Skip to content

Document Agent User site and tenant restrictions #1203

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Rebecca Agiewich (rjagiewich) merged 4 commits into from
Oct 1, 2026
+81 −6
Merged

Document Agent User site and tenant restrictions #1203

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
401ade8
Document Agent User site and tenant restrictions
krishnatejagunda Sep 22, 2026
cc6b345
Merge branch 'main' into docs/restricted-for-ai-teammates
krishnatejagunda Oct 1, 2026
72cfb00
Revise examples for Set-SPOSite command
krishnatejagunda Oct 1, 2026
8f9c081
Restore example for Set-SPOTenant access control
krishnatejagunda Oct 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOSite.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,6 +162,14 @@ Get-SPOSite -Filter "Owner -like '$($userUPN)'"
```
This example retrieves all sites filtering by the specified owner using a variable.

### EXAMPLE 13

```powershell
Get-SPOSite -Identity https://contoso.sharepoint.com/sites/site1 | Select-Object Url, RestrictAccessControlForAgenticUser
```

This example returns whether Agent Users are restricted from accessing the site.

## PARAMETERS

### -ArchiveStatus
Expand Down
8 changes: 8 additions & 0 deletions sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Get-SPOTenant.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,14 @@ Get-SPOTenant

This example returns the organization-level site collection properties such as StorageQuota, StorageQuotaAllocated, ResourceQuota, ResourceQuotaAllocated, SiteCreationMode and OneDriveStorageQuota.

### Example 2

```powershell
Get-SPOTenant | Select-Object RestrictAccessControlForAgenticUser
```

This example returns whether Agent Users are restricted from accessing all sites in the organization.

## PARAMETERS

### CommonParameters
Expand Down
29 changes: 28 additions & 1 deletion sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOSite.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,7 @@ Set-SPOSite [-Identity] <SpoSitePipeBind> [-Owner <String>] [-Title <String>] [-
[-DefaultShareLinkRole <SharingRole>] [-BlockGuestsAsSiteAdmin <SharingState>]
[-FileAnonymousLinkType <AnonymousLinkType>] [-FolderAnonymousLinkType <AnonymousLinkType>]
[-RestrictContentOrgWideSearch <Boolean>] [-RestrictedContentDiscoveryforCopilotAndAgents <Boolean>]
[-RestrictAccessControlForAgenticUser <Boolean>]
[-RestrictedAccessControl <Boolean>] [-RestrictedAccessControlGroups <Guid[]>]
[-ListsShowHeaderAndNavigation <Boolean>] [-HidePeoplePreviewingFiles <Boolean>]
[-HidePeopleWhoHaveListsOpen <Boolean>] [-IsAuthoritative <Boolean>] [-AllowFileArchive <Boolean>]
Expand Down Expand Up @@ -388,13 +389,21 @@ Example 24 removes the version history limit override for video and audio file t

### Example 25


```powershell
Set-SPOSite -Identity https://contoso.sharepoint.com/sites/site1 -FolderAnonymousLinkType ViewUpload -FileAnonymousLinkType None
```

Example 25 sets a site level override for FolderAnonymousLinkType to limit anonymous and request files folder sharing to only support view and upload permissions and clears any site level override for the FileAnonymousLinkType by setting it to None.

### Example 26

```powershell
Set-SPOSite -Identity https://contoso.sharepoint.com/sites/site1 -RestrictAccessControlForAgenticUser $true
Get-SPOSite -Identity https://contoso.sharepoint.com/sites/site1 | Select-Object Url, RestrictAccessControlForAgenticUser
```

Example 26 restricts Agent Users from accessing the site and then returns the configured value. The policy is enforced at runtime and doesn't remove existing permissions.

## PARAMETERS

### -AddInformationSegment
Expand Down Expand Up @@ -2167,6 +2176,24 @@ Accept pipeline input: False
Accept wildcard characters: False
```

### -RestrictAccessControlForAgenticUser

> Applicable: SharePoint Online

Specifies whether Agent Users are restricted from accessing the site. Set this parameter to `$true` to block Agent Users at runtime, or `$false` to remove the site restriction. Changing this setting doesn't remove existing permissions.

```yaml
Type: System.Boolean
Parameter Sets: ParamSet1
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
```

### -RestrictedToGeo

> Applicable: SharePoint Online
Expand Down
42 changes: 37 additions & 5 deletions sharepoint/sharepoint-ps/Microsoft.Online.SharePoint.PowerShell/Set-SPOTenant.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,8 @@ Set-SPOTenant [-MinCompatibilityLevel <Int32>] [-MaxCompatibilityLevel <Int32>]
[-ViewInFileExplorerEnabled <Boolean>] [-AuthContextResilienceMode <SPResilienceModeType>]
[-ReduceTempTokenLifetimeEnabled <Boolean>] [-ReduceTempTokenLifetimeValue <Int32>]
[-ShowOpenInDesktopOptionForSyncedFiles <Boolean>] [-ShowPeoplePickerGroupSuggestionsForIB <Boolean>]
[-EnableRestrictedAccessControl <Boolean>] [-BlockDownloadFileTypePolicy <Boolean>]
[-EnableRestrictedAccessControl <Boolean>] [-RestrictAccessControlForAgenticUser <Boolean>]
[-BlockDownloadFileTypePolicy <Boolean>]
[-BlockDownloadFileTypeIds <SPBlockDownloadFileTypeId[]>] [-ExcludedBlockDownloadGroupIds <Guid[]>]
[-TlsTokenBindingPolicyValue <SPOTlsTokenBindingPolicyValue>] [-RecycleBinRetentionPeriod <Int32>]
[-IsEnableAppAuthPopUpEnabled <Boolean>] [-IsDataAccessInCardDesignerEnabled <Boolean>]
Expand Down Expand Up @@ -251,7 +252,8 @@ Set-SPOTenant [-MinCompatibilityLevel <Int32>] [-MaxCompatibilityLevel <Int32>]
[-ViewInFileExplorerEnabled <Boolean>] [-AuthContextResilienceMode <SPResilienceModeType>]
[-ReduceTempTokenLifetimeEnabled <Boolean>] [-ReduceTempTokenLifetimeValue <Int32>]
[-ShowOpenInDesktopOptionForSyncedFiles <Boolean>] [-ShowPeoplePickerGroupSuggestionsForIB <Boolean>]
[-EnableRestrictedAccessControl <Boolean>] [-BlockDownloadFileTypePolicy <Boolean>]
[-EnableRestrictedAccessControl <Boolean>] [-RestrictAccessControlForAgenticUser <Boolean>]
[-BlockDownloadFileTypePolicy <Boolean>]
[-BlockDownloadFileTypeIds <SPBlockDownloadFileTypeId[]>] [-ExcludedBlockDownloadGroupIds <Guid[]>]
[-TlsTokenBindingPolicyValue <SPOTlsTokenBindingPolicyValue>] [-RecycleBinRetentionPeriod <Int32>]
[-IsEnableAppAuthPopUpEnabled <Boolean>] [-IsDataAccessInCardDesignerEnabled <Boolean>]
Expand Down Expand Up @@ -390,7 +392,8 @@ Set-SPOTenant [-MinCompatibilityLevel <Int32>] [-MaxCompatibilityLevel <Int32>]
[-ViewInFileExplorerEnabled <Boolean>] [-AuthContextResilienceMode <SPResilienceModeType>]
[-ReduceTempTokenLifetimeEnabled <Boolean>] [-ReduceTempTokenLifetimeValue <Int32>]
[-ShowOpenInDesktopOptionForSyncedFiles <Boolean>] [-ShowPeoplePickerGroupSuggestionsForIB <Boolean>]
[-EnableRestrictedAccessControl <Boolean>] [-BlockDownloadFileTypePolicy <Boolean>]
[-EnableRestrictedAccessControl <Boolean>] [-RestrictAccessControlForAgenticUser <Boolean>]
[-BlockDownloadFileTypePolicy <Boolean>]
[-BlockDownloadFileTypeIds <SPBlockDownloadFileTypeId[]>] [-ExcludedBlockDownloadGroupIds <Guid[]>]
[-TlsTokenBindingPolicyValue <SPOTlsTokenBindingPolicyValue>] [-RecycleBinRetentionPeriod <Int32>]
[-IsEnableAppAuthPopUpEnabled <Boolean>] [-IsDataAccessInCardDesignerEnabled <Boolean>]
Expand Down Expand Up @@ -527,7 +530,8 @@ Set-SPOTenant [-MinCompatibilityLevel <Int32>] [-MaxCompatibilityLevel <Int32>]
[-ViewInFileExplorerEnabled <Boolean>] [-AuthContextResilienceMode <SPResilienceModeType>]
[-ReduceTempTokenLifetimeEnabled <Boolean>] [-ReduceTempTokenLifetimeValue <Int32>]
[-ShowOpenInDesktopOptionForSyncedFiles <Boolean>] [-ShowPeoplePickerGroupSuggestionsForIB <Boolean>]
[-EnableRestrictedAccessControl <Boolean>] [-BlockDownloadFileTypePolicy <Boolean>]
[-EnableRestrictedAccessControl <Boolean>] [-RestrictAccessControlForAgenticUser <Boolean>]
[-BlockDownloadFileTypePolicy <Boolean>]
[-BlockDownloadFileTypeIds <SPBlockDownloadFileTypeId[]>] [-ExcludedBlockDownloadGroupIds <Guid[]>]
[-TlsTokenBindingPolicyValue <SPOTlsTokenBindingPolicyValue>] [-RecycleBinRetentionPeriod <Int32>]
[-IsEnableAppAuthPopUpEnabled <Boolean>] [-IsDataAccessInCardDesignerEnabled <Boolean>]
Expand Down Expand Up @@ -664,7 +668,8 @@ Set-SPOTenant [-MinCompatibilityLevel <Int32>] [-MaxCompatibilityLevel <Int32>]
[-ViewInFileExplorerEnabled <Boolean>] [-AuthContextResilienceMode <SPResilienceModeType>]
[-ReduceTempTokenLifetimeEnabled <Boolean>] [-ReduceTempTokenLifetimeValue <Int32>]
[-ShowOpenInDesktopOptionForSyncedFiles <Boolean>] [-ShowPeoplePickerGroupSuggestionsForIB <Boolean>]
[-EnableRestrictedAccessControl <Boolean>] [-BlockDownloadFileTypePolicy <Boolean>]
[-EnableRestrictedAccessControl <Boolean>] [-RestrictAccessControlForAgenticUser <Boolean>]
[-BlockDownloadFileTypePolicy <Boolean>]
[-BlockDownloadFileTypeIds <SPBlockDownloadFileTypeId[]>] [-ExcludedBlockDownloadGroupIds <Guid[]>]
[-TlsTokenBindingPolicyValue <SPOTlsTokenBindingPolicyValue>] [-RecycleBinRetentionPeriod <Int32>]
[-IsEnableAppAuthPopUpEnabled <Boolean>] [-IsDataAccessInCardDesignerEnabled <Boolean>]
Expand Down Expand Up @@ -975,6 +980,15 @@ Get-SPOTenant | Select-Object SmartWikiEntryScope, SmartWikiEntrySelectedSitesLi

This example adds a site to the current selected sites list for the Smart Wiki library entry point without changing the scope. It then displays the current scope and the selected sites.

### EXAMPLE 32

```powershell
Set-SPOTenant -RestrictAccessControlForAgenticUser $true
Get-SPOTenant | Select-Object RestrictAccessControlForAgenticUser
```

This example restricts Agent Users from accessing all sites in the organization and then returns the configured value. The policy is enforced at runtime and doesn't remove existing permissions.

## PARAMETERS

### -AIBuilderModelScope
Expand Down Expand Up @@ -5439,6 +5453,24 @@ Accept pipeline input: False
Accept wildcard characters: False
```

### -RestrictAccessControlForAgenticUser

> Applicable: SharePoint Online

Specifies whether Agent Users are restricted from accessing all sites in the organization. Set this parameter to `$true` to block Agent Users at runtime, or `$false` to remove the organization-wide restriction. Changing this setting doesn't remove existing permissions.

```yaml
Type: System.Boolean
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
```

### -RestrictExternalSharing

> Applicable: SharePoint Online
Expand Down
Loading