Clear-SPOSiteRestrictedAppAccessControlPolicy

Module:
Microsoft.Online.SharePoint.PowerShell Module

Removes the complete Application Restrictions policy from a site. The cmdlet disables enforcement and removes the active mode and both lists.

Syntax

Default (Default) 

Clear-SPOSiteRestrictedAppAccessControlPolicy
    -Identity <String>
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

Description

Use the Clear-SPOSiteRestrictedAppAccessControlPolicy cmdlet to return a site to its unconfigured state. The cmdlet disables enforcement, removes the active mode and both lists, and clears the stored site policy. After the policy is cleared, the site is in the same state as a site that was never configured: enforcement is disabled and there are no entries.

Clearing is different from disabling. Disable-SPOSiteRestrictedAppAccessControl turns off enforcement but preserves the active mode and both lists so the same configuration can be re-enabled later. Use Clear-SPOSiteRestrictedAppAccessControlPolicy when you want the configuration removed as well. To clear only one list and keep the other list, the mode, and site enablement, use Clear-SPOSiteRestrictedAppAccessControlList.

Because the mode is removed along with the lists, a cleared site can't be enabled again until a mode is set. Enable-SPOSiteRestrictedAppAccessControl fails when no mode is set; enabled with mode None is the only combination the backend rejects. Rebuild the policy with Set-SPOSiteRestrictedAppAccessControlMode and Set-SPOSiteRestrictedAppAccessControlList, then enable it explicitly. Configuration and enablement are orthogonal: mode and list changes never turn enforcement on, so an administrator can stage a policy and then enable it. This avoids the dangerous case where adding a single ID to an unconfigured site would immediately activate an allow list and block every other application.

Clearing a site policy affects only that site. The tenant switch gates all site enforcement, and the tenant deny list can't be overridden by a site allow list, so clearing a site policy never restores access for an application that the tenant denies. Use Clear-SPOTenantRestrictedAppAccessControlPolicy for the tenant scope.

Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and Application Restrictions, so clearing a site policy doesn't grant any application access it doesn't already have.

Site Application Restrictions administration is isolated from the general-purpose Get-SPOSite and Set-SPOSite cmdlets. Application Restrictions is fully decoupled from SiteProperties, so Get-SPOSite doesn't load site policy data and Set-SPOSite can't change it. Use the dedicated Application Restrictions cmdlets listed in Related Links.

For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at Intro to SharePoint Online Management Shell.

Examples

Example 1

Clear-SPOSiteRestrictedAppAccessControlPolicy -Identity "https://contoso.sharepoint.com/sites/Finance"

This example removes the complete Application Restrictions policy from the Finance site. It disables enforcement and removes the active mode, allow list, and deny list.

Example 2

Clear-SPOSiteRestrictedAppAccessControlPolicy -Identity "e1b2c3d4-5678-4abc-9def-0123456789ab" -WhatIf

This example identifies the site by site ID and previews the change without modifying the policy. Every site Application Restrictions cmdlet accepts -Identity as either a site URL or a site ID.

Example 3

$url = "https://contoso.sharepoint.com/sites/Finance"
Clear-SPOSiteRestrictedAppAccessControlPolicy -Identity $url -Confirm:$false
Set-SPOSiteRestrictedAppAccessControlMode -Identity $url -Mode Deny
Set-SPOSiteRestrictedAppAccessControlList -Identity $url -ListType DenyList -AddRestrictedAppIds "11111111-1111-1111-1111-111111111111"
Enable-SPOSiteRestrictedAppAccessControl -Identity $url

This example removes an existing policy and then rebuilds it from scratch. Because the mode is removed when the policy is cleared, you must assign a mode to the site before you can enable it.

Parameters

-Confirm

Applicable: SharePoint Online

Prompts you for confirmation before running the cmdlet. This cmdlet uses ConfirmImpact.High, so it prompts by default. Use -Confirm:$false to suppress the prompt in automation.

Parameter properties

Type:System.Management.Automation.SwitchParameter
Default value:None
Supports wildcards:False
DontShow:False
Aliases:cf

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-Identity

Applicable: SharePoint Online

Specifies the site whose policy is cleared. Provide either the site URL or the site ID.

Parameter properties

Type:System.String
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-WhatIf

Applicable: SharePoint Online

Shows what would happen if the cmdlet runs. The cmdlet isn't run.

Parameter properties

Type:System.Management.Automation.SwitchParameter
Default value:None
Supports wildcards:False
DontShow:False
Aliases:wi

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Inputs

None

Outputs

None

This cmdlet doesn't return an object. Use Get-SPOSiteRestrictedAppAccessControl to confirm that the site is unconfigured.

Notes

  • Clearing a site policy disables enforcement, removes the active mode and both lists, and clears the stored site policy. A cleared site is indistinguishable from a site that was never configured.
  • To keep the configuration for later use, use Disable-SPOSiteRestrictedAppAccessControl instead. It preserves the active mode and both lists.
  • To clear only one list, use Clear-SPOSiteRestrictedAppAccessControlList, which preserves the other list, the active mode, and site enablement.
  • After clearing, the site can't be enabled until a mode is set. Enable-SPOSiteRestrictedAppAccessControl fails when no mode is set.
  • The tenant switch gates all site enforcement, so a site policy has no effect while the tenant switch is off. The tenant deny list can't be overridden by a site allow list.
  • Application Restrictions never grants permissions. A request must still pass existing SharePoint authorization.
  • This cmdlet supports -WhatIf and -Confirm with ConfirmImpact.High. -Confirm:$false is allowed for automation and doesn't bypass validation, authorization, auditing, or first-party protection.