You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: sharepoint/sharepoint-ps/sharepoint-online/Set-SPOTenantPreAuthSettings.md
+92-33Lines changed: 92 additions & 33 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -19,9 +19,9 @@ Sets the pre auth settings for the tenant.
19
19
20
20
**What is pre auth?**
21
21
22
-
SharePoint embeds self-issued tokens into some URLs called pre auth URLs or temp auth URLs to provide temporary access to a SharePoint resource, which helps support more rich user experiences. For example, a common scenario is downloading a file using a pre auth URL that includes the token in the `tempauth` query parameter like so: `https://<tenant>.sharepoint.com/sites/samplesite/_layouts/15/download.aspx?UniqueId=<id>&tempauth=v1.ey...`.
22
+
SharePoint includes self-issued tokens into some URLs called pre auth URLs or temp auth URLs to provide temporary access to a SharePoint resource, which helps support more rich user experiences. For example, a common scenario is downloading a file using a pre auth URL that includes the token in the `tempauth` query parameter like so: `https://<tenant>.sharepoint.com/sites/samplesite/_layouts/15/download.aspx?UniqueId=<id>&tempauth=v1.ey...`.
23
23
24
-
However, pre auth is currently being deprecated. So this command lets you control whether you want to disable the use of pre auth overall and define special cases to allow or deny the use of pre auth in based on app id and feature.
24
+
However, pre auth is currently being deprecated. So this command lets you control whether you want to disable the use of pre auth overall and define any special cases to allow or deny the use of pre auth in based on app id and feature.
This example disables pre auth for the tenant overall and adds 2 apps to the allow list so that both can continue using pre auth for all features, while the rest of the apps and features are denied from using pre auth.
61
+
This example disables pre auth for the tenant overall and adds a setting that allows 2 apps continue using pre auth for all features, while the rest of the apps and features are denied from using pre auth.
62
+
63
+
> [!NOTE]
64
+
> This example relies on the default values for the `-ExcludedApps`, `-IncludedFeatures`, or `-ExcludedFeatures` parameters. So the following would be an equivalent command, where the empty quotes say that all other apps and features are included for the setting.
This example disables pre auth for the tenant overall and allows app id 00000000-0000-0000-0000-000000000000 to continue using pre auth for all features apart from the Download and Embed features.
79
+
This example disables pre auth for the tenant overall and allows all apps apart from 1 to continue using pre auth for all features except for Download and Embed.
78
80
79
-
In this case, the app with id 00000000-0000-0000-0000-000000000000 will not be allowed to use pre auth for the Download and Embed features, but it can use pre auth for all other features. This happens because the deny list takes precedence over the allow list, so for any overlapping settings between the two lists, the deny list will win (see the first note in the description).
81
+
In this case, the app with id 00000000-0000-0000-0000-000000000000 will not be allowed to use pre auth for any feature because it is not an included app for the setting. Therefore, we will default to the IsDisabled setting, which disables the use of preAuth overall. Any other app will be allowed to use pre auth for all features except for Download and Embed.
This example disables pre auth for the tenant overall, but it has overlapping settings in the allow list. The first setting says that none of the apps are allowed to use pre auth for the Download and Embed features. The second setting says that the app with id 11111111-1111-1111-1111-111111111111 is allowed to use pre auth for all features.
90
-
91
-
In this case, pre auth will be allowed for all features including Download and Embed for the app with id 11111111-1111-1111-1111-111111111111 even though we said that no apps can use preauth for those two features. This happens because the second allow list setting overwrites the first allow list setting (see the second note in the description).
91
+
This example enables pre auth for the tenant overall, but it has overlapping settings between the allow and deny lists. The allow list setting allows the app with id 00000000-0000-0000-0000-000000000000 to use pre auth for WAC, Embed, and Download features. But the deny list setting denies the same app from using pre auth for all features.
92
92
93
-
If you swapped the order of the allow list settings, pre auth will no longer be allowed for the Download and Embed features for the app with id 11111111-1111-1111-1111-111111111111. But all other features should still be allowed to continue using pre auth for that app.
93
+
In this case, the app with id 00000000-0000-0000-0000-000000000000 will not be allowed to use pre auth for any feature (including all the allow-listed features) because the deny list takes precedence over the allow list. Any other app will be denied from using pre auth for any feature.
String containing a comma-separated list of app ids for the allow list or deny list setting.
163
+
String containing a comma-separated list of app ids that are included for the allow list or deny list setting.
164
164
165
165
Possible Values:
166
-
- `"All"`: Default. The allow or deny list setting will apply to all apps.
167
-
- A comma-separated list of app ids (e.g. `"00000000-0000-0000-0000-000000000000,11111111-1111-1111-1111-111111111111"`): The allow or deny list setting will apply to only the apps in the list.
168
-
- `"None"`: The allow or deny list setting will apply to none of the apps.
166
+
- `""`: Default. If both the -IncludedApps and -ExcludedApps parameters are empty strings, the allow or deny list setting will apply to all apps.
167
+
- A comma-separated list of app ids (e.g. `"00000000-0000-0000-0000-000000000000,11111111-1111-1111-1111-111111111111"`): The allow or deny list setting will apply to only the apps in the list and all other apps will not have the setting applied.
String containing a comma-separated list of app ids that are excluded for the allow list or deny list setting.
194
+
195
+
Possible Values:
196
+
- `""`: Default. If both the -IncludedApps and -ExcludedApps parameters are empty strings, the allow or deny list setting will apply to all apps.
197
+
- A comma-separated list of app ids (e.g. `"00000000-0000-0000-0000-000000000000,11111111-1111-1111-1111-111111111111"`): The allow or deny list setting will not apply to the apps in the list and all other apps will have the setting applied.
198
+
199
+
```yaml
200
+
Type: String
201
+
Parameter Sets: AddListItem
202
+
Applicable: SharePoint Online
203
+
Required: False
204
+
Position: Named
205
+
Default value: ""
206
+
Accept pipeline input: False
207
+
Accept wildcard characters: False
208
+
```
209
+
210
+
```yaml
211
+
Type: String
212
+
Parameter Sets: RemoveListItem
213
+
Applicable: SharePoint Online
214
+
Required: False
215
+
Position: Named
216
+
Default value: ""
188
217
Accept pipeline input: False
189
218
Accept wildcard characters: False
190
219
```
191
220
192
-
### -Features
221
+
### -IncludedFeatures
193
222
194
-
String containing a comma-separated list of features for the allow list or deny list setting.
223
+
String containing a comma-separated list of features included for the allow list or deny list setting.
195
224
196
225
Possible Values:
197
-
- `"All"`: Default. The allow or deny list setting will apply to all features.
198
-
- A comma-separated list of feature names (e.g. `"Whiteboard,Download,WAC"`): The allow or deny list setting will apply to only the features in the list (see the list below for all available features).
226
+
- `""`: Default. If both the -IncludedFeatures and -ExcludedFeatures parameters are empty string, the allow or deny list setting will apply to all features.
227
+
- A comma-separated list of features (e.g. `"Whiteboard,Download,WAC"`): The allow or deny list setting will apply to only the features in the list (see the list below for all available features) and all other features will not have the setting applied.
String containing a comma-separated list of features excluded for the allow list or deny list setting.
290
+
291
+
Possible Values:
292
+
- `""`: Default. If both the -IncludedFeatures and -ExcludedFeatures parameters are empty string, the allow or deny list setting will apply to all features.
293
+
- A comma-separated list of features (e.g. `"Whiteboard,Download,WAC"`): The allow or deny list setting will not apply to the features in the list (see the list above for all available features) and all other features will have the setting applied.
0 commit comments