Commands › SharePoint Online

Set-SPOSiteRestrictedAppAccessControlList

SharePoint Online Microsoft.Online.SharePoint.PowerShell Set-*

Adds or removes application IDs in a site's Application Restrictions allow or deny list in one atomic update.

Quick start script

# Set-SPOSiteRestrictedAppAccessControlList — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-SPOService -Url https://$org-admin.sharepoint.com

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-SPOSiteRestrictedAppAccessControlList
$before | Format-List

# 3. Make the change (dry run first)
Set-SPOSiteRestrictedAppAccessControlList -Identity <String> -ListType <String> -WhatIf
Set-SPOSiteRestrictedAppAccessControlList -Identity <String> -ListType <String>

# 4. Verify and diff
$after = Get-SPOSiteRestrictedAppAccessControlList
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

Set-SPOSiteRestrictedAppAccessControlList [-Identity] <String> -ListType <String> [-AddRestrictedAppIds <Guid[]>] [-RemoveRestrictedAppIds <Guid[]>] [-WhatIf] [-Confirm] [<CommonParameters>]

Parameters (6)

Parameter	Type	Required	What it controls
-Identity	String	yes	Specifies the site to configure. You can specify either the site URL or the site ID.
-ListType	String	yes	Specifies the list to change. Valid values are `AllowList` and `DenyList`. Entry mutations must explicitly identify the target list.
-AddRestrictedAppIds	Guid[]		Specifies the application IDs to add to the list identified by `-ListType`. You supply application IDs only; the backend classifies each added ID as a regular application or a parent agent blueprint and stores the...
-RemoveRestrictedAppIds	Guid[]		Specifies the application IDs to remove from the list identified by `-ListType`. Removals are applied before additions.
-Confirm	SwitchParameter		Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation.
-WhatIf	SwitchParameter		Shows what would happen if the cmdlet runs. The cmdlet isn't run.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.