Commands › SharePoint Online

Set-SPOTenantRestrictedAppAccessControlList

SharePoint Online Microsoft.Online.SharePoint.PowerShell Set-*

Adds or removes application IDs in the tenant-wide Application Restrictions deny list in one atomic update.

Quick start script

# Set-SPOTenantRestrictedAppAccessControlList — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-SPOService -Url https://$org-admin.sharepoint.com

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-SPOTenantRestrictedAppAccessControlList
$before | Format-List

# 3. Make the change (dry run first)
Set-SPOTenantRestrictedAppAccessControlList  -WhatIf
Set-SPOTenantRestrictedAppAccessControlList

# 4. Verify and diff
$after = Get-SPOTenantRestrictedAppAccessControlList
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

Set-SPOTenantRestrictedAppAccessControlList [-AddRestrictedAppIds <Guid[]>] [-RemoveRestrictedAppIds <Guid[]>] [-WhatIf] [-Confirm] [<CommonParameters>]

Parameters (4)

ParameterTypeRequiredWhat it controls
-AddRestrictedAppIds Guid[] Specifies the application IDs to add to the tenant deny list. Each supplied ID is classified by using Microsoft Graph and stored internally as either a regular application or a parent agent blueprint. First-party or...
-RemoveRestrictedAppIds Guid[] Specifies the application IDs to remove from the tenant deny list. Removals are applied before additions and don't use Microsoft Graph, so stale or deleted application IDs can always be removed.
-Confirm SwitchParameter Prompts you for confirmation before running the cmdlet. This cmdlet uses `ConfirmImpact.High`, so it prompts by default. Use `-Confirm:$false` to suppress the prompt in automation. Suppressing the prompt doesn't...
-WhatIf SwitchParameter Shows what would happen if the cmdlet runs. The cmdlet isn't run.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.