Disable-SPOSiteRestrictedAppAccessControl

Module:
Microsoft.Online.SharePoint.PowerShell Module

Turns off Application Restrictions enforcement for a site while preserving the active mode and both lists.

Syntax

Default (Default) 

Disable-SPOSiteRestrictedAppAccessControl
    -Identity <String>
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

Description

Use the Disable-SPOSiteRestrictedAppAccessControl cmdlet to turn off Application Restrictions enforcement for a single site while preserving the active mode and both lists. You can re-enable the same configuration later with Enable-SPOSiteRestrictedAppAccessControl.

Disabling a site is different from clearing it. To remove the mode and both lists and clear the stored site policy entirely, use Clear-SPOSiteRestrictedAppAccessControlPolicy.

Configuration and enablement are orthogonal. Mode and list changes never turn enforcement on, so after you disable a site you can continue to stage changes with Set-SPOSiteRestrictedAppAccessControlMode and Set-SPOSiteRestrictedAppAccessControlList without reactivating enforcement. Site enforcement is turned on only by Enable-SPOSiteRestrictedAppAccessControl.

While the site is disabled, no site-level Application Restrictions decision applies to requests for that site. Tenant-level policy is unaffected: the tenant switch gates all site enforcement, and the tenant deny list can't be overridden by a site allow list.

Application Restrictions adds a SharePoint authorization boundary for applications that already have Microsoft Entra consent and SharePoint permissions. It never grants permissions and it doesn't replace Entra consent. A request must pass both the existing permission model and Application Restrictions, so disabling a site policy doesn't grant any application access it doesn't already have.

Site Application Restrictions administration is isolated from the general-purpose Get-SPOSite and Set-SPOSite cmdlets. Application Restrictions is fully decoupled from SiteProperties, so Get-SPOSite doesn't load site policy data and Set-SPOSite can't change it. Use the dedicated Application Restrictions cmdlets listed in Related Links.

For permissions and the most current information about Windows PowerShell for SharePoint Online, see the online documentation at Intro to SharePoint Online Management Shell.

Examples

Example 1

Disable-SPOSiteRestrictedAppAccessControl -Identity "https://contoso.sharepoint.com/sites/Finance"

This example turns off Application Restrictions enforcement for the Finance site. The active mode, allow list, and deny list are preserved.

Example 2

Disable-SPOSiteRestrictedAppAccessControl -Identity "e1b2c3d4-5678-4abc-9def-0123456789ab" -WhatIf

This example uses a site ID and shows what would happen without changing the policy. Every site Application Restrictions cmdlet accepts -Identity as either a site URL or a site ID.

Example 3

$url = "https://contoso.sharepoint.com/sites/Finance"
Disable-SPOSiteRestrictedAppAccessControl -Identity $url -Confirm:$false
Get-SPOSiteRestrictedAppAccessControl -Identity $url

This example disables enforcement without an interactive prompt and then reads the policy back to confirm that the mode and both lists are still stored. Using -Confirm:$false doesn't bypass validation, authorization, auditing, or first-party protection.

Parameters

-Confirm

Applicable: SharePoint Online

Prompts you for confirmation before running the cmdlet. This cmdlet uses ConfirmImpact.High, so it prompts by default. Use -Confirm:$false to suppress the prompt in automation.

Parameter properties

Type:System.Management.Automation.SwitchParameter
Default value:None
Supports wildcards:False
DontShow:False
Aliases:cf

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-Identity

Applicable: SharePoint Online

Specifies the site to disable. Provide either the site URL or the site ID.

Parameter properties

Type:System.String
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:True
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-WhatIf

Applicable: SharePoint Online

Shows what would happen if the cmdlet runs. The cmdlet isn't run.

Parameter properties

Type:System.Management.Automation.SwitchParameter
Default value:None
Supports wildcards:False
DontShow:False
Aliases:wi

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Inputs

None

Outputs

None

This cmdlet doesn't return an object. Use Get-SPOSiteRestrictedAppAccessControl to read the resulting policy.

Notes

  • Disabling preserves the active mode and both lists. Use Clear-SPOSiteRestrictedAppAccessControlPolicy to remove the mode and lists and clear the stored site policy.
  • Site enforcement is turned on again only by Enable-SPOSiteRestrictedAppAccessControl. Mode and list changes never turn enforcement on.
  • The tenant switch gates all site enforcement, so a site policy has no effect while the tenant switch is off. The tenant deny list can't be overridden by a site allow list.
  • Application Restrictions never grants permissions. A request must still pass existing SharePoint authorization.
  • This cmdlet supports -WhatIf and -Confirm with ConfirmImpact.High. -Confirm:$false is allowed for automation and doesn't bypass validation, authorization, auditing, or first-party protection.