SharePoint Gen

SharePoint Online - Site Collection External Sharing Settings App

ChandrasekarN — Tue, 30 Aug 2016 07:38:05 GMT

Summary

SharePoint Online provides an ability to share contents to external users. This is a great feature for collaboration with your partners. However, the External Sharing can be enabled/disabled only in SharePoint Admin Portal or PowerShell which requires the user to be part of SharePoint Online administrators group. This creates a dependency on Tenant Administrators every time a Site Owner/Site Collection Administrator wants to either allow or disallow external sharing in their site collection. This application gives the privilege for a Site Owner and Site Collection administrators to change the external sharing settings from a site collection itself.

Features

Empowers Site Owner and Site Collection Administrators to change external sharing settings.
Display banner if the site is externally shared
File system logging

Solution Components

The solution consists of two parts;

A link to access a page in remote web application to change external sharing settings
The web application that hosts a page for changing external sharing settings.

External Sharing Link

Only users who have site collection manage permission will be able to use this application. Users with manage site collection permission can go to site settings of a site collection and they will see a link called “External Sharing” under “Site Collection Administration”.

Remote web application

When the user clicks on the “External Sharing” link, they will be redirected to a page hosted in an IIS server On-Prem or Azure. This page provides the users with the options to change external sharing settings.

Solution configuration and setup

External Sharing Link

The link to change External sharing will be available under site settings -> Site collection administration of each site collection. This link will be added automatically when the site is provisioned using Site Provisioning App.

Remote web application setup

For the External Sharing Web Application to interact with SharePoint Online, we need to create App Principals which is registered with Microsoft Azure Access Control Service (ACS).

Add-in Registration and Permissions

External Sharing Application requests permissions at Tenant, Site Collection, and User Profile level. Also, the application uses App-only Policy as all Site Owners or Site Collection Administrators will not have permission at Tenant and User Profile level.

Web configuration file

Enter the Client ID and Secret values in External Sharing Web Application’s web.cofig file. For security purpose, the values will be encrypted using Add-in Security tool – See section "Securing Add-in Principals" on how to use the tool. The web.config of the application contains encrypted ClientID, encrypted ClientSecret, Tenant Admin URL, and JavaScript file that contains the code for displaying the banner.

Application walkthrough

External Sharing page

External Sharing page is used for changing the settings of external sharing of a site collection. The page displays the following;

Top navigation with current logged in user name
Top level Site Settings navigation option to go back to the site collection’s site settings page
The URL of the site collection
Options to change the settings of external sharing
Ok button to submit the change or cancel button to go back to site settings page.

External Sharing settings

There are 2 settings available;

Allow external sharing
Don’t allow external sharing

By default, the current external sharing settings for the site collection will be selected. Only when the user opts to change the settings, the Ok button will be enabled.

Allow external sharing

To enable external sharing, users need to choose the option “Allow external users who accept sharing invitations and sign in as authenticated users”. When the user chooses to allow external sharing, two things happen;

The site collection will be shared externally At the tenant level, the option to allow external users who accept sharing invitations and sign in as authenticated users will be enabled.
A banner will be displayed in the Site collection and sites informing the users that this site can be shared with people outside of Contoso. We make use of SharePoint Online's OOB status banner to display custom message. Refer externalsharing.js located under scripts folder. Since this js will be used across site collections, deploy this file in CDN or at any root site collection level.

Don’t allow external sharing

To disable external sharing, users need to choose the option “Don’t allow sharing outside your organization”. When the user chooses not to share the site externally, a message will be displayed (see picture below) informing about the details if the stop external sharing of the site collection. When the user clicks Ok, two things happen;

The site collection will not be shared externally - At the tenant level, the option to disallow external sharing will be enabled.
The banner will be removed from the site collection.

Securing Add-in Principals

To protect the Add-in principles, most importantly the Client ID and Client Secret, we encrypt their values and store the encrypted values in the respective configuration files. The application handles the decryption of the values. DPAPI functions encrypt and decrypt data using the Triple-DES algorithm. In addition to encryption and decryption, DPAPI handles key generation and protection. DPAPI can generate encryption keys that are unique either for a user making the call or the computer on which the program making the call runs. The encryption can be scoped at machine or user level. Using the encrypted value generated in one machine we can't decrypted the value in another machine, it has to be decrypted in the same machine. When an application calls the DPAPI encryption routine, it can specify an optional secondary entropy ("secret" bytes) that will have to be provided by an application attempting to decrypt data. Please look at Governance.AddInSecurity application in PNP Github for the source code - https://github.com/OfficeDev/PnP/tree/master/Solutions/Governance.AddInSecurity The entire solution for External Sharing Settings Add-In can be found here - https://github.com/OfficeDev/PnP/tree/master/Solutions/Governance.ExternalSharing

SharePoint Online - Change Site Collection Ownership App

ChandrasekarN — Tue, 30 Aug 2016 07:34:14 GMT

Summary

The Change Site Collection Owner application is used for changing the Site Owner of a site collection in SharePoint Online by the current site owner or any site collection administrator. Out of the box in SharePoint Online, the Site Owner can only be changed in SharePoint Admin Center or PowerShell which requires the user to be part of SharePoint Online administrators group. This application gives the privilege for a Site Owner and Site Collection administrators to change the site collection ownership from a site collection itself.

Features

Empowers Site Owner and Site Collection Administrators to change current site owner
Choose site owner from only supported certain domain (for e.g. disallow external users from being a site owner)
Multiple option to choose a site owner. Sample has the options to choose
- Assign to myself
- Assign to my manager
- Assign to another site collection administrators
Automatically set the new site owner's email in Access Request Settings for the site.
Email notification to Site Owner and Site Collection Administrators when any change happens
File system logging

Solution Components

The solution consists of two parts;

A link to access a page in remote web application to change site collection ownership
The web application that hosts a page for changing the site ownership.

Change Site Collection Ownership Link

Only users who have site collection manage permission will be able to use this application. Users with manage site collection permission can go to site settings of a site collection and they will see a link called “Change Site Collection Ownership” under “Site Collection Administration”.

Remote web application

When users click on the “Change Site Collection Ownership” link, they will be redirected to a page hosted in an IIS server On-Prem or Azure. This page provides an interface with the options to choose a new site owner.

Solution configuration and setup

Change Site Collection Ownership Link

The link to change site collection ownership will be available under site settings -> Site collection administration of each site collection. This link will be added automatically when the site is provisioned using Site Provisioning App.

Remote web application setup

For the Change Owner Web Application to interact with SharePoint Online, we need to create App Principals which is registered with Microsoft Azure Access Control Service (ACS).

Add-in Registration and Permissions

Change Owner Application requests permissions at Tenant, Site Collection, and User Profile level. Also, the application uses App-only Policy as all Site Owners or Site Collection Administrators will not have permission at Tenant and User Profile level.

Web configuration file

Enter the Client ID and Secret values in Change Owner Web Application’s web.cofig file. For security purpose, the values will be encrypted using Add-in Security tool – See section "Securing Add-in Principals" on how to use the tool. The web.config of the application contains encrypted ClientID, encrypted ClientSecret, Email template file location, Supported Domains and email settings. You can add multiple supported domains separated by comma (for e.g. value="contoso.com,contosotest.onmicrosoft.com”)

Application walkthrough

Change Site Collection Ownership Page

Change Site Collection Ownership page is used for choosing a new site owner. The page displays the following;

Top navigation with current logged in user name
Top level Site Settings navigation option to go back to the site collection’s site settings page
Left navigation to browse through site collection giving great end user experience.
The URL of the site collection
Current site owner
Options to choose new site owner
Add site collection administrators
Ok button to submit the change or cancel button to go back to site settings page.

Choosing a new site owner

There are 3 different options to choose a new site owner. By default none of the options is choose and the “Ok” button will be disabled. Only when the user chooses a new site owner, the user will be able to submit.

Assign to myself

In this option, the user can choose themselves as a site owner. When this option is chosen, it will display current user’s name which will be grayed out. In case, the current owner is the same person as the logged in user, this option will be grayed out.

Assign to my manager

This provides an option to choose user’s manager as a site owner. If the user does not have any manager assigned in user profile, it will be grayed out – The user can’t select this option.

Assign to another site collection administrator

You can opt to choose one of the existing site collection administrators as a new site owner. Choosing this option, displays a dropdown box that shows all current site collection administrators. It doesn’t display any service accounts though. The users will be shown only if their accounts belong to supported domains configured in web.config file, for e.g. you can restrict external/partners from being a site owner. If there aren’t any site collection administrators available, then the page displays a message asking users to add site collection administrators using Add Site Collection Administrators link.

Site Collection Administrators

The page also provides an option to add site collection administrators.

Submission

When a new owner is selected and submitted for change, few things takes place;

The selected person will be assigned as a new site owner for this site collection
In the Access Request settings section of the site collection, the newly selected owner's email address will be updated.
An Email notification will be sent to new owner, old owner, and all Site Collection administrators informing them about the change in ownership.

Securing Add-in Principals

To protect the Add-in principles, most importantly the Client ID and Client Secret, we encrypt their values and store the encrypted values in the respective configuration files. The application handles the decryption of the values. DPAPI functions encrypt and decrypt data using the Triple-DES algorithm. In addition to encryption and decryption, DPAPI handles key generation and protection. DPAPI can generate encryption keys that are unique either for a user making the call or the computer on which the program making the call runs. The encryption can be scoped at machine or user level. Using the encrypted value generated in one machine we can't decrypted the value in another machine, it has to be decrypted in the same machine. When an application calls the DPAPI encryption routine, it can specify an optional secondary entropy ("secret" bytes) that will have to be provided by an application attempting to decrypt data. Please look at Governance.AddInSecurity application in PNP Github for the source code - https://github.com/OfficeDev/PnP/tree/master/Solutions/Governance.AddInSecurity The entire solution for Change Site Ownership can be found here - https://github.com/OfficeDev/PnP/tree/master/Solutions/Governance.ChangeOwnership

SharePoint Online : Securing Add-in Principals

ChandrasekarN — Sat, 27 Aug 2016 15:27:45 GMT

For the remote components of a provider-hosted SharePoint Add-in to interact with SharePoint using OAuth, the add-in must first register with the Azure ACS cloud-based service and the SharePoint App Management Service of the tenancy. The registration involves creating new Client ID/Secret and other add-in specific details. After you register your add-in, it has an add-in identity and is a security principal, referred to as an add-in principal. When you install your add-in, SharePoint administrators can retrieve information about that particular add-in principal. The Client ID/Secret values need to be entered in configuration file of the application. Anyone who has access to the file system of the config file location can read these values. Using these values, they can build their own application and do anything in the SharePoint they want to (though its only restricted to app permissions defined for the app principal). This can become a big security threat especially if the app is given app-only policy permission. This is a governance problem. Any organization need to have well defined governance on the deployment process, person responsible in making the changes in the configuration file and so on. If the config file is not well protected enough, it can become a problem. To address this scenario, we need to secure the app principle itself, so that even if someone gets access to these principles they shouldn't be able to do anything with it. The idea is to encrypt the key values using Triple-DES algorithm at Machine level. Using the encrypted value generated in one machine we can't decrypted the value in another machine, it has to be decrypted in the same machine. When an application calls the DPAPI encryption routine, it can specify an optional secondary entropy ("secret" bytes) that will have to be provided by an application attempting to decrypt data. The solutions consists of 2 parts - Encryption (Generated using an Exe application) and Decryption (Used in the actual add-in application);

Encryption

Enter the Client ID or the Secret value in Client ID/Secret text box.
Entropy key is optional field.
Choose the scope as Local Machine (this is the default value)
Click Encrypt button to get the encrypted text value and hit copy text to copy the values.

Validation

Decryption

The encrypted value is stored in the configuration file. The add-in application uses EncryptionUtility class DecryptStringWithDPAPI method to get the decrypted value. For e.g. in the TokenHelper.cs of an Add-In application, to get the actual value of Client Secret, here is the code; private static SecureString stringClientSecret = EncryptionUtility.DecryptStringWithDPAPI(WebConfigurationManager.AppSettings.Get("ClientSecret")) ; private static readonly string ClientSecret = EncryptionUtility.ToInsecureString(stringClientSecret); The complete solution can be downloaded here - https://github.com/OfficeDev/PnP/tree/master/Solutions/Governance.AddInSecurity

SPO : PowerShell to get Custom Actions in a Site Collection

ChandrasekarN — Sat, 27 Aug 2016 15:13:30 GMT

[System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Client") [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Client.Runtime") $siteUrl = Read-Host -Prompt "Enter sitecollection url" $username = Read-Host -Prompt "Enter user login name" $password = Read-Host -Prompt "Enter user login password" -AsSecureString $ctx = New-Object Microsoft.SharePoint.Client.ClientContext($siteUrl) # SharePoint Online $credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($username, $password) $ctx.Credentials = $credentials $rootWeb = $ctx.Site $ctx.Load($rootWeb) $ctx.ExecuteQuery() $caColl = $rootWeb.get_userCustomActions() $ctx.Load($caColl) $ctx.ExecuteQuery() Write-Host Write-Host 'Total number of custom actions: '$caColl.Count $count = 1 $caColl | ForEach-Object { Write-Host $count')' $_.Name $count++ }

SPO : PowerShell Script to get report of all subsites for a given site collection

ChandrasekarN — Tue, 23 Aug 2016 14:36:58 GMT

In SharePoint Online, most of the times, a Site Owner would like to get subsites report of their site collection. Here is a sample PowerShell script which uses CSOM to get all users with Full control permission in all the subsites (recursively) under the given Site Collection and outputs in an Excel sheet. The script can be modified as needed to get other properties of a subsite. Add-Type –Path "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\ISAPI\Microsoft.SharePoint.Client.dll" Add-Type –Path "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\ISAPI\Microsoft.SharePoint.Client.Runtime.dll" $siteURL = Read-Host -Prompt "Enter Site Collection URL" $username = Read-Host -Prompt "Enter User Name" $password = Read-Host -Prompt "Password for $username" -AsSecureString [Microsoft.SharePoint.Client.ClientContext]$clientContext = New-Object Microsoft.SharePoint.Client.ClientContext($siteURL) $clientContext.Credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($username, $password) $excel = New-Object -ComObject Excel.Application $excel.Visible = $true $workbook = $excel.Workbooks.Add() $sheet = $workbook.ActiveSheet $counter = 1 $sheet.cells.Item($counter,1) = 'Site URL' $sheet.cells.Item($counter,2) = 'Unique Permission' $sheet.cells.Item($counter,3) = 'Users with Full Control Permission' $sheet.cells.Item($counter,1).font.bold = $True $sheet.cells.Item($counter,2).font.bold = $True $sheet.cells.Item($counter,3).font.bold = $True $sheet.cells.Item($counter,1).Interior.ColorIndex = 8 $sheet.cells.Item($counter,2).Interior.ColorIndex = 8 $sheet.cells.Item($counter,3).Interior.ColorIndex = 8 Function Invoke-LoadMethod() { param( [Microsoft.SharePoint.Client.ClientObject]$Object = $(throw "Please provide a Client Object"), [string]$PropertyName ) $ctx = $Object.Context $load = [Microsoft.SharePoint.Client.ClientContext].GetMethod("Load") $type = $Object.GetType() $clientLoad = $load.MakeGenericMethod($type) $Parameter = [System.Linq.Expressions.Expression]::Parameter(($type), $type.Name) $Expression = [System.Linq.Expressions.Expression]::Lambda( [System.Linq.Expressions.Expression]::Convert( [System.Linq.Expressions.Expression]::PropertyOrField($Parameter,$PropertyName), [System.Object] ), $($Parameter) ) $ExpressionArray = [System.Array]::CreateInstance($Expression.GetType(), 1) $ExpressionArray.SetValue($Expression, 0) $clientLoad.Invoke($ctx,@($Object,$ExpressionArray)) } function Get-SPOWebs(){ param( $Url = $(throw "Please provide a Site Collection Url"), $Credential = $(throw "Please provide a Credentials") ) $context = New-Object Microsoft.SharePoint.Client.ClientContext($Url) $context.Credentials = $Credential $web = $context.Web $context.Load($web) $context.Load($web.Webs) $context.ExecuteQuery() foreach($web in $web.Webs) { Get-SPOWebs -Url $web.Url -Credential $Credential Invoke-LoadMethod -Object $web -PropertyName "HasUniqueRoleAssignments" $context.ExecuteQuery() $outputString = '' $siteGroups = $web.SiteGroups $context.Load($web.AssociatedOwnerGroup) $context.ExecuteQuery() $ownersGroup = $siteGroups.GetByName($web.AssociatedOwnerGroup.Title) $context.Load($ownersGroup) $context.ExecuteQuery() $ownersGroupUsers = $ownersGroup.Users $context.Load($ownersGroupUsers) $context.ExecuteQuery() $ownersGroupUsers | ForEach-Object {$outputString += $_.Email + ';' } $rows = $sheet.UsedRange.Rows.Count + 1 $sheet.cells.Item($rows ,1) = $web.Url $sheet.cells.Item($rows ,2) = $web.HasUniqueRoleAssignments.ToString() $sheet.cells.Item($rows ,3) = $outputString $outputString = '' } } Get-SPOWebs -Url $siteURL -Credential $clientContext.Credentials

SharePoint Online - Setting custom home page in Site Collection and in Sub-Sites

ChandrasekarN — Wed, 03 Aug 2016 18:11:05 GMT

In SharePoint Online, using PNP’s Remote Site Provisioning approach you can request and create customized site collections. As part of site collection creation process, one of the option could be to upload custom page and set it as default welcome page for the Site Collection. As part of site provisioning, if you have sub-sites created as well, you may want to set the same custom page as your sub-sites welcome page. Setting SiteCollection’s Welcome Page

var wikiPages = web.Lists.GetByTitle("Pages");

web.Context.Load(wikiPages);

web.Context.ExecuteQuery();

Microsoft.SharePoint.Client.File wikiFile = wikiPages.RootFolder.GetFile("CustomDefault-page.aspx");

if (wikiFile.CheckOutType == CheckOutType.None)

   wikiFile.CheckOut();

 web.Context.Load(wikiFile);

web.Context.ExecuteQuery();

 var wikiPage = wikiFile.ListItemAllFields;

 web.Context.Load(wikiPage);

 web.Context.ExecuteQuery();

 wikiPage["PublishingPageLayout"] = web.ServerRelativeUrl + "/_catalogs/masterpage/PageFromDocLayout.aspx, Body only";

 wikiPage.Update();

  wikiFile.CheckIn(string.Empty, CheckinType.MajorCheckIn);

 web.Context.Load(wikiFile);

 web.Context.ExecuteQuery();

  //Set Welcome Home Page

 var rootFolder = web.RootFolder;

 rootFolder.WelcomePage = "Pages/CustomDefault-page.aspx";

 rootFolder.Update();

 web.Context.ExecuteQuery();

Setting Sub-Site’s Welcome Page

 FileCreationInformation newFile = new FileCreationInformation();

 ctx.Load(hostWeb);

 ctx.ExecuteQuery();

 Microsoft.SharePoint.Client.File file = hostWeb.GetFileByServerRelativeUrl(hostWeb.ServerRelativeUrl + "/Pages/CustomDefault-page.aspx");

 ClientResult data = file.OpenBinaryStream();

 hostWeb.Context.Load(file);

 hostWeb.Context.ExecuteQuery();

 if (data != null)

     using (var memory = new MemoryStream())

      {
          byte[] buffer = new byte[file.Length];

          int nread = 0;

          while ((nread = data.Value.Read(buffer, 0, buffer.Length)) > 0)
          {
              memory.Write(buffer, 0, nread);
          }

           memory.Seek(0, SeekOrigin.Begin);

           StreamReader fsReader = new StreamReader(memory);

           byte[] contents = null;

           using (Stream fStream = fsReader.BaseStream)

                contents = new byte[fStream.Length];

                fStream.Read(contents, 0, (int)fStream.Length);

                 fStream.Close();

              newFile.Content = contents;

              newFile.Url = "CustomDefault-page.aspx";

              newFile.Overwrite = true;

              var wikiPages = newWeb.Lists.GetByTitle("Pages");

              newWeb.Context.Load(wikiPages);

              newWeb.Context.ExecuteQuery();

              Microsoft.SharePoint.Client.File wikiFile = wikiPages.RootFolder.Files.Add(newFile);

              newWeb.Context.Load(wikiFile);

              newWeb.Context.ExecuteQuery();

              wikiFile.CheckIn(string.Empty, CheckinType.MajorCheckIn);

              newWeb.Context.Load(wikiFile);

              newWeb.Context.ExecuteQuery();

              //Set Welcome Home Page

              var rootFolder = newWeb.RootFolder;

              rootFolder.WelcomePage = "Pages/CustomDefault-page.aspx";

              rootFolder.Update();

              newWeb.Context.ExecuteQuery();

SharePoint Online - Securing Add-in Principals

ChandrasekarN — Thu, 03 Mar 2016 18:50:08 GMT

For the remote components of a provider-hosted SharePoint Add-in to interact with SharePoint using OAuth, the add-in must first register with the Azure ACS cloud-based service and the SharePoint App Management Service of the tenancy. The registration involves creating new Client ID/Secret and other add-in specific details. After you register your add-in, it has an add-in identity and is a security principal, referred to as an add-in principal. When you install your add-in, SharePoint administrators can retrieve information about that particular add-in principal. The Client ID/Secret values need to be entered in configuration file of the application. Anyone who has access to the file system of the config file location can read these values. Using these values, they can build their own application and do anything in the SharePoint they want to (though its only restricted to app permissions defined for the app principal). This can become a big security threat especially if the app is given app-only policy permission. This is a governance problem. Organization needs to have well defined governance on the deployment process, person responsible in making the changes in the configuration file and so on. If the config file is not well protected enough, it can become a problem. To address this scenario, we need to secure the app principle itself, so that even if someone gets access to these principles they shouldn't be able to do anything with it. The idea is to encrypt the key values using Triple-DES algorithm at Machine level. Using the encrypted value generated in one machine we can't decrypt the value in another machine, it has to be decrypted in the same machine. When an application calls the DPAPI encryption routine, it can specify an optional secondary entropy ("secret" bytes) that will have to be provided by an application attempting to decrypt data.

Encryption

Enter the Client ID or the Secret value in Client ID/Secret text box.
Entropy key is optional field.
Choose the scope as Local Machine (this is the default value)
Click Encrypt button to get the encrypted text value and hit copy text to copy the values.

Validation

To validate the encrypted text, without altering any values, click the Decrypt button and you should see the original value of the ID/Secret given. If the value is tampered or if you try to use the encrypted text value in a different machine, the decryption will fail. The encrypted values has to be entered in configuration file of the add-in application. In the Tokenhelper class file, the encrypted values has to be decrypted. Sample code in Tokenhelper.cs private static SecureString stringClientSecret = EncryptionUtility.DecryptStringWithDPAPI(WebConfigurationManager.AppSettings.Get("ClientSecret")); private static readonly string ClientSecret = EncryptionUtility.ToInsecureString(stringClientSecret); Download complete solution - Governance.AddInSecurity

SharePoint Online–CSOM Change Access Requests Settings

ChandrasekarN — Thu, 31 Dec 2015 18:06:19 GMT

The Access Request in the Site settings > Site permissions is a feature which allows people to request access to content that they do not currently have permission to see. The setting that allows members to share the site and individual files and folders doesn’t overwrite the "Manage permissions" permission level, it works with permission level. When you select the "Allow members to share the site and individual files and folders" setting, the site members can send an invitation to the other users who have no permission, but this invitation will not take effect until the site owner approve it. As a site owner, you can go to Site settings > Access requests and invitations to approve or reject the invitation.

Default setting:

You can change these settings programmatically using CSOM.

To uncheck Allow Members to share the site and invite others, use this code;

// web is Microsoft.SharePoint.Client.Web object

            web.Context.Load(web, w => w.MembersCanShare);
            web.Context.ExecuteQuery();
            web.MembersCanShare = false;
            web.Update();
            web.Context.Load(web, w => w.MembersCanShare);
            web.Context.ExecuteQuery();

            web.Context.Load(web, w => w.AssociatedMemberGroup.AllowMembersEditMembership);
            web.Context.ExecuteQuery();
            web.AssociatedMemberGroup.AllowMembersEditMembership = false;
            web.AssociatedMemberGroup.Update();
            web.Context.Load(web, w => w.AssociatedMemberGroup.AllowMembersEditMembership);
            web.Context.ExecuteQuery();

To set a custom email address for Allow Access Requests, for e.g. email address of Site Owner, use this code; RequestAccessEmail property is available from Version 16.1.4727.1200 onwards. You can find the latest CSOM package for SharePoint online from the NuGet gallery with an id of Microsoft.SharePointOnline.CSOM

          clientContext.Load(clientContext.Web, w => w.RequestAccessEmail);
          clientContext.ExecuteQuery();
          clientContext.Web.RequestAccessEmail = clientContext.Site.Owner.Email;
          clientContext.Web.Update();
          clientContext.Load(clientContext.Web, w => w.RequestAccessEmail);
          clientContext.ExecuteQuery();

Custom setting using CSOM:

SP 2013 – PowerShell to Modify Help Setting on Site Collection

ChandrasekarN — Sat, 14 Jun 2014 19:52:11 GMT

Let’s say we want to enable/disable any of the help collection options available under Site Collection Administration settings. This can be done using SPSiteExtension class which contains all help related extension methods for the SPSite object.

Here is a simple script to disable Central Administration help

[System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Help")
$site = Get-SPSite https://2013-SP
[Microsoft.SharePoint.Help.SPSiteExtension]::DeactivateHelpCollection($site, "WSSCentralAdmin")

To activate and deactivate use ActivateHelpCollection and DeactivateHelpCollection method respectively.

To get the internal names of all those help collection properties, use the cmdlet Get-SPHelpCollection

SharePoint 2013 : Manage Other User Profiles

ChandrasekarN — Tue, 10 Dec 2013 13:05:32 GMT

SharePoint gives an option in UPSA to manage the user profiles of other users (like editing basic or contact information) in their mysite. To edit other users profile, we need to first give “Manage Profiles” permission to a user (who wants to manage) under UPSA.

Sometimes you might get UserNotFoundException when you access the user’s EditProfile.aspx page even though you have Manage Profiles permission.

You get this error if the user information is not found in UserInfo Table. If the user has never logged in before then there won’t be any reference in the UserInfo table. So the profile can be edited by other user only if the actual user had logged into the site at least once.