Supported App-Only APIs for SharePoint Site Access and Group Membership (No PowerShell)?
a { text-decoration: none; color: #464feb; } tr th, tr td { border: 1px solid #e6e6e6; } tr th { background-color: #f5f5f5; } I am trying to determine the supported approach for retrieving SharePoint Site Owners, Members, and Visitors (effective user access) in an App-Only (Application Permissions) scenario without using PowerShell. Specifically, I am building an MCP tool that needs to: Check whether a specific user has access to a particular SharePoint site. Retrieve the list of users who have access to a SharePoint site, especially through the SharePoint Owners, Members, and Visitors groups. From my understanding, Microsoft Graph can be used to enumerate SharePoint sites and permissions, but retrieving the actual membership of the associated SharePoint groups does not appear to be fully supported through Graph alone. Most recommendations I have found suggest using SharePoint REST APIs, CSOM, or PnP-based solutions. My questions are: How can I retrieve SharePoint Site Owners, Members, and Visitors (effective user access) in an App-Only scenario without using PowerShell? Are there any supported Microsoft Graph APIs (including Beta APIs), SharePoint REST APIs, SDKs, Python libraries, CSOM, or other approaches that can provide this information? Can a backend service implemented entirely in code (without PowerShell execution) determine: Whether a specific user has access to a SharePoint site? The users belonging to the site's Owners, Members, and Visitors groups? The reason for asking is that I am developing a backend service, and invoking PowerShell from the application is not a practical option. I am looking for a supported API/SDK-based solution that can be implemented directly in code using App Registration permissions only.
Applying Search Schema fails
Hi everyone, We've been fighting a SharePoint Online search issue at one of our customers since early July 2026. We've had a Microsoft Support case open for a few months, but it has hit a dead end. I'm posting here to find out whether others are seeing the same thing and whether anyone has found a workaround. Our setup An in-house ERP system syncs customers and projects to a SharePoint list, which serves as the provisioning master list. A provisioning engine (PnP PowerShell / PnP provisioning templates) creates a site for each item, using one of two templates: Customer site or Project site. During provisioning we apply: Property bag values at site level (for example, the account manager for a customer) Custom columns in the document libraries for document metadata SearchSettings in the XML template that map both the property bags and the columns to the default RefinableStringXX managed properties Some values link to managed metadata, and some are free text. This approach was designed together with the customer, and Microsoft Support confirmed that it is a supported implementation. The issue Applying the SearchSettings fails. Running Invoke-PnPSiteTemplate with the SearchSettings section returns one of these: Service unavailable now, please try again later. The request was canceled due to the configured HttpClient.Timeout of 100 seconds elapsing. Without SearchSettings, the template applies without problems. Even applying only the first line of the SearchSettings on a brand-new site causes the timeout. The Search Schema pages are extremely slow at both site collection and tenant level, much slower than in any other tenant we work in. The issue has now gotten worse. We can't create, modify or delete any managed property mapping, at either site collection or tenant level. Opening _layouts/15/selectcrawledproperty.aspx (for example, to edit RefinableString01) now always returns "Sorry, something went wrong. An unexpected error has occurred." What Microsoft Support told us At first, the case was pushed back as out of scope because we use PnP. After escalation, engineering confirmed that the behaviour matches a known issue: Search Schema pages load slowly when a large number of implicit properties and mappings exist. They confirmed it's not caused by misconfiguration on our side. However, there is no public documentation, no workaround, no fix and no ETA, and no further escalation path. They suggested we give feedback through the community, so here we are. Questions for the community Has anyone else run into this Search Schema latency or the "Service unavailable" error when applying SearchSettings, especially in tenants with many sites and mappings? Has anyone been able to reduce the number of implicit or crawled properties in a tenant, or "reset" the site-level search configuration, and did that help? Could this be related to the recent search migration issues reported in service health SP1393483 and in this thread? Are there any best practices or (unofficial) limits for the number of property bag values or library columns mapped to RefinableStrings across many sites? For example, does linking to managed metadata make it better or worse? Has anyone tried splitting the SearchSettings into smaller increments and applying them one by one? We're also looking at reducing the number of mappings and the number of sites that need search support. Still, it would be very helpful to understand the actual limit we're hitting, since this affects how we design future solutions as well. Thanks in advance for any insights!SharePoint HTML Page Links Not Working? Heres How to Fix Them!
Suppose you create or upload an HTML page to the SharePoint Site Pages However, you may notice that some links work while others don't. When this happens, you might see the following error message: "This link can't be opened because your organization doesn't allow access to this site. " Microsoft supports only the following types of links when rendering HTML pages in SharePoint. đź”—Links within the same site đź”—Links within the same tenant đź”—Links that support navigation between pages And the follow type are not supported by Default đź”—Links to another Microsoft 365 tenant đź”—Links outside of SharePoint So How can we fix it? If a link doesn't open on your page, the destination may not be from an approved domain. This is expected behavior and is part of how SharePoint securely renders HTML pages. To allow the link, a site administrator must add the domain to the site's allow list. Go to Site Setting Gear Icon and Choose Site Information Choose "View all Site Settings" Select HTML Field Security. Add the relevant domain to the allow list - Remove Prefix like Https:// Save your changes and refresh the page. Once the domain is allowed, the link should open correctly. đź“şIn this video, I'll explain why hyperlinks can behave differently when HTML files are hosted in SharePoint and show you how to troubleshoot the most common issues. https://lnkd.in/dm86ir6i For offical article check this is https://support.microsoft.com/en-us/sharepoint/create-edit-publish-html-pages đź’¬ Have you experienced a SharePoint link issue? Let me know in the comments! đź‘Ť If you found this helpful, please Like, Subscribe, and turn on notifications for more SharePoint, Microsoft 365, and Copilot tips.
Advice for creating and migrating to a SharePoint Intranet
Hi all, I'm relatively new to SharePoint Online, having done a course in it and mostly self-practice since then, but I've never had to create an intranet for a company before and I just got a new job where one of my tasks is to create an intranet for a client using SharePoint Online. (I'm essentially a paid intern.) Before I give you the rundown, here is the premise and 'heads up': I'm aware of the different types of sites, such as Communication and Team sites which include M365 Groups, as well as the sites that don't include M365 Groups (for niche purposes I've heard.) I'm aware of the ability to set different permission levels at site level, library/list level, file/folder level, user level (though this is not recommended I've heard), and group level. I'm also aware (but not familiar with) Azure AD and having the ability to set separate permissions in the database for internal and external users, as well as https://learn.microsoft.com/en-us/sharepoint/sharepoint-azureb2b-integration Here's the rundown: The client has only ever used Windows File Explorer for document storage and email for sharing, never any cloud services. They want to switch to using cloud services as they are a new company and would like to set up an intranet for all their employees-to-come when they grow more. Currently, afaik, they are about 5 strong with 2 of those being the founders. We are trying to set up a SharePoint Online intranet for them where they ideally have separate places for each department, and within those departments they have a section each one can store restricted documents and collaboration in. (For example, HR restricted files would not be accessible by anyone but HR employees and CEO potentially, Finances would have reports only accountants and Managers/CEO could see etc.) The other sections of their departments can be accessible to anyone within the company, but not externally, for when they need to collaborate on things as a company. (Not sure if this is best practice though?) Suggestions on intranet structure using different SharePoint sites would be helpful. On the point of sharing, I have been trying to figure out the best way to be able to allow one of the founders, for example, to share a restricted document with one person for a limited time that is outside the company, but they need to be authenticated. This whole process kind of goes over my head. From what I've seen, the default permission setting for a SharePoint site/library can be set to a group or level you choose (the CEO/Founders level for example) but if they, on the off chance, need to send a single document to a contractor for say 6 months, is there a way to do this with permissions and Azure AD? I've read through https://learn.microsoft.com/en-us/microsoft-365/solutions/setup-secure-collaboration-with-teams?view=o365-worldwide, but I think I could use some extra help if possible. I could use the motto of "Muck around and find out", but I want to do a good job and save time with as few logic/set up mistakes as I can, hence my question here. Thanks in advance for taking the time to read this and reply if you do. (If this isn't the correct forum to ask this, please point me to a place I can ask in.)
SharePoint News Email “Content too large” issue – size limit clarification
Hi, We are currently trying to send a SharePoint News post via email and encountering the following error: “The contents of this page are too big to send in email.” We performed testing to understand the limitation and observed the following: Full newsletter (~5.29 MB) → ❌ Error Pages 1–12 (~3.11 MB) → ❌ Error Pages 1–11 (~2.80 MB) → ✅ Works Slight increase (~2.90 MB) → ❌ Error again ✅ Based on testing: Practical threshold seems around ~2.7–2.8 MB Above this, email rendering fails ❓ Questions: Is there a documented maximum size limit for SharePoint News email content? Is the limit based on: Total content size after rendering? Image count/size? Can this limit be configured or increased? What are the recommended best practices for image-heavy newsletters? ✅ Current understanding: It appears that the limitation is due to HTML email rendering size rather than just file size Any clarification or official guidance would be appreciated. Thanks.Confused about public CDN and if its required to host custom fonts
We would like to add custom fonts for our Intranet using SharePoint online. I see that to use the brand center you must enable a public CDN. We are concerned that our assets could be accessed anonymously when using the public CDN. Is there any way to enable the brand center with only assets stored in SharePoint online and not enable the CDN. Our offices are all based in the same region so CDN is not required.Custom fonts in SharePoint not working on my tenant (Brand center)
I'm trying to use the brand center to configure custom fonts and themes on my sites but it appears as the setup was not finished properly or something like that as I can't set custom fonts. I tried it first on my dev tenant where everything went according to the documentation but when I configured it on the main tenant something appears to have happened as it won't allow me to set the fonts. I've made some comparisons with the dev tenant, and it appears as if the list controlling the fonts was not created right (it's missing the content types and probably scripts that font list uses) Anyway... I haven't been able to find any way of fixing it nor recreating the site or even delete it so I'm kind of lost with this.
