Set-SPOTenantPreAuthSettings

Set-SPOTenantPreAuthSettings
    -IsDisabled <Boolean>
    [<CommonParameters>]

Set-SPOTenantPreAuthSettings
    -Type <TenantPreAuthSettingsListType>
    [-Add]
    [-IncludedApps <String>]
    [-ExcludedApps <String>]
    [-IncludedFeatures <String>]
    [-ExcludedFeatures <String>]
    [<CommonParameters>]

Set-SPOTenantPreAuthSettings
    -Id <String>
    [-Remove]
    [<CommonParameters>]

Set-SPOTenantPreAuthSettings
    [-UseGraphUrlIsEnabled <Boolean>]
    [-UseGraphUrlAppsList <String>]
    [<CommonParameters>]

You can use this cmdlet to configure or disable the pre-authentication feature within SharePoint Online. The disablement can be combined with switches to support granular pre-authentication management for specific apps and features at the tenant level.

You must be a SharePoint Administrator to run the cmdlet.

Microsoft Graph URL settings

Microsoft Graph file APIs can return URLs that applications use to download, upload, preview, transform, or monitor file operations. Some of these URLs have historically included pre-authentication tokens or redirected clients to pre-authenticated URLs.

You can use this cmdlet to start receiving Microsoft Graph URLs from supported APIs for third-party applications.

Expected API behavior

APIs that return URLs

For APIs with a Microsoft Graph alternative, if the setting is enabled for the calling application, the response uses a Microsoft Graph URL, and the application can call that URL by using an appropriate Microsoft Graph access token.

For APIs without a Microsoft Graph alternative, the returned SharePoint Online URL does not contain temporary authentication information. The application must obtain an appropriate Microsoft Entra access token for SharePoint Online and include it when calling the returned URL.

APIs that currently return an HTTP 302 redirect

Affected APIs return content directly rather than redirecting the application to a temporary authentication URL. Applications must not depend on intercepting the redirect, extracting a temporary authentication value from the redirect location, passing the redirected URL to an unauthenticated client, or assuming that every content request returns an HTTP 302 status code. Applications should be prepared to process a successful content response from the original Microsoft Graph request.

Direct SharePoint API requests

The tenant setting applies when the original request is made through Microsoft Graph. It does not change requests that applications make directly to SharePoint APIs.

Affected API scenarios

Set-SPOTenantPreAuthSettings -IsDisabled $true

Set-SPOTenantPreAuthSettings -Add -Type Allow -IncludedApps "029e7c27-4b9c-4f8b-ba32-b96249468d42,0ab82eba-96c7-4681-9f75-c18437e20d0e"

This example disables pre-authentication overall and adds a setting that allows two apps to use pre-authentication for all features.

Set-SPOTenantPreAuthSettings -Add -Type Allow -IncludedApps "029e7c27-4b9c-4f8b-ba32-b96249468d42,0ab82eba-96c7-4681-9f75-c18437e20d0e" -ExcludedApps "" -IncludedFeatures "" -ExcludedFeatures ""

This example performs the same function as example 1 except in this case the switches for -ExcludedApps, -IncludedFeatures, and -ExcludedFeatures are added to the cmdlet.

These switches are assumed to take the default value of "" if not used with the cmdlet and example 2 is used to demonstrate the complete set of switches only.

Set-SPOTenantPreAuthSettings -Remove -Id "368dde6f-c857-4383-a8a7-02a04a294e6d"

This example will remove an existing item from the current list of items. The remove switch can remove allow or deny entries from the list.

Set-SPOTenantPreAuthSettings -IsDisabled $true

Set-SPOTenantPreAuthSettings -Add -Type Allow -ExcludedApps "029e7c27-4b9c-4f8b-ba32-b96249468d42" -ExcludedFeatures "Download,WebRenderingEmbed"

This example disables pre-authentication overall and allows all apps apart from one to use pre-authentication for all features except for "Download" and "WebRenderingEmbed".

In this case, the app "029e7c27-4b9c-4f8b-ba32-b96249468d42" will always be denied from using pre-authentication since it is excluded from the allow list setting. Any other app will be allowed to use pre-authentication for any feature apart from "Download" and "WebRenderingEmbed".

Set-SPOTenantPreAuthSettings -IsDisabled $true

Set-SPOTenantPreAuthSettings -Add -Type Allow -IncludedApps "029e7c27-4b9c-4f8b-ba32-b96249468d42" -IncludedFeatures "OfficeOnline,WebRenderingEmbed,Download"

Set-SPOTenantPreAuthSettings -Add -Type Deny -IncludedApps "029e7c27-4b9c-4f8b-ba32-b96249468d42,0ab82eba-96c7-4681-9f75-c18437e20d0e"

This example disables pre-authentication overall but contains an overlap between the settings in the Allow list and Deny list. It first allows an app to use pre-authentication for the "OfficeOnline", "WebRenderingEmbed", and "Download" features. But in the final execution of the cmdlet, it denies the same app from using pre-authentication for all features.

In this case, the app "029e7c27-4b9c-4f8b-ba32-b96249468d42" would not be allowed to use pre-authentication for any of the allow-listed features despite having the setting. This is because the Deny list takes precedence over the Allow list.

Set-SPOTenantPreAuthSettings -IsDisabled $false

Set-SPOTenantPreAuthSettings -Add -Type Deny -IncludedApps "Empty"

This example enables pre-authentication overall and denies requests that are not coming from an app (e.g. requests coming via a browser) from using pre-authentication for all features.

Set-SPOTenantPreAuthSettings -UseGraphUrlIsEnabled $true -UseGraphUrlAppsList "029e7c27-4b9c-4f8b-ba32-b96249468d42,0ab82eba-96c7-4681-9f75-c18437e20d0e"

This example enables the setting for two apps, which means that supported Microsoft Graph APIs will return Graph URLs to these apps. Using a targeted list allows you to validate application compatibility before applying the behavior more broadly.

Set-SPOTenantPreAuthSettings -UseGraphUrlIsEnabled $true -UseGraphUrlAppsList ""

This example enables the setting for all 3P applications by supplying an empty application list.

Set-SPOTenantPreAuthSettings -UseGraphUrlIsEnabled $false

This example shows how to stop returning Microsoft Graph URLs through this setting.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

The -IncludedFeatures and -ExcludedFeatures use feature names from the following table. It explicitly mentions if the feature will be broken if it is disabled via the PowerShell cmdlet.