Supported App-Only APIs for SharePoint Site Access and Group Membership (No PowerShell)?
a { text-decoration: none; color: #464feb; } tr th, tr td { border: 1px solid #e6e6e6; } tr th { background-color: #f5f5f5; } I am trying to determine the supported approach for retrieving SharePoint Site Owners, Members, and Visitors (effective user access) in an App-Only (Application Permissions) scenario without using PowerShell. Specifically, I am building an MCP tool that needs to: Check whether a specific user has access to a particular SharePoint site. Retrieve the list of users who have access to a SharePoint site, especially through the SharePoint Owners, Members, and Visitors groups. From my understanding, Microsoft Graph can be used to enumerate SharePoint sites and permissions, but retrieving the actual membership of the associated SharePoint groups does not appear to be fully supported through Graph alone. Most recommendations I have found suggest using SharePoint REST APIs, CSOM, or PnP-based solutions. My questions are: How can I retrieve SharePoint Site Owners, Members, and Visitors (effective user access) in an App-Only scenario without using PowerShell? Are there any supported Microsoft Graph APIs (including Beta APIs), SharePoint REST APIs, SDKs, Python libraries, CSOM, or other approaches that can provide this information? Can a backend service implemented entirely in code (without PowerShell execution) determine: Whether a specific user has access to a SharePoint site? The users belonging to the site's Owners, Members, and Visitors groups? The reason for asking is that I am developing a backend service, and invoking PowerShell from the application is not a practical option. I am looking for a supported API/SDK-based solution that can be implemented directly in code using App Registration permissions only.Microsoft Foundry Guardrails Getting in Your Way? Here’s How to Dial Them Down
How This All Started So here’s the story. I just got back from a trip and had a pile of footage sitting on my laptop. Being the lazy (sorry, efficient) person I am, I fired up OpenCode and asked GPT-6 Astra, running on Microsoft Foundry, to cut me a travelogue. Nothing fancy: under two minutes, nice lighting, clean transitions, no cringy effects, a quick QA before showing me, and the output in its own folder. Easy, right? Nope. This is what I got instead: “Image processing blocked due to content policy violation.” Seriously? It’s holiday footage! Nothing even remotely dodgy in there. This is a classic false positive from the default guardrails, and the good news is it’s totally fixable. Let me show you how. My Setup Quick context before we dive in: I’ve got two models deployed on Microsoft Foundry, gpt-6-astra and gpt-6-sol. Both were running on Microsoft’s out-of-the-box guardrail. Step 1: Find the Guardrails Page Head over to the Microsoft Foundry portal, click Build, then hit Guardrails in the left menu. You’ll see three guardrails that Microsoft gives you by default: Microsoft.Default, Microsoft.DefaultV2 and Microsoft.MAIDefault. Microsoft.DefaultV2 is the one every new deployment gets, which is why it’s sitting on both of my models. Here’s the catch: you can’t edit or delete these Microsoft-managed defaults. So instead of tweaking them, we’re going to build our own guardrail and swap it in. Step 2: Create Your Own Guardrail Smash that "Create" button and you’ll land on the Create guardrail page. This is where all the knobs and switches live: Every control has three bits: the risk type, the intervention point (does it check what you send in, what the model spits out, or both?) and the action. The magic trick for loosening things up is flipping the action from Block to Annotate. With Annotate, Foundry still scans the content and tags it in the API response, but it stops slamming the door on your request. So What Does Each Setting Actually Do? Before you go on a switching-off spree, it’s worth knowing what each of these does and what you’re giving up when you loosen it. Here’s the quick tour: Jailbreak: This one catches prompts trying to trick the model into ignoring its rules. On Block, those prompts get rejected outright. On Annotate, they go through with a flag. Turn it off completely and you’re trusting the model’s own training to keep it in line. Network (egress rules): Controls which outbound calls a hosted agent is allowed to make. As the portal points out, it only applies to hosted agents, so for plain model deployments like mine it doesn’t change a thing. Indirect prompt injections: Watches user input and tool responses (files, docs, web pages the model reads) for sneaky instructions someone has planted. Leave it on and your agents are protected when they read outside content; switch it off and a dodgy file could quietly hijack your model. For an agentic tool like OpenCode, which reads files and runs shell commands, I’d honestly keep this one on, even if it’s just on Annotate. Spotlighting (Preview): Tags external content inside the prompt so the model can tell your real instructions apart from random untrusted data. Think of it as an extra seatbelt against indirect attacks. Content harms (Hate, Sexual, Self-harm, Violence): Each of these has a severity slider that starts at Medium blocking, meaning anything rated medium or higher gets blocked. Slide it down to Lowest blocking and only the really nasty stuff gets stopped, which kills off most false positives like mine. The asterisk means these four are mandatory: you can turn the dial down, but you can’t switch them off. Blocklists: Want to ban specific words or phrases, like profanity or your competitor’s name? This is where you do it. It’s off by default. Protected material for code and text: Checks whether the model is about to spit out known copyrighted text (song lyrics, articles and so on) or code lifted from public repos. Block stops it; Annotate lets it through with a flag. Switch it off and you’re rolling the dice on your app reproducing someone else’s copyrighted work. Step 3: Pick Your Models Hit Next and Foundry asks which agents and models you want this guardrail on. Any model you’ve already deployed in your project shows up here. For me that’s gpt-6-astra and gpt-6-sol, so I ticked both. Step 4: Name It and Pick a Streaming Mode One more Next and you’re on the Review page. Give your guardrail a name (I went with NoGuardrails, because subtlety isn’t my thing) and pick a streaming mode. You’ve got two choices: Default: Foundry buffers the response and runs it through the guardrail before each chunk goes out. Nothing reaches the user until it’s been checked. Safest option, but you’ll feel a bit of lag when streaming. Asynchronous: Content streams back the moment it’s generated, with the filters running in the background. Much snappier, but flagged content might flash up briefly before the filter catches it, so your app has to clean up after the fact. Microsoft pitches this for low-latency stuff like internal dev tools, which is exactly my use case. Give the summary a quick once-over, then click Create. Done! Did It Work? Yep! With my shiny new guardrail in place, I fired off the exact same request, this time to GPT-6 Sol. And boom: no more content policy error. The model went straight to work scanning my footage and putting the video together. Wrapping Up Look, Microsoft’s default guardrails are a solid starting point, but they can be a bit trigger-happy when you’re doing perfectly legit stuff like video editing, creative work or internal tooling. Since you can’t touch the defaults, the trick is to roll your own: flip Block to Annotate where it makes sense, drag those content harm sliders down, pick the streaming mode that fits your app, and assign it to your deployments. That’s it! One friendly word of warning though: with great power comes great responsibility. Only loosen what you actually need, keep things like indirect prompt injection detection switched on for any agent that reads files or browses the web, and think twice before doing this on anything customer-facing. And if you want to go further than the portal lets you, like switching content filters off completely, you’ll need to apply to Microsoft for approval first. Happy building!
SharePoint Online site template that includes multiple languages when is created?
I have one site template , but the multilanguage must be created page by page with translate option, ¿is there one way to create a template english/spanish to be ready from start , that the user can only create site from template and be ready with two or more languages?
Applying Search Schema fails
Hi everyone, We've been fighting a SharePoint Online search issue at one of our customers since early July 2026. We've had a Microsoft Support case open for a few months, but it has hit a dead end. I'm posting here to find out whether others are seeing the same thing and whether anyone has found a workaround. Our setup An in-house ERP system syncs customers and projects to a SharePoint list, which serves as the provisioning master list. A provisioning engine (PnP PowerShell / PnP provisioning templates) creates a site for each item, using one of two templates: Customer site or Project site. During provisioning we apply: Property bag values at site level (for example, the account manager for a customer) Custom columns in the document libraries for document metadata SearchSettings in the XML template that map both the property bags and the columns to the default RefinableStringXX managed properties Some values link to managed metadata, and some are free text. This approach was designed together with the customer, and Microsoft Support confirmed that it is a supported implementation. The issue Applying the SearchSettings fails. Running Invoke-PnPSiteTemplate with the SearchSettings section returns one of these: Service unavailable now, please try again later. The request was canceled due to the configured HttpClient.Timeout of 100 seconds elapsing. Without SearchSettings, the template applies without problems. Even applying only the first line of the SearchSettings on a brand-new site causes the timeout. The Search Schema pages are extremely slow at both site collection and tenant level, much slower than in any other tenant we work in. The issue has now gotten worse. We can't create, modify or delete any managed property mapping, at either site collection or tenant level. Opening _layouts/15/selectcrawledproperty.aspx (for example, to edit RefinableString01) now always returns "Sorry, something went wrong. An unexpected error has occurred." What Microsoft Support told us At first, the case was pushed back as out of scope because we use PnP. After escalation, engineering confirmed that the behaviour matches a known issue: Search Schema pages load slowly when a large number of implicit properties and mappings exist. They confirmed it's not caused by misconfiguration on our side. However, there is no public documentation, no workaround, no fix and no ETA, and no further escalation path. They suggested we give feedback through the community, so here we are. Questions for the community Has anyone else run into this Search Schema latency or the "Service unavailable" error when applying SearchSettings, especially in tenants with many sites and mappings? Has anyone been able to reduce the number of implicit or crawled properties in a tenant, or "reset" the site-level search configuration, and did that help? Could this be related to the recent search migration issues reported in service health SP1393483 and in this thread? Are there any best practices or (unofficial) limits for the number of property bag values or library columns mapped to RefinableStrings across many sites? For example, does linking to managed metadata make it better or worse? Has anyone tried splitting the SearchSettings into smaller increments and applying them one by one? We're also looking at reducing the number of mappings and the number of sites that need search support. Still, it would be very helpful to understand the actual limit we're hitting, since this affects how we design future solutions as well. Thanks in advance for any insights!
Missing "search this library" bar in SharePoint
We have an office of (8) users on SharePoint and over the last week we've been experiencing the search functionality bar at top of page missing for handful of users and then reappearing later in the day. Is there a known issue regarding the search bar capability? Thank you!
PnP Modern Search v4 multitext column search on a non queryable managed property
In order to use PnP Search, i tried to map a crawled property into the Refinablestring managed one, however all of them does not have or allow to use the "queryable" property. Results in Copilot and GPT prompts say it should be checked, already tried to change in the site collection and in only one site. When i tried to create a new managed property, couldn't make it "refinable" but "queryable" was available for selection. The use of the filtering in the PnP Search would be: (1)One Sharepoint library with choice and text columns filled with metadata regarding PDF documents from my org, like tecnical notes, laws, etc. This one is intended to have some kind of search inside the doc too. (2)One Sharepoint list that would contain a text column with entire sections of a manual and a column with the sharepoint link to it inside a page. Expected behavior is: User types text -> Finds section -> Redirection. This manual is stored in SP Online as a page with collapsed sections and has lots of images and text, so it probably will be moved into more than one page shortly, the links are generated when the text webparts get some kind of "Title" on it. Its also on a PDF and thats roughly 500 pages now. The PnP webparts used are search, search verticals and search results. Any ideas if i can make the Refinablestring queryable or create a new property thats refinable?
Excel Desktop App hangs when attempting to open documents from SharePoint to edit
User attempts to open Excel Documents saved in SharePoint by selecting Edit in Desktop App. As the Excel Desktop App begins to open a message displays stating: We have opened this document in Microsoft Excel in your computer. However, the Excel App just hangs without fully opening (see Screenshot). No problem detected when opening the Excel Desktop app directly, Desktop App opens freely. Excel MS365 is up-to-date version 2609 build 16.0.20430 64 Bit (Before reinstall). I have uninstalled the MS365 Office packet and reinstall it directly from the User's Office Portal, to no avail.Hub Site association approval request fails with 403 Forbidden (previously working, regression)
Sites configured to require approval before joining our Hub Site are failing the association request with an HTTP 403 Forbidden error[browser DevTools Network tab}. This same workflow was functioning correctly as of [early August 2026]. Hub sites that do not require join approval continue to associate successfully — the failure is isolated specifically to the approval-required path. Steps to Reproduce As a site owner, go to Site Settings → Site Information (or Site Contents → hub association) on a site that is not yet associated with the hub. Attempt to associate it with [Hub Site URL], which has RequiresJoinApproval set to $true. Observe that the request fails immediately (or fails when the approver attempts to approve it — specify which point in the workflow fails). Repeat the same steps against a hub site that does not require approval — association succeeds without error. Expected Behavior The association request should be submitted and routed to the configured approver(s) for review, consistent with behavior observed as recently. Actual Behavior Request fails with HTTP 403 Forbidden. [browser DevTools Network tab - attached the HAR file for reference] Error Details HTTP Status: 403 Forbidden [browser DevTools Network tab - JoinHubSite(@v1)?@v1] Troubleshooting Already Performed Confirmed association without approval works (isolates the issue to the approval workflow specifically)
PowerPoint Brand Images: folders appear as tabs, but images only show under “All”
Hi, I’m testing PowerPoint Brand Images with a SharePoint Organizational Asset Library and I’m seeing unexpected behaviour with folders. The image library is registered correctly as an ImageDocumentLibrary. PowerPoint detects the library and all images are visible under All. I created several first-level folders in SharePoint, for example: Photos Icons Logos Test PowerPoint correctly reads these folders and shows them as separate tabs in Insert > Pictures > Brand Images. The issue: the tabs remain empty. For example, I created a completely new folder called Test directly in SharePoint and uploaded a new PNG directly into that folder. Result: Test appears as a tab in PowerPoint the PNG appears under All the PNG does not appear under Test I see exactly the same behaviour in PowerPoint Desktop and PowerPoint for the web. I have already checked: OrgAssetType: ImageDocumentLibrary Private CDN: enabled library registered as Private CDN origin CopilotSearchable: enabled SharePoint Online Management Shell: 16.0.27515.12000 PowerPoint Microsoft 365 Beta Channel, version 2609, build 16.0.20416.20004, 64-bit direct upload through SharePoint instead of OneDrive/File Explorer completely new folder and image manual reindexing of the SharePoint library So PowerPoint finds both the folder names and the images, but the folder-to-image relationship does not seem to work in Brand Images. Has anyone successfully used first-level SharePoint folders as working tabs in the new PowerPoint Brand Images experience? Is there an additional configuration step required, or could this be an issue with folder-scoped retrieval in the current rollout?SharePoint security broken between Microsoft 365 group and SharePoint group
Hi, Users are giving Member privilege through Teams, which gave them Member privilege in the Member SharePoint group. All good for 99% of the company. PROBLEM : I have 4 users without access to the SharePoint by this method. Security is not broken between Microsoft 365 Group and SharePoint group and is working fine for everybody else. Strangely, I saw that these 4 users are members of more than 1500+ Microsoft 365 Group, since they have been in the business for a long time and touch many projects here). I heard the limit is 7000 but they still have problem. Using the "Check permission", I got "None" for these people, but "Edit - Given through the XYZ Member group" for every other people in the Microsoft 365 Group. Any advice ? Thanks ! Patriccote
