows an app to use pre-authentication for the OfficeOnline, WebRenderingEmbed, and Download features. But in the final execution of the cmdlet, it denies the same app from using pre-authentication for all features.
104
+
This example disables pre-authentication overall but contains an overlap between the settings in the Allow list and Deny list. It first allows an app to use pre-authentication for the `"OfficeOnline"`, `"WebRenderingEmbed"`, and `"Download"` features. But in the final execution of the cmdlet, it denies the same app from using pre-authentication for all features.
110
105
111
-
In this case, the app 029e7c27-4b9c-4f8b-ba32-b96249468d42 would not be allowed to use pre-authentication for any of the allow-listed features despite having the setting. This is because the Deny list takes precedence over the Allow list.
106
+
In this case, the app `"029e7c27-4b9c-4f8b-ba32-b96249468d42"` would not be allowed to use pre-authentication for any of the allow-listed features despite having the setting. This is because the Deny list takes precedence over the Allow list.
This example enables pre-authentication overall and denies requests that are not coming from an app (e.g. requests coming via a browser) from using pre-authentication for all features.
120
115
121
116
> [!NOTE]
122
-
> The `"Empty"` value for `-IncludedApps` or `-ExcludedApps` is different from an empty string `""`:
117
+
> The `"Empty"` value for `-IncludedApps` or `-ExcludedApps` is different from an empty string `""`. The rules are as follows:
123
118
> -`"Empty"` represents any requests that are not coming from an app (e.g. direct requests from the browser) and will not have an app ID associated with it
124
119
> -`""` can mean several things:
125
120
> - If you have `–IncludedApps "" -ExcludedApps ""`, it means that the setting applies to all
126
-
> - If you have `–IncludedApps "" -ExcludedApps "<appid>"`, it means that the setting applies to all apps apart from 029e7c27-4b9c-4f8b-ba32-b96249468d42.
127
-
> - If you have `–IncludedApps "029e7c27-4b9c-4f8b-ba32-b96249468d42" and -ExcludedApps ""`, it means that the setting only applies to the appId 029e7c27-4b9c-4f8b-ba32-b96249468d42
121
+
> - If you have `–IncludedApps "" -ExcludedApps "029e7c27-4b9c-4f8b-ba32-b96249468d42"`, it means that the setting applies to all apps apart from `"029e7c27-4b9c-4f8b-ba32-b96249468d42"`.
122
+
> - If you have `–IncludedApps "029e7c27-4b9c-4f8b-ba32-b96249468d42" and -ExcludedApps ""`, it means that the setting only applies to the app `"029e7c27-4b9c-4f8b-ba32-b96249468d42"`
128
123
> - You cannot have a setting with `–IncludedApps "029e7c27-4b9c-4f8b-ba32-b96249468d42" –ExcludedApps "029e7c27-4b9c-4f8b-ba32-b96249468d42"`
129
124
130
125
## PARAMETERS
131
126
132
-
### -IsDisabled
133
-
134
-
This parameter allows the administrator to toggle pre-authentication for all apps and features to be either enabled or disabled.
127
+
### -Add
135
128
136
-
PARAMVALUE: True | False
129
+
This parameter specifies that the operation of the cmdlet is to Add a setting to the allow list or deny list.
137
130
138
131
```yaml
139
-
Type: Boolean
140
-
Parameter Sets: IsDisabled
132
+
Type: SwitchParameter
133
+
Parameter Sets: AddListItem
141
134
Applicable: SharePoint Online
142
-
Required: True
135
+
Required: False
143
136
Position: Named
144
-
Default value: False
137
+
Default value: None
145
138
Accept pipeline input: False
146
139
Accept wildcard characters: False
147
140
```
148
141
149
-
### -Add
142
+
### -ExcludedApps
150
143
151
-
This parameter specifies that the operation of the cmdlet is to Add a setting to the SPOTenantPreAuthSettings configuration.
144
+
This parameter value contains the apps ids to configure within the `-ExcludedApps` scope.
145
+
146
+
PARAMVALUE: `"Empty"`, `""`, or a comma-separated list of app IDs
152
147
153
148
```yaml
154
-
Type: SwitchParameter
155
-
Parameter Sets: Add
149
+
Type: String
150
+
Parameter Sets: AddListItem
156
151
Applicable: SharePoint Online
157
-
Required: True
152
+
Required: False
158
153
Position: Named
159
-
Default value: None
154
+
Default value: ""
160
155
Accept pipeline input: False
161
156
Accept wildcard characters: False
162
157
```
163
158
164
-
### -Remove
159
+
### -ExcludedFeatures
165
160
166
-
This parameter specifies that the operation of the cmdlet is to Remove a setting from the SPOTenantPreAuthSettings configuration.
161
+
This parameter value contains the feature names to configure within the `-ExcludedFeatures` scope.
162
+
163
+
PARAMVALUE: `"Empty"`, `""`, or a comma-separated list of app IDs
167
164
168
165
```yaml
169
-
Type: SwitchParameter
170
-
Parameter Sets: Remove
166
+
Type: String
167
+
Parameter Sets: AddListItem
171
168
Applicable: SharePoint Online
172
-
Required: True
169
+
Required: False
173
170
Position: Named
174
-
Default value: None
171
+
Default value: ""
175
172
Accept pipeline input: False
176
173
Accept wildcard characters: False
177
174
```
178
175
179
176
### -Id
180
177
181
-
This parameter identifies the configuration setting to remove from the SPOTenantPreAuthSettings configuration set. It is only required with the -Remove parameter.
178
+
This parameter identifies the list item setting to remove from the current configuration. It is only required with the `-Remove` parameter.
| DataFormWebpart | Scenarios involved with DataFormWebParts to display/interact with SharePoint data. | [DataFormWebPart Properties (Microsoft.SharePoint.WebPartPages) - Microsoft Learn ](https://learn.microsoft.com/en-us/previous-versions/office/developer/sharepoint-2010/ms369119(v=office.14)) |
286
-
| Download | Scenarios for getting pre-authenticated download URLs. 3rd party application and some 1st party applications may be broken. | [OAuth 2.0 and OpenID Connect protocols on the Microsoft identity platform - Microsoft Learn ](https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols) |
280
+
| DataFormWebpart | Scenarios involved with DataFormWebParts to display/interact with SharePoint data. | [DataFormWebPart Properties (Microsoft.SharePoint.WebPartPages) - Microsoft Learn ](/previous-versions/office/developer/sharepoint-2010/ms369119(v=office.14)) |
281
+
| Download | Scenarios for getting pre-authenticated download URLs. 3rd party application and some 1st party applications may be broken. | [OAuth 2.0 and OpenID Connect protocols on the Microsoft identity platform - Microsoft Learn ](/entra/identity-platform/v2-protocols) |
287
282
| OfficeOnline | Office on the web scenarios. Performance might be impacted. | |
288
283
| SearchPreview | Scenarios involved in generating previews/thumbnails/conversions for search query results. Experience might be broken. | |
289
-
| SharePointConnector | Scenarios involved with SharePoint Connectors | [SharePoint Connectors - Microsoft Learn](https://learn.microsoft.com/en-us/connectors/sharepointonline/) |
284
+
| SharePointConnector | Scenarios involved with SharePoint Connectors | [SharePoint Connectors - Microsoft Learn](/connectors/sharepointonline/) |
| UploadSession | Scenarios for creating upload sessions. 3rd party application and some 1st party applications may be broken | |
292
287
| Video | Playing Video hosted on SharePoint might be broken | |
293
288
| WebRendering | Scenarios for rendering previews of files in browser. | |
294
-
| WebRenderingEmbed | Embed SharePoint files in another application. 3rd party application and some 1st party applications may be broken | [Embed Web Part](https://support.microsoft.com/en-us/office/add-content-to-your-page-using-the-embed-web-part-721f3b2f-437f-45ef-ac4e-df29dba74de8) |
295
-
| Whiteboard | Teams integration with Whiteboard app will be broken for anonymous and guest users. | [Use Whiteboard in a Teams meeting - Microsoft Support](https://support.microsoft.com/en-us/office/use-whiteboard-in-a-teams-meeting-26f87802-b37f-4af0-806d-af79fbfb8ae6) |
289
+
| WebRenderingEmbed | Embed SharePoint files in another application. 3rd party application and some 1st party applications may be broken | [Embed Web Part](https://support.microsoft.com/office/add-content-to-your-page-using-the-embed-web-part-721f3b2f-437f-45ef-ac4e-df29dba74de8) |
290
+
| Whiteboard | Teams integration with Whiteboard app will be broken for anonymous and guest users. | [Use Whiteboard in a Teams meeting - Microsoft Support](https://support.microsoft.com/office/use-whiteboard-in-a-teams-meeting-26f87802-b37f-4af0-806d-af79fbfb8ae6) |
296
291
297
292
### CommonParameters
298
-
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216).
293
+
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](/powershell/module/microsoft.powershell.core/about/about_commonparameters?view=powershell-5.1).
0 commit comments