Commands › SharePoint Online

Set-SPOSiteRestrictedAppAccessControlMode

SharePoint Online Microsoft.Online.SharePoint.PowerShell Set-*

Sets the active mode of the site-level Application Restrictions policy to `Allow` or `Deny`, preserving site enablement and both lists.

Quick start script

# Set-SPOSiteRestrictedAppAccessControlMode — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-SPOService -Url https://$org-admin.sharepoint.com

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-SPOSiteRestrictedAppAccessControlMode
$before | Format-List

# 3. Make the change (dry run first)
Set-SPOSiteRestrictedAppAccessControlMode -Identity <String> -Mode <String> -WhatIf
Set-SPOSiteRestrictedAppAccessControlMode -Identity <String> -Mode <String>

# 4. Verify and diff
$after = Get-SPOSiteRestrictedAppAccessControlMode
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

Set-SPOSiteRestrictedAppAccessControlMode [-Identity] <String> -Mode <String> [-WhatIf] [-Confirm] [<CommonParameters>]

Parameters (4)

Parameter	Type	Required	What it controls
-Identity	String	yes	Specifies the site to configure. You can specify either the site URL or the site ID.
-Mode	String	yes	Specifies the active mode of the site policy. Valid values are `Allow` and `Deny`.
-Confirm	SwitchParameter		Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation.
-WhatIf	SwitchParameter		Shows what would happen if the cmdlet runs. The cmdlet isn't run. `-WhatIf` displays the same mode-switch impact as the confirmation warning without changing the policy.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.