+> If you've set up idle session timeout policies for [Outlook web app](https://support.microsoft.com/topic/description-of-the-activity-based-authentication-timeout-for-owa-in-office-365-0c101e1b-020e-69c1-a0b0-26532d60c0a4) and [SharePoint](/sharepoint/sign-out-inactive-users), turning on idle session timeout in the Microsoft 365 admin center will override the Outlook web app and SharePoint settings.

+ - OneDrive

+ - SharePoint

+ - If they're on a managed device (one that is compliant or joined to a domain) and using a supported browser like Microsoft Edge or Google Chrome (with the [Microsoft Single Sign On](https://chrome.google.com/webstore/detail/windows-accounts/ppnbnpeolgkicgegkbkbjmhlideopiji)) extension.

+### How should I prepare if my organization is already using existing Outlook web app and SharePoint idle timeout policies?

+If you're already using existing Outlook web app and SharePoint idle timeout policies, you can still turn on idle session timeout feature. When you turn on the idle timeout policy, it takes precedence over the existing Outlook web app and SharePoint Online policies. We're planning to deprecate the existing Outlook web app and SharePoint policies in the near future. To better prepare your organization, we recommend you turn on idle session timeout.

+- OneDrive

+- SharePoint

+### I'm active in Azure portal, but I'm logged out of other M365 Apps for inactivity. Why am I logged out?

+Azure portal supports a similar inactivity feature, but is supported by Azure portal only. For more information, see [Azure portal: Signing-Out + Notification](/azure/azure-portal/set-preferences#signing-out--notifications).

+ Title: "Organizational messages in the Microsoft 365 admin center"

+f1.keywords:

+- NOCSH

+audience: Admin

+ms.localizationpriority: medium

+- Tier2

+- scotvorg

+- M365-subscription-management

+- Adm_O365

+- Adm_TOC

+search.appverid:

+- MET150

+- MOE150

+description: "Learn how to send messages to your organization in Microsoft 365 using organizational messages in the Microsoft 365 admin center."

+# Organizational messages in the Microsoft 365 admin center

+As an admin, you can now connect with your organization through customized messages using organizational messages, available in the Microsoft 365 admin center under **Reports**. This feature allows you to create and manage messages, and review delivery reports, all from a central location. Organizational Messages enhance in-product experiences, supporting remote and hybrid work scenarios, such as providing educational materials for employees, information on Microsoft 365 service or license availability, and updates on organizational initiatives. Use the power of organizational messages in the Microsoft 365 admin center to streamline your outreach within Microsoft products.

+To get started, go to [organizational messages in the Microsoft 365 admin center](https://aka.ms/organizationalmessagesportal).

+>[!NOTE]

+> The experience will start rolling out in preview on May 2, 2024.

+## What can I do with organizational messages?

+Organizational messagesΓÇÖ centralized experience within Microsoft 365 admin center includes the following features and capabilities:

+- Create messages from scratch (for example, free text entry)

+- Use premade template messages from Microsoft

+- Send messages to the Windows Spotlight location

+- Save draft messages

+- Reject or Approve customized messages

+- Add images or icons to messages

+- Specify custom destination URLs

+- Configure delivery schedules and parameters for messages

+- Assign targeting via Entra user groups and advanced targeting options

+- Manage messages created in Microsoft 365 admin center and other portals

+- Review message performance with time series data

+## Setup requirements

+Before working with organizational messages, make sure your team satisfies the following requirements:

+- **Tenant** see [Setting tenant policies](#setting-tenant-policies).

+- **Authors** anyone in your organization who wants to create messages must have one of these following admin roles assigned to them within Microsoft 365 admin center:

+ - [Global Administrator](/azure/active-directory/roles/permissions-reference#global-administrator)

+ - [Organizational Messages Writer](/azure/active-directory/roles/permissions-reference#organizational-messages-writer)

+- **Approvers** anyone in your organization who will be designated a responsible party for approving customized messages must have one of these following admin roles assigned to them within Microsoft 365 admin center:

+ - [Global Administrator](/azure/active-directory/roles/permissions-reference#global-administrator)

+ - [Organizational Messages Approver](/entra/identity/role-based-access-control/permissions-reference#organizational-messages-approver)

+- **Message recipients** anyone in your organization who might receive messages from your authors must have access to the Microsoft products to which the messages are configured to be delivered. (End users aren't required to have any Entra roles to receive organizational messages.)

+ - For example, any message configured to be delivered to a Windows channel, like Windows Spotlight, requires that recipients use **Windows 11 Enterprise**.

+> [!IMPORTANT]

+> Organizational messages preview features will not be restricted based on the licenses held by participating tenants, authors, approvers, or message recipients. However, some organizational messages features might be restricted to particular Microsoft licenses in the future.

+## Get started

+There are three basic experiences to familiarize yourself with within the organizational messages centralized experience:

+1. **Manage** ΓÇô this is where you and your team will be able to see most of your organizational messages created in various portals, including Intune/Microsoft Endpoint Manager. Your team will also be able to execute various functions on each message, view details, and conduct approval flows in the ΓÇÿManageΓÇÖ area.

+2. **Create a message** ΓÇô this wizard is where anyone with the above-described ΓÇ£Organizational Messages WriterΓÇ¥ Entra role can go to create either fully customized or templatized messages.

+3. **Review activity** ΓÇô This is where your admins can go to see the performance activity of messages that are or have been delivering to your users.

+## Manage

+You can review and control the messages from anyone in their organization using the main landing experience. Operations that admins can affect within the ΓÇÿManageΓÇÖ experience include:

+- Filtering based on message status (such as Active), location (such as Windows Spotlight), or objective (such as Adoption); filtering using search on message name.

+- Reviewing existing message details (such as language, targeting, among others).

+- Understanding aggregate performance data per message.

+- Cancelling, deleting, approving, copying messages.

+### How to continue creating a draft message (Modify)

+If you have the Organizational Messages Writer Entra role as described above, you can edit or otherwise complete a saved ΓÇÿdraftΓÇÖ message in your tenant. To do so:

+1. Filter Status to **Draft**.

+2. Select the message name of the message you want to edit.

+3. In the message details panel, select **Modify**.

+4. This takes you directly into the creation wizard where you can continue the creation of this draft message.

+### How to approve or reject a ΓÇÿpending approvalΓÇÖ message

+If you have the Organizational Messages Approver Entra role as described above, you can review and approve or reject messages from your colleagues that are in the ΓÇÿpending approvalΓÇÖ state. To approve or reject a ΓÇÿpending approvalΓÇÖ message:

+1. Filter Status to **Pending approval**.

+2. Select the message name of the message you want to review.

+3. In the message details panel, read through all of the content provided by the author.

+4. If you believe this message is appropriate for delivering to users in your tenant, you can optionally add a comment and select **Approve**.

+5. However, if you believe the message is not ready or appropriate for delivering to your tenantΓÇÖs users, you must add a comment in the text field and select **Reject**.

+### How to overcome a rejected message (Withdraw)

+If you have the Organizational Messages Writer Entra role as described above, you can overcome a rejection from the approvers in your tenant. To do so:

+1. Filter status to **Rejected**.

+2. On the message name of the rejected message you want to overcome, select **Withdraw**.

+3. This sets the state of the rejected message to **Draft**.

+4. From there, you can go to the message details panel, select **Modify**.

+5. This takes you directly into the creation wizard where you can continue the creation of this draft message, once again sending for approval to return the message to approvers for review.

+> [!NOTE]

+> - Fully customized messages will require an approver to ΓÇÿapproveΓÇÖ any message before it is delivered to your users. However, selecting a premade message will not require any approval from your organization before it can be delivered to end users.

+> - Approvers cannot approve or reject a message that they personally created.

+> - ΓÇÿRejectingΓÇÖ a message will mark the message state as 'Rejected', requiring an author to ΓÇÿWithdrawΓÇÖ the message and then ΓÇÿModifyΓÇÖ the new draft.

+> - Messages that are not reviewed (such as, approved or rejected) by approvers before the set 'End date' of the message will automatically be rejected by the system to ensure minimum duration of delivery of messages are as expected by authors.

+## Create a message

+Users with the Organizational Messages Writer Entra role described previously will have access to the **Create a message** button and capability in the centralized experience. Selecting this button will invoke the wizard, which includes these primary creation steps:

+- **Objective** for selecting the nature or purpose of your new message.

+- **Location** for indicating to which in-product channel the message will be sent for your users.

+- **Template** for choosing the format of the message, ΓÇÿcreate your ownΓÇÖ or a premade message from Microsoft.

+- **Customize** for adding customization to the message, including full text and/or custom URLs.

+- **Recipients** for setting the groups within your organization that should receive the message.

+- **Schedule** for configuring the start and end dates as well as the frequency with which the system will send the message to the same user over time.

+- **Finish** for reviewing the message before scheduling or sending for approval by your organizationΓÇÖs approvers.

+### Choosing custom or premade messages

+There are two primary forms of message creation that are enabled in this experience:

+1. **Fully customized creation** (or 'create your own') ΓÇô this is an open-ended format of entering in arbitrary content for messages, allowing your team to make messages that include your company name or other specifics that are unique to your company, group, or team. For example, an author can select ΓÇÿcreate your ownΓÇÖ and type all of the words of the message themselves.

+2. **Premade messages** (or ΓÇÿtemplatizedΓÇÖ messages) ΓÇô this is a method of selecting and customizing content that is partially created by Microsoft for general purpose use. For example, Microsoft might provide various generic messages that your team can pick and add your logo and URL to drive awareness of a software update.

+### How to save and continue draft message

+1. Notice that throughout the creation wizard, each step has a **Save and close** button.

+2. You can select **Save and close** at any point to save the message as a new draft.

+3. Once saved, you'll see your message at the top of the Manage table.

+4. To go back to making your message, select the draft messageΓÇÖs name to invoke the message details panel.

+5. Select **Modify** in the message details panel to continue creating that message in the creation wizard.

+### How to create a message by copying an existing message

+1. Go the Manage experience and find a message you want to use as a starting point.

+2. Select **Copy** function.

+3. You'll be immediately placed within the creation wizard with relevant elements from the previous message copied over.

+4. Edit as you like and complete the creation wizard or save as a draft.

+> [!NOTE]

+> - For the same channel (such as Windows Spotlight), images provided by your team for the last created message will be automatically provided for your next message. However, you can override that image with a new image upload.

+> - Once you select ΓÇÿSend for approvalΓÇÖ at the end of a fully customized message creation flow, anyone in your tenant that has the ΓÇ£Organizational Messages ApproverΓÇ¥ Entra role described above will be able to review and approve/reject your message.

+> - If you save your draft before the ΓÇÿScheduleΓÇÖ step and thus do not provide a custom message name, the Draft will have a programmatically generated name based on the date-time when you saved the draft. You can edit this message name by modifying the draft message.

+> - Not all selections in the ΓÇÿObjectiveΓÇÖ step might have premade messages available. However, all objectives will have the ΓÇ£create your ownΓÇÖ format available for full customization authoring.

+## Review activity

+As you can see upon visiting the centralized experience, the basic Manage table includes basic aggregate insights data for your messages (including Total messages seen, Total clicks, and Clickthrough rate). However, the centralized experience also includes advanced insights experiences, including:

+- Filtering on time range, status, and other aspects,

+- Graphing of selected date range,

+- Data export to CSV

+You'll also see three time-series data charts at the top, showing daily changes in the Total messages seen (or impressions), Total clicks, and Clickthrough rate for your messages.

+### How to export data

+If you or your team would like to work with your tenantΓÇÖs message performance data, you can export it to a CSV file. To do so:

+1. Set the filters, including time range, for the data youΓÇÖre interested in retrieving.

+2. Select the **Export to CSV** button and save the file locally.

+## Advanced features

+Rolling out in spring 2024, organizational messages will also include two more features that provide advanced capabilities for how admins can schedule and direct their messages:

+### Urgent delivery

+For some time-sensitive communications, admins and other communicators might need to get a message out fast. For example, when an event is occurring on a corporate campus or a service outage has begun, admins might need to quickly broadcast such events to all employees so they can be prepared. To support communications in such events, admins in Microsoft 365 admin center will be able to select the ΓÇÿUrgent messagesΓÇÖ button in the ΓÇ£Top ActionsΓÇ¥ section.

+## Setting tenant policies

+There are certain policies in [Microsoft Intune](https://intune.microsoft.com) that will block the delivery of organizational messages to your end users if not configured properly. This section describes how to adjust all policy settings for your tenant so that delivery is always allowed and works as intended.

+### General Instructions

+To make policy changes on your tenant, your Intune admin must:

+1. Sign in to the Microsoft Endpoint Manager admin center for your tenant.

+1. Configure the policies described below using a Microsoft Intune device restrictions profile template or the settings catalog.

+1. Make sure to adjust these policies in all new and existing policies that are targeted at end users and devices that may receive organizational messages.

+1. Enable Organizational Messages Policy

+>[!NOTE]

+> This policy is required for devices running [Windows 11](https://support.microsoft.com/topic/november-29-2022-kb5020044-os-build-22621-900-preview-43f0bdf9-0b75-4110-bab3-3bd2433d84b3), [version 22H2](https://support.microsoft.com/topic/november-29-2022-kb5020044-os-build-22621-900-preview-43f0bdf9-0b75-4110-bab3-3bd2433d84b3), [build 10.0.22621.900](https://support.microsoft.com/topic/november-29-2022-kb5020044-os-build-22621-900-preview-43f0bdf9-0b75-4110-bab3-3bd2433d84b3) and later. If you don't enable this policy, these devices can't receive organizational messages. The policy isn't required on devices running earlier builds.

+1. Go to **Settings catalog** > **Experience** > **Enable delivery of organizational messages (User)**.

+1. To enable delivery of organizational messages, switch the toggle to **Enabled**.

+### Enable Experiences Policies

+>[!NOTE]

+> If you use the Windows 11 MDM security baseline, you will need to change the required policies to **Not configured**. These policies control organizational messages configured by your team as well as other messages coming directly from Microsoft. To continue blocking messages coming directly from Microsoft as defined in the Windows 11 MDM security baseline, [configure the Microsoft messaging policy](/mem/intune/remote-actions/organizational-messages-prerequisites#microsoft-messaging-policy).

+If using Settings catalog, follow these steps:

+(This can be in a new or existing Windows configuration profile.)

+1. Go to **Devices** > **Windows** > **Configuration profiles**.

+1. Select **Settings catalog**.

+1. Select **Add Settings**.

+1. In Settings picker, select **Experience category**.

+1. In configuration settings, ensure the following are selected or set to ΓÇÿAllowΓÇÖ:

+ - Add Allow Windows Spotlight (User)

+ - Allow Tailored Experiences with Diagnostic Data (User)

+ - Add Third Party Suggestions in Windows Spotlight (User)

+ - Add Windows Consumer Features

+ - Add Allow Windows Spotlight on Action Center (User)

+ - Add Allow Windows Tips

+ - Add Configure Windows Spotlight on Lock Screen (User)

+1. In configuration settings, ensure the following are de-selected:

+ - Disable Cloud Optimized Content

+1. In configuration settings, ensure the following are selected or set to ΓÇÿAllowΓÇÖ:

+ - Enable delivery of organizational messages (User)

+If using Device Restrictions, follow these steps:

+(This can be in a new or existing Windows configuration profile.)

+1. Go to **Devices** > **Windows** > **Configuration profiles**.

+1. In a new or existing template profile select **Device restrictions** > **Windows Spotlight**.

+1. Ensure or Select ΓÇÿNot configuredΓÇÖ is set for the following:

+ - Windows Spotlight

+ - Windows Spotlight on lock screen

+ - Consumer features

+ - Windows Tips

+ - Windows Spotlight in action center

+ - Windows Spotlight personalization

+## FAQ

+### Can you tell me more about delivery expectations for these messages?

+After your message has been scheduled by the Organizational Messages platform, at the earliest, it will take a few hours before the message will be eligible to be delivered to end user devices. For example, if you set the Start Date to be now/today, you should expect a few hours before any end user devices in your testing tenant receive the message payload.

+Further, Windows 11 buffers messages on a set period for each of the channels. (In other words, this experience is delivered on a ΓÇÿpullΓÇÖ model.) So, expect that your message might take 24 or more hours for targeted end users in your testing tenant to receive and render the message as their devices might be configured to request content at different times.

+Once your message has been actively delivering for over 24 hours, you can return to the Manage experience to review the latest delivery data for your message.

+### My team has made other organizational messages within Intune, Adoption Score, Usage reports, and others. How do they work with this?

+The Organizational messages centralized experience is the ΓÇÿone-stop-shopΓÇÖ for organizational messages. You should be able to see and manage your other messages from the centralized experience, regardless of where they were created.

+> [!NOTE]

+> - Adoption Score organizational messages on Office or Outlook channels are not visible in the centralized experience.

+> - Intune organizational messages can only be read in the centralized experience (such as, cannot be canceled or deleted).

+> - We expect this to change in future releases within the 2024 calendar year.

+### How do admins get the required permissions?

+ Reach out to a Global admin and ask them to assign you Organizational Messages Writer or Organizational Message Approver Entra role to you following these steps:

+1. Global Admin of target testing tenant goes to **Microsoft 365 Admin Center > Active Users**.

+2. Search for or otherwise select target user in Active users table.

+3. Select the **Manage roles** button in the top navigation bar.

+4. Select **Organizational Messages Writer** or **Organizational Messages Approver** in the **Other** section, and then select **Save changes**.

+### Why do I need to update my MDM policies?

+The MDM policies listed under Prerequisites control whether the service delivering the messages is able to access each location where organizational messages could be delivered. Previously, the CSPs only affected consumer scenarios and controlled whether Microsoft messaging can be delivered, however, since weΓÇÖre using the same service, the policies affect admin-created messages as well.

+### How can I get my MDM settings for troubleshooting purposes?

+1. Run *ms-settings:workplace*

+2. In the **Export your management log files** section, select **Export**.

+3. Get the resulting file in *C:\Users\Public\Documents\MDMDiagnostics*.

+### How can I get my user and device ID for troubleshooting purposes?

+1. Launch MS Feedback Hub

+2. Select **Settings** in the bottom left-hand corner.

+3. Navigate to the **Device Information** section

+### Where can I find more information on the Configuration Service Provider (CSP) policies related to Organizational Messages?

+You can find more information in the following documents:

+- [Experience/AllowWindowsSpotlight](/windows/client-management/mdm/policy-csp-experience#experience-allowwindowsspotlight)

+- [Experience/AllowWindowsTips](/windows/client-management/mdm/policy-csp-experience#experience-allowwindowstips)

+- [Experience/AllowWindowsSpotlightOnActionCenter](/windows/client-management/mdm/policy-csp-experience#experience-allowwindowsspotlightonactioncenter)

+- [Experience/DisableCloudOptimizedContent](/windows/client-management/mdm/policy-csp-experience#experience-disablecloudoptimizedcontent)

+- [Experience/ConfigureWindowsSpotlightOnLockScreen](/windows/client-management/mdm/policy-csp-experience#experience-configurewindowsspotlightonlockscreen)

+- [Experience/AllowSpotlightCollection](/windows/client-management/mdm/policy-csp-experience#experience-allowspotlightcollection)

+- [Experience/AllowWindowsConsumerFeatures](/windows/client-management/mdm/policy-csp-experience#experience-allowwindowsconsumerfeatures)

+- [Experience/AllowTailoredExperiencesWithDiagnosticData](/en-us/windows/client-management/mdm/policy-csp-experience#experience-allowtailoredexperienceswithdiagnosticdata)

+- [Experience/AllowThirdPartySuggestionsInWindowsSpotlight](/windows/client-management/mdm/policy-csp-experience#experience-allowthirdpartysuggestionsinwindowsspotlight)

+### Where can I find more information on Organizational Messages experiences?

+There are several other public Microsoft documents for our other preview product experiences:

+- [Overview of organizational messages in Microsoft Intune](/mem/intune/remote-actions/organizational-messages-overview)

+### What do the different message states mean?

+All messages have a state that indicates their creation or delivery status, including:

+1. **Completed** ΓÇô message has successfully run its course as defined by Start and end dates.

+2. **Pending** ΓÇô message is still being registered by the organizational messages services and thus is not delivering. Additionally, certain details of the message might be unavailable while in ΓÇÿpendingΓÇÖ state.

+3. **Failed** ΓÇô message was not able to be properly registered by the organizational messages services for various reasons. These messages will need to be copied to retry the process.

+4. **Cancelled** ΓÇô message was explicitly stopped by your tenant admin. This might have been during delivery of the message or prior (that is, in Scheduled state).

+5. **Active** ΓÇô message is currently delivering to your users.

+6. **Draft** ΓÇô message has not been completed or otherwise submitted for scheduling and/or approval. Any of your tenantΓÇÖs writers can continue a draft to completion via the creation flow.

+7. **Scheduled** ΓÇô message has been properly authored and is awaiting delivery (at which time it will be coded as ΓÇÿActive)

+8. **Rejected** ΓÇô message was reviewed, and an Approver admin disallowed it from proceeding to a Scheduled or Active state.

+9. **Pending approval** ΓÇô message is awaiting review by an Approver admin.

+1. In the admin center, go to the **Billing** > [Billing accounts](https://go.microsoft.com/fwlink/p/?linkid=2102895" target="_blank") page.

+1. On the **Overview** tab, select a billing account.

+1. On the billing account details page, select the **Billing profiles** tab. The tab lists all billing profiles associated with the selected billing account.

+1. Select a billing profile name to view its details page.

+1. In the **Invoice and Billing Notifications** section, select **Edit settings**.

+1. In the **Invoice email settings** pane, under **Get invoices in email attachments**, switch the toggle to **On**.

+1. If needed, add any additional recipient email addresses, then select **Save Changes**.

+Configuring _Geography_ admins requires the SharePoint PowerShell module.

+You can add a security group or a mail-enabled security group as a _Geography_ admin. (Distribution groups and Microsoft 365 Groups aren't supported.)

+Note that not all security groups have a group alias. If you want to add a security group that doesn't have an alias, run [Get-MgGroup](/powershell/module/microsoft.graph.groups/get-mggroup) to retrieve a list of groups, find your security group's ObjectID, and then run:

+## Related articles

+1. Network connectivity that might be required from a Microsoft datacenter to a customer network (inbound hybrid server network traffic).

+|4|**STS** such as AD FS Proxy servers (for federated customers only)|Customer STS (such as AD FS Proxy) \| Ports TCP 443 or TCP 49443 w/ClientTLS|Inbound server traffic|

+|6|**Mailbox Migration**<p>When mailbox migration is initiated from on-premises [Exchange Hybrid](/exchange/exchange-deployment-assistant) to Microsoft 365, Microsoft 365 connects to your published Exchange Web Services (EWS)/Mailbox Replication Services (MRS) server. If you need to allow inbound connections only from specific source IP ranges, create a permit rule for the IP addresses listed in the **Exchange Online** table in [Microsoft 365 URL & IP ranges](urls-and-ip-address-ranges.md). <p> To ensure that connectivity to published EWS endpoints (like OWA) isn't blocked, make sure the MRS proxy resolves to a separate FQDN and public IP address before you restrict connections.|Customer on-premises EWS/MRS Proxy <br> TCP port 443|Inbound server traffic|

+|24|**Network Connection Status Indicator**<p>Used by Windows 10 and 11 to determine if the computer is connected to the internet (does not apply to non-Windows clients). When this URL cannot be reached, Windows assumes it isn't connected to the Internet and M365 Apps for Enterprise will not try to verify activation status, causing connections to Exchange and other services to fail.|www.msftconnecttest.com <br> <p> Also see [Manage connection endpoints for Windows 11 Enterprise](/windows/privacy/manage-windows-11-endpoints) and [Manage connection endpoints for Windows 10 Enterprise, version 21H2](/windows/privacy/manage-windows-21h2-endpoints).|Outbound server-only traffic|

+- OneDrive

+Please review [Configure Search for OneDrive Multi-Geo](configure-search-for-multi-geo.md) for instructions including any limitations and differences.

+OneDrive:

+Select OneDrive from the Microsoft 365 app launcher and confirm that you are automatically directed to the appropriate _Geography_ location for the user, based on the user's PDL. OneDrive should now begin provisioning at that location. Once provisioned, try uploading and downloading some documents.

+Log in to your OneDrive mobile App with your test account credentials. Confirm that you can see your OneDrive files and can interact with them from your mobile device.

+Confirm that the OneDrive sync client automatically detects your OneDrive _Geography_ location upon login. If you need to download the sync client, you can click **Sync** in the OneDrive library.

+Confirm that you can access OneDrive by logging in from an Office application, such as Word. Open the Office application and select **OneDrive ΓÇô \<TenantName\>**. Office will detect your OneDrive location and show you the files that you can open.

+Try sharing OneDrive files. Confirm that the people picker shows you all your SharePoint users regardless of their _Geography_ location.

+CDNs help keep Microsoft 365 fast and reliable for end users. Cloud services like Microsoft 365 use CDNs to cache static assets closer to the browsers requesting them to speed up downloads and reduce perceived end user latency. The information in this article will help you learn about Content Delivery Networks (CDNs) and how they're used by Microsoft 365.

+CDNs are commonly used to provide faster downloads of generic content for a web site or service such as JavaScript files, icons and images, and can also provide private access to user content such as files in SharePoint document libraries, streaming media files, and custom code.

+The built-in Microsoft 365 Content Delivery Network (CDN) allows Microsoft 365 administrators to provide better performance for their organization's SharePoint pages by caching static assets closer to the browsers requesting them, which helps to speed up downloads and reduce latency. The Microsoft 365 CDN uses the [HTTP/2 protocol](https://en.wikipedia.org/wiki/HTTP/2) for improved compression and download speeds.

+Content in **public** origins within the Microsoft 365 CDN is accessible anonymously, and can be accessed by anyone who has URLs to hosted assets. Because access to content in public origins is anonymous, you should only use them to cache non-sensitive generic content such as JavaScript files, scripts, icons and images. The Microsoft 365 CDN is used by default for downloading generic resource assets like the Microsoft 365 client applications from a public origin.

+**Private** origins within the Microsoft 365 CDN provide private access to user content such as SharePoint document libraries, sites and proprietary images. Access to content in private origins is secured with dynamically generated tokens so it can only be accessed by users with permissions to the original document library or storage location. Private origins in the Microsoft 365 CDN can only be used for SharePoint content, and you can only access assets through redirection from your SharePoint tenant.

+The Microsoft 365 CDN service is included as part of your SharePoint subscription.

+For more information about how to use the Microsoft 365 CDN, see [Use the Microsoft 365 content delivery network with SharePoint](use-microsoft-365-cdn-with-spo.md).

+>Beginning in Q3 2020, SharePoint will begin caching videos on the Azure CDN to support improved video playback and reliability. Popular videos will be streamed from the CDN endpoint closest to the user. This data will remain within the Microsoft Purview boundary. This is a free service for all tenants and it does not require any customer action to configure.

+ b. If the data is already cached in a _private_ origin, the CDN service checks your Microsoft 365 user account's permissions on the origin. If you have permissions, SharePoint dynamically generates a custom URL composed of the path to the asset in the CDN and two access tokens, and returns the custom URL to your client. Your client then downloads the data directly from the nearest CDN location to your client using the custom URL.

+This screenshot shows the library uploaded to the master page gallery on the SharePoint site itself. The time it took to upload the library is 1.51 seconds.

+Using CDNs only makes sense in a SharePoint context and should be avoided with SharePoint Server. This is because all of the advantages around geographic location don't hold true if the server is located on-premises or geographically close anyway. Additionally, if there's a network connection to the servers where it's hosted, then the site may be used without an Internet connection and therefore can't retrieve the CDN files. Otherwise, you should use a CDN if there's one available and stable for the library and files you need for your site.

+[Use the Microsoft 365 content delivery network with SharePoint](use-microsoft-365-cdn-with-spo.md)

+**Question**: Can users be precreated on the target tenant?</br>

+**Answer:** Yes, all Users/Groups that are identified for migration should be precreated on the target tenant and appropriate licenses assigned prior to staring any migrations. Also:

+**Answer:** Users with permissions to OneDrive content will continue to have access to their content upon completion on the new target tenant. If those users/groups were included as part of the Identity Map and mapped accordingly.

+**Answer:** After the migration is complete, the user needs to sign in to their OneDrive Sync client using their new identity and to the new OneDrive location. Once this step is done, files and folders begin resyncing to the device.

+**Answer:** As part of the migration process, Admins must precreate the appropriate users on the destination tenant, including guest/external users, and provide the tool with an "Identity Map". The identify map tells us how to adjust file/site ownership and permissions.

+- Step 4: [Precreate users and groups](cross-tenant-onedrive-migration-step4.md)

+To establish trust, each SharePoint tenant administrator must run specific commands on both source and target tenants. Once the trust has been requested, the administrator of the target tenant will receive an email informing them that another tenant is trying to establish a trust relationship.

+> The "trust" command is specific to SharePoint. It only grants permission for the SharePoint administrator on the source tenant to execute OneDrive Migration operations to the identified target tenant.

+# Step 4: Precreating users and groups

+## Precreate users and groups on the target tenant

+1. Precreate users and groups as needed in the target tenantΓÇÖs directory.

+5. Precreated users must be added as members of any appropriate security groups or unified groups before the OneDrive migration begins.

+- Step 4: [Precreate users and groups](cross-tenant-onedrive-migration-step4.md)

+2. To start the migration, a SharePoint Admin or Microsoft 365 Global Admin of the source tenant must run the following command:

+These commands can be useful when planning bulk batches of OneDrive migrations. You can queue/migrate up to 4,000 OneDrive migrations per batch. If your user count exceeds 4,000, create separate batches, and schedule them to run once the current batch is close to completion.

+## OneDrive status premigration

+Before you start the migration, the users current source OneDrive status is similar to the example below. This example is from the users source tenant, showing their current files and folders.

+This article discusses how to perform bulk SharePoint site migrations using the Cross-tenant SharePoint migration solution. To learn more, see [Cross-tenant SharePoint migration overview](cross-tenant-SharePoint-migration.md).

+1. **Validate scoped sites for SharePoint Migration**. Create a script that validates the status of your SharePoint Sites, site users, and groups before initiating the migration. This script should be designed to validate the existence of the **SharePoint** site, and the provisioning status of the users and groups on the target tenant. Once validated, the script should provide the status of those users and groups, and log any exceptions that are found.</br>

+2. **Build Identity Map**. Follow the steps detailed here: [Create the Identity mapping file](/microsoft-365/enterprise/cross-tenant-sharepoint-migration-step5#create-the-identity-mapping-file). </br>

+## Premigration FAQs

+**Question:** Can a SharePoint account have any content in the **target tenant** before migration?</br>

+**Question:** Can users be precreated on the target tenant?</br>

+**Answer:** Yes, all Users/Groups that are identified for migration should be precreated on the target tenant and appropriate licenses assigned prior to staring any migrations. Also:

+**Question:** Can my SharePoint accounts be in Read-only mode prior to starting any cross-tenant migrations?</br>

+**Answer:** No. Before starting any migration, you need to ensure that your Source SharePoint accounts are NOT set to Read-Only, otherwise the migration fails.

+**Question:** Can my SharePoint accounts be in **Read-only** mode prior to starting any cross-tenant migrations?</br>

+**Answer:** No, before starting any migrations, ensure that your source SharePoint accounts are NOT set to Read-only. Otherwise, the migration fails.

+**Question:** What do I need to consider for migrating sites between Multi-Geo tenants?</br>

+**Answer:** Users with permissions to SharePoint content continues to have access to their content upon completion on the new target tenant. if those users/groups were included as part of the Identity Map and mapped accordingly.

+**Question:** What happens to sharing links?</br>

+**Answer:** As part of the migration process, Admins must precreate the appropriate users on the destination tenant, including guest/external users, and provide the tool with an "Identity Map." The identify map tells us how to adjust file/site ownership and permissions.

+- Step 4: [Precreate users and groups](cross-tenant-SharePoint-migration-step4.md)

+- **Microsoft SharePoint Powershell**. Confirm you have the most recent version installed. If not, [Download SharePoint Management Shell from Official Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=35588).

+- Be a SharePoint admin or Microsoft 365 Global admin on both the source and target tenants

+1. Sign in to the SharePoint Management Shell as a SharePoint admin or Microsoft 365 Global admin.

+- Step 4: [Precreate users and groups](cross-tenant-SharePoint-migration-step4.md)

+To establish trust, each SharePoint tenant administrator must run specific commands on both source and target tenants. Once the trust has been requested, the administrator of the target tenant will receive an email informing them that another tenant is trying to establish a trust relationship.

+> The "trust" command is specific to SharePoint. It only grants permission for the SharePoint administrator on the source tenant to execute SharePoint Migration operations to the identified target tenant.

+1. Make sure you've verified the compatibility status. If you see a status of either **Compatible** or **Warning** on your source tenant, you may continue. Run:

+2. To start the migration, a SharePoint Admin or Microsoft 365 Global Admin of the source tenant must run the following command:

+ Start-SPOCrossTenantSiteContentMove-SourceSiteUrl <…> -TargetSiteUrl <…> -TargetCrossTenantHostUrl <…>

+2. To start the migration, a SharePoint Admin or Microsoft 365 Global Admin of the source tenant must run the following command:

+These commands can be useful when planning bulk batches of site migrations. You can queue and migrate up to 4,000 migrations per batch. If your count exceeds 4,000, then separate batches can be created and scheduled to run once the current batch is close to completion.

+Before you begin the migration, the users current source SharePoint status will be similar to the following. This example is from the users source tenant, showing their current files and folders.

+Get-SPOCrossTenantUserContentMoveState -PartnerCrossTenantHostURL https://m365x946316-my.sharepoint.com/

+Get-SPOCrossTenantUserContentMoveState -PartnerCrossTenantHostURL https://m365x016551-my.sharepoint.com/

+ Title: "Delay loading images and JavaScript in SharePoint"

+description: Learn how to decrease the load time for SharePoint pages by using JavaScript to delay loading images and nonessential JavaScript.

+# Delay loading images and JavaScript in SharePoint

+The article describes how you can decrease the load time for SharePoint pages by using JavaScript to delay loading images and also by waiting to load nonessential JavaScript until after the page loads.

+Images can negatively affect page load speeds on SharePoint. By default, most modern Internet browsers prefetch images when loading an HTML page. This process can cause the page to be slow to load if the images aren't visible on the screen until the user scrolls down. The images can block the browser from loading the visible part of the page. To work around this problem, you can use JavaScript to skip loading the images first. Also, loading nonessential JavaScript can slow download times on your SharePoint pages too. This article describes some methods you can use to improve page load times with JavaScript in SharePoint.

+## Improve page load times by delaying image loading in SharePoint pages by using JavaScript

+For SharePoint, you need to attach the following function to the scroll event on the #s4-workspace \<div\> tag because the window events are overridden in order to ensure the ribbon remains attached to the top of the page.

+Once you finish writing delayLoadImages.js, you can add the contents of the file to a master page in SharePoint by adding a script link to the header in the master page. Once it's in a master page, the JavaScript is applied to all pages in your SharePoint site that use that master page layout. Alternatively, if you intend to only use the functionality on one page of your site, use the script editor Web Part to embed the JavaScript into the page. For more information, see:

+### Example: Referencing the JavaScript delayLoadImages.js file from a master page in SharePoint

+This article has links to the step-by-step instructions for deploying high availability federated authentication for Microsoft 365 in Azure infrastructure services with these virtual machines:

+Here's the configuration, with placeholder names for each server.

+All of the virtual machines are in a single cross-premises Azure virtual network (VNet).

+The result of this configuration is that you'll have federated authentication for all of your Microsoft 365 users, in which they can use their AD DS credentials to sign in rather than their Microsoft 365 account. The federated authentication infrastructure uses a redundant set of servers that are more easily deployed in Azure infrastructure services, rather than in your on-premises edge network.

+To compute the estimated costs for this configuration, see the [Azure pricing calculator](https://azure.microsoft.com/pricing/calculator/).

+- If you're an experienced AD FS implementer, feel free to adapt the instructions in phases 3 and 4 and build the set of servers that best suits your needs.

+Our example organization has 5,000 employees in buildings across the world in Europe, Africa, Asia, and the Americas. Seventy percent of the employees use Microsoft 365 E3 and the rest of the organization uses Microsoft 365 E5.

+Choosing which update channels to use for Windows 10 and Microsoft 365 Apps can depend on your type of organization and where on the development cycle you want to be deploying and using new features and capabilities. Find the prerelease and production channels that best fit your needs.

+## Prerelease channels

+|Right for early adopters and IT Pros who want more reliable builds that are still in development. <br/><br/> See what"s coming up next and help validate new features.|Preview Channel|Preview Channel|

+|Right for customers who want the latest releases as soon as they're ready.|Semi-Annual Enterprise Channel|[Current Channel](/deployoffice/overview-update-channels#current-channel-overview)|[Latest releases](deploy-update-channels-examples-rapid-deploy.md)|

+|Right for enterprises who want the latest release with more predictability.|Semi-Annual Enterprise Channel|[Monthly Enterprise Channel](/deployoffice/overview-update-channels#monthly-enterprise-channel-overview)||

+|Right for enterprises with need for extensive IT testing before each update.|Semi-Annual Enterprise Channel|[Semi-Annual Enterprise Channel](/deployoffice/overview-update-channels#semi-annual-enterprise-channel-overview)||

+ Title: "Image optimization for SharePoint classic publishing sites"

+description: "Learn how to use renditions and sprites to improve image performance on your SharePoint classic publishing sites."

+# Image optimization for SharePoint classic publishing sites

+>This topic applies to SharePoint classic publishing sites, not modern portal sites. For information about image optimization in SharePoint modern portal sites, see [Optimize images in SharePoint modern portal pages](modern-image-optimization.md).

+An image sprite contains many smaller images. Using CSS you select a part of the composite image to display on a particular part of the page with absolute positioning. Basically, you move a single image around the page instead of loading multiple images, and make a small part of that image visible through a small window where the required part of the sprite image is shown to the end user. SharePoint uses sprites to display its various icons in the sprite spcommon.png file.

+This can increase performance because you download only one image instead of several and then cache and reuse that image. Even if the image doesn't remain cached, by having a single image instead of multiple images, this method reduces the total number of HTTP requests to the server, which will reduce page loading times. This is really a form of image bundling. This is a useful technique if the images aren't changing often, for example, icons, as shown in the SharePoint example provided above. You can see how to use [Web Essentials](https://vswebessentials.com/), a third-party, open-source, community-based project to achieve this easily in Microsoft Visual Studio. For more information, see [Minification and bundling in SharePoint](./minification-and-bundling-in-sharepoint-online.md).

+Image renditions are a feature in SharePoint that allows you to serve up different versions of images based on pre-defined image dimensions. This is especially important when there's user-generated image content or the image dimensions such as width and height are fixed by the CSS on the site. Even if an image is fixed by CSS, the full resolution image is still loaded. In this case, the file size can be reduced by using image renditions.

+ExpressRoute for Microsoft 365 provides an alternate routing path to many internet facing Microsoft 365 services. The architecture of ExpressRoute for Microsoft 365 is based on advertising public IP prefixes of Microsoft 365 services that are already accessible over the Internet into your provisioned ExpressRoute circuits for subsequent redistribution of those IP prefixes into your network. With ExpressRoute you effectively enable several different routing paths, through the internet and through ExpressRoute, for many Microsoft 365 services. This state of routing on your network might represent a significant change to how your internal network topology is designed.

+You have to carefully plan your ExpressRoute for Microsoft 365 implementation to accommodate for the network complexities of having routing available via both a dedicated circuit with routes injected into your core network and the internet. If you and your team don't perform the detailed planning and testing in this guide, there's a high risk you'll experience intermittent or a total loss of connectivity to Microsoft 365 services when the ExpressRoute circuit is enabled.

+To have a successful implementation, you'll need to analyze your infrastructure requirements, go through detailed network assessment and design, carefully plan the rollout in a staged and controlled manner, and build a detailed validation and testing plan. For a large, distributed environment it's not uncommon to see implementations span several months. This guide is designed to help you plan ahead.

+Large successful deployments might take six months in planning and often include team members from many areas in the organization including networking, Firewall and Proxy server administrators, Microsoft 365 administrators, security, end-user support, project management, and executive sponsorship. Your investment in the planning process will reduce the likelihood that you'll experience deployment failures resulting in downtime or complex and expensive troubleshooting.

+We expect the following prerequisites to be completed before this implementation guide is started.

+3. You've already read and understand the [ExpressRoute documentation](/azure/expressroute/) and your internal network is able to meet ExpressRoute prerequisites end to end.

+- Estimate the expected and observed network performance and latency characteristics from major user locations to Microsoft 365. Keep in mind that Microsoft 365 is a global and distributed set of services and users will be connecting to locations that may be different from the location of their tenant. For this reason, it's recommended to measure and optimize for latency between the user and the closest edge of Microsoft global network over ExpressRoute and Internet connections. You can use your findings from the network assessment to aid with this task.

+Inbound connections should be reviewed regardless of whether they're connecting over the internet or ExpressRoute to ensure asymmetric routing hasn't been introduced. In some cases, on-premises endpoints that Microsoft 365 services initiate inbound connections to might also need to be accessed by other Microsoft and non-Microsoft services. It's paramount that enabling ExpressRoute routing to these services for Microsoft 365 purposes doesn't break other scenarios. In many cases, customers might need to implement specific changes to their internal network, such as source-based NAT, to ensure that inbound flows from Microsoft remain symmetric after ExpressRoute is enabled.

+|**Service** <br/> |SharePoint <br/> |

+|**Public Microsoft 365 endpoint (destination)** <br/> |SharePoint (IP addresses) <br/> |

+The selection of meet-me locations, which are the physical location where your ExpressRoute circuit connects your network to the Microsoft network, is influenced by the locations where people will access Microsoft 365 from. As a SaaS offering, Microsoft 365 doesn't operate under the IaaS or PaaS regional model in the same way Azure does. Instead, Microsoft 365 is a distributed set of collaboration services, where users might need to connect to endpoints across multiple datacenters and regions, which may not necessarily be in the same location or region where the user's tenant is hosted.

+This means the most important consideration you need to make when selecting meet-me locations for ExpressRoute for Microsoft 365 is where the people in your organization will be connecting from. The general recommendation for optimal Microsoft 365 connectivity is to implement routing, so that user requests to Microsoft 365 services are handed off into the Microsoft network over the shortest network path, this is also often being referred to as 'hot potato' routing. For example, if most of the Microsoft 365 users are in one or two locations, selecting meet-me locations that are in the closest proximity to the location of those users will create the optimal design. If your company has large user populations in many different regions, you might want to consider having multiple ExpressRoute circuits and meet-me locations. For some of your user locations, the shortest/most optimal path into Microsoft network and Microsoft 365, might not be through your internal WAN and ExpressRoute meet-me points, but via the Internet.

+The first diagram shows an example of a customer with two physical locations in North America. You can see the information about office locations, Microsoft 365 tenant locations, and several choices for ExpressRoute meet-me locations. In this example, the customer has selected the meet-me location based on two principles, in order:

+Expanding this concept slightly further, the second diagram shows an example multi-national customer faced with similar information and decision making. This customer has a small office in Bangladesh with only a small team of 10 people focused on growing their footprint in the region. There's a meet-me location in Chennai and a Microsoft datacenter with Microsoft 365 hosted in Chennai so a meet-me location would make sense; however, for 10 people, the expense of the extra circuit is burdensome. As you look at your network, you'll need to determine if the latency involved in sending your network traffic across your network is more effective than spending the capital to acquire another ExpressRoute circuit.

+Alternatively, the 10 people in Bangladesh might experience better performance with their network traffic sent over the internet to the Microsoft network than they would routing on their internal network as we showed in the introductory diagrams and reproduced below.

+Create a plan for bandwidth required for each major Microsoft 365 workload. Separately estimate Exchange Online, SharePoint, and Skype for Business Online bandwidth requirements. You can use the estimation calculators we've provided for Exchange Online and Skype for Business as a starting place; however, a pilot test with a representative sample of the user profiles and locations is required to fully understand the bandwidth needs of your organization.

+1. The endpoints must be public IP addresses that are registered to your company or to carrier providing ExpressRoute connectivity to you.

+4. The endpoints must not be used for connectivity to Microsoft services that aren't configured over ExpressRoute.

+If your network design doesn't meet these requirements, there's a high risk your users will experience connectivity failures to Microsoft 365 and other Microsoft services due to route black holing or asymmetric routing. This occurs when requests to Microsoft services are routed over ExpressRoute, but responses are routed back across the internet, or vice versa, and the responses are dropped by stateful network devices such as firewalls.

+Most enterprise Microsoft 365 deployments assume some form of inbound connectivity from Microsoft 365 to on-premises services, such as for Exchange, SharePoint, and Skype for Business hybrid scenarios, mailbox migrations, and authentication using ADFS infrastructure. When ExpressRoute you enable an extra routing path between your on-premises network and Microsoft for outbound connectivity, these inbound connections might inadvertently be impacted by asymmetric routing, even if you intend to have those flows continue to use the Internet. A few precautions described below are recommended to ensure there's no impact to Internet based inbound flows from Microsoft 365 to on-premises systems.

+You might consider one of the following implementation patterns to satisfy this requirement:

+2. Ensure that ExpressRoute routes aren't propagated to the network segments where inbound services, such as front-end servers or reverse proxy systems, handling Internet connections reside.

+There might be cases where you may choose to direct some inbound flows over ExpressRoute connections. For these scenarios, take the following extra considerations into account.

+8. Some on-premises services, such as ADFS proxy or Exchange autodiscover, may receive inbound requests from both Microsoft 365 services and users from the Internet. For these requests Microsoft 365 will target the same FQDN as user requests over the Internet. Allowing inbound user connections from the internet to those on-premises endpoints, while forcing Microsoft 365 connections to use ExpressRoute, represents significant routing complexity. For the vast majority of customers implementing such complex scenarios over ExpressRoute isn't recommended due to operational considerations. This additional overhead includes, managing risks of asymmetric routing and will require you to carefully manage routing advertisements and policies across multiple dimensions.

+1. While the perimeter network is secure, there's no Source NAT available for incoming requests.

+2. In this faulty configuration, there's no Source NAT configured or available at the perimeter network where the traffic is sent resulting in the actual source IP address being used as the return destination.

+1. The incoming request continues to enter through the New Jersey data center's perimeter network. This time the prefixes advertised from Microsoft over the ExpressRoute circuit aren't available to the New Jersey data center.

+2. In this faulty configuration, there's no Source NAT configured or available at the perimeter network where the traffic is sent resulting in the actual source IP address being used as the return destination.

+The Microsoft 365 front-end servers are accessible on both the Internet and ExpressRoute. These servers will prefer to route back to on-premises over ExpressRoute circuits when both are available. Because of this, there's a possibility of route asymmetry if traffic from your network prefers to route over your Internet circuits. Asymmetrical routes are a problem because devices that perform stateful packet inspection can block return traffic that follows a different path than the outbound packets followed.

+- SMTP services such as mail from an Exchange Online tenant to an on-premises host or SharePoint Mail sent from SharePoint to an on-premises host. SMTP protocol is used more broadly within Microsoft's network than the route prefixes shared over ExpressRoute circuits and advertising on-premises SMTP servers over ExpressRoute will cause failures with these other services.

+1) Do not advertise the same public IP Address route prefix to the public Internet and over ExpressRoute. It's recommended that the IP BGP Route Prefix advertisements to Microsoft over ExpressRoute are from a range that isn't advertised to the internet at all. If this isn't possible to achieve due to the available IP Address space, then it's essential to ensure you advertise a more specific range over ExpressRoute than any internet circuits.

+Inside the egress point of your network are many other devices and circuits that play a critical role in how people perceive availability. These portions of your connectivity scenarios aren't covered by ExpressRoute or Microsoft 365 SLAs, but they play a critical role in the end-to-end service availability as perceived by people in your organization.

+ - Alternatively, testing can be performed on a production network if the customer isn't yet using Microsoft 365 or is in pilot.

+Your testing procedures should include tests for each outbound and inbound network service for Microsoft 365 both that will be using ExpressRoute and ones that will not. The procedures should include testing from each unique network location including users who aren't on-premises in the corporate LAN.

+6. Validate your public NAT IP range isn't advertised to Microsoft through any other ExpressRoute or public Internet network circuit unless it's a specific subset of a larger range as in the previous example.

+10. Test application level functionality for SharePoint

+ - Test SharePoint web access.

+Now that you have the completed plan on paper it's time to test at a small scale. In this test you'll establish a single ExpressRoute connection with Microsoft Peering to a test subnet on your on-premises network. You can configure a [trial Microsoft 365 tenant](https://go.microsoft.com/fwlink/p/?LinkID=403802) with connectivity to and from the test subnet and include all outbound and inbound services that you'll be using in production in the test subnet. Set up DNS for the test network segment and establish all inbound and outbound services. Execute your test plan and ensure that you are familiar with the routing for each service and the route propagation.

+QoS is necessary to obtain voice and meeting benefits for Skype for Business Online. You can configure QoS after you have ensured that the ExpressRoute network connection doesn't block any of your other Microsoft 365 service access. Configuration for QoS is described in the article [ExpressRoute and QoS in Skype for Business Online](https://support.office.com/article/ExpressRoute-and-QoS-in-Skype-for-Business-Online-20c654da-30ee-4e4f-a764-8b7d8844431d) .

+ Title: "Introduction to performance tuning for SharePoint"

+description: "This article explains what specific aspects you need to consider when designing pages for best performance in SharePoint."

+# Introduction to performance tuning for SharePoint

+This article explains what specific aspects you need to consider when designing pages for best performance in SharePoint.

+## SharePoint metrics

+The following broad metrics for SharePoint provide real-world data about performance:

+- Most of the pages perform well on SharePoint.

+- The slowest 1% of SharePoint pages take more than 5,000 milliseconds to load.

+This scenario is applicable to SharePoint on-premises and SharePoint but in an on-premises scenario the differences can't be as easily noticed as in SharePoint.

+You can categorize the connections between the server and the user into three main components. Consider these components when designing SharePoint pages for insight into load times.

+Many of the issues that affect performance with SharePoint on-premises also apply to SharePoint.

+As you would expect, you have far more control over how servers perform with on-premises SharePoint. With SharePoint, things are a little different. The more work you make a server do, the longer it takes to render a page. With SharePoint, the biggest culprits in this respect are complex pages with multiple web parts.

+SharePoint

+With SharePoint, certain page requests might actually end up calling multiple servers. You could end up with a matrix of requests between servers for an individual request. These interactions are expensive from a page load perspective and make things slow.

+With SharePoint, there are a few more factors to consider; for example:

+One feature that you can use in SharePoint is the Microsoft CDN (Content Delivery Network). A CDN is basically a distributed collection of servers deployed across multiple datacenters. With a CDN, content on pages can be hosted on a server close to the client even if the client is far away from the originating SharePoint Server. Microsoft will be using this feature more in the future to store local instances of pages that can't be customized, for example the SharePoint admin home page. For more information about CDNs, see [Content delivery networks](content-delivery-networks.md).

+Check out the following articles for different SharePoint page customization techniques and other best practices to help you achieve optimal performance.

+- [Navigation options for SharePoint](navigation-options-for-sharepoint-online.md)

+- [Use the Page Diagnostics tool for SharePoint](page-diagnostics-for-spo.md)

+- [Image optimization for SharePoint](image-optimization-for-sharepoint-online.md)

+- [Delay loading images and JavaScript in SharePoint](delay-loading-images-and-javascript-in-sharepoint-online.md)

+- [Minification and bundling in SharePoint](minification-and-bundling-in-sharepoint-online.md)

+- [Use the Office 365 Content Delivery Network (CDN) with SharePoint](use-microsoft-365-cdn-with-spo.md)

+- [Using Content Search Web Part instead of Content Query Web Part to improve performance in SharePoint](using-content-search-web-part-instead-of-content-query-web-part-to-improve-perfo.md)

+- [Capacity planning and load testing SharePoint](capacity-planning-and-load-testing-sharepoint-online.md)

+- [Diagnosing performance issues with SharePoint](diagnosing-performance-issues-with-sharepoint-online.md)

+- [Using the object cache with SharePoint](using-the-object-cache-with-sharepoint-online.md)

+- [How to: Avoid getting throttled or blocked in SharePoint](/sharepoint/dev/general-development/how-to-avoid-getting-throttled-or-blocked-in-sharepoint-online)

+ Title: "Manage SharePoint site groups with PowerShell"

+description: In this article, find procedures for using PowerShell for Microsoft 365 to manage SharePoint site groups.

+# Manage SharePoint site groups with PowerShell

+Although you can use the Microsoft 365 admin center, you can also use PowerShell for Microsoft 365 to manage your SharePoint site groups.

+The procedures in this article require you to connect to SharePoint. For instructions, see [Connect to SharePoint PowerShell](/powershell/sharepoint/sharepoint-online/connect-sharepoint-online).

+## View SharePoint with PowerShell for Microsoft 365

+The SharePoint admin center has some easy-to-use methods for managing site groups. For example, suppose you want to look at the groups, and the group members, for the `https://litwareinc.sharepoint.com/sites/finance` site. Here's what you have to do to:

+There are two ways to run this command set in the SharePoint Management Shell command prompt:

+- Copy the commands into Notepad (or another text editor), modify the value of the **$siteURL** variable, select the commands, and then paste them into the SharePoint Management Shell command prompt. When you do, PowerShell stops at a **>>** prompt. Press Enter to execute the `foreach` command.<br/>

+- Copy the commands into Notepad (or another text editor), modify the value of the **$siteURL** variable, and then save this text file with a name and the .ps1 extension in a suitable folder. Next, run the script from the SharePoint Management Shell command prompt by specifying its path and file name. Here's an example command:

+

+These are all the groups that were created for the site `https://litwareinc.sharepoint.com/sites/finance`, and all the users assigned to those groups. The group names are in yellow to help you separate group names from their members.

+As another example, here's a command set that lists the groups, and all the group memberships, for all of your SharePoint sites.

+[Connect to SharePoint PowerShell](/powershell/sharepoint/sharepoint-online/connect-sharepoint-online)

+[Create SharePoint sites and add users with PowerShell](create-sharepoint-sites-and-add-users-with-powershell.md)

+[Manage SharePoint users and groups with PowerShell](manage-sharepoint-users-and-groups-with-powershell.md)

+## Add a user to the site admins group

+For example, this set of commands adds Opal Castillo (user name opalc) to the list of site admins on the ContosoTest site collection in the Contoso tenancy:

+In this task, we use the `Add-SPOUser` cmdlet to add a user to a SharePoint group on a site collection.

+However by using the SharePoint Management Shell and CSV files, this is fast and easy. In this task, you use Windows PowerShell to remove a user from a site collection security group. Then you use a CSV file and remove lots of users from different sites.

+The first CSV file adds one or more groups to one or more site collections and will have this structure:

+The second CSV file adds one or more users to one or more groups and will have this structure:

+This grabs the data for these three sites and writes them to a text file on your local drive. The parameter ΓÇôAppend adds new content to an existing file.

+These advisories are displayed in the Microsoft 365 admin center. To view these advisories, go to **Health** > <a href="https://go.microsoft.com/fwlink/p/?linkid=842900" target="_blank">**Service health**</a> > **Exchange Online** and then select the **Active issues** tab. The name for these service alerts is "Message Queueing to External Recipients Above Thresholds".

+This service advisory informs you of messages destined to recipients outside Exchange Online might be delayed. Queueing might be caused by your on-premises environment or third-party messaging\journaling solution. Reasons for queueing might be, but aren't limited to:

+## SharePoint and OneDrive for Business collaboration options

+|Share sites and documents with external users | Administrators configure sharing at the tenant, or site collection level for Microsoft account authenticated, work or school account authenticated or guest accounts | <ul><li> [Manage external sharing for your SharePoint environment](https://support.office.com/article/Manage-external-sharing-for-your-SharePoint-Online-environment-C8A462EB-0723-4B0B-8D0A-70FEAFE4BE85?ui=en-US&amp;rs=en-US&amp;ad=US) </li><li> [Restrict sharing of SharePoint and OneDrive content by domain](/sharepoint/restricted-domains-sharing) </li><li> [Use SharePoint as a business-to-business (B2B) extranet solution](https://support.office.com/article/7b087413-165a-4e94-8871-4393e0b9c037) </li></ul> |

+|Tracking and controlling external sharing for end users | OneDrive for Business file owners and SharePoint end users configure site and document sharing and establish notifications to track sharing | <ul><li> [Configure notifications for external sharing for OneDrive for Business](https://support.office.com/article/Configure-notifications-for-external-sharing-for-OneDrive-for-Business-b640c693-f170-4227-b8c1-b0a7e0fa876b) </li><li> [Share SharePoint files or folders](https://support.office.com/article/1fe37332-0f9a-4719-970e-d2578da4941c) </li></ul> |

+- **Storage:** In Microsoft 365 licensing plans, software boundaries and limits for SharePoint are managed separately from mailbox storage limits. Mailbox storage limits are set up and managed by using Exchange Online. In both scenarios, storage can't be shared across tenants.

+Microsoft 365 uses both physical storage and Azure cloud storage. Exchange Online (including Exchange Online Protection) and Skype for Business use their own storage for customer data. SharePoint uses both SQL Server storage and Azure Storage, hence the need for extra isolation of customer data at the storage level.

+## SharePoint

+SharePoint has several independent mechanisms that provide data isolation. It stores objects as abstracted code within application databases. For example, when a user uploads a file to SharePoint, the file is disassembled, translated into application code, and stored in multiple tables across multiple databases.

+If a user could gain direct access to the storage containing the data, the content isnΓÇÖt interpretable to a human or any system other than SharePoint. These mechanisms include security access control and properties. All SharePoint resources are secured by the authorization code and RBAC policy, including within a tenancy. The access control list (ACL) that secures a resource contains an identity authenticated at the tenant level. SharePoint data for a tenant is limited to identities authenticated by the authentication provider for the tenant.

+SharePoint uses SQL Server and Azure Storage for content metadata storage. The partition key for the content store is *SiteId* in SQL. When running a SQL query, SharePoint uses a *SiteId* verified as part of a tenant-level *SubscriptionId* check.

+SharePoint stores encrypted file content in Microsoft Azure blobs. Each SharePoint farm has its own Microsoft Azure account and all the blobs saved in Azure are encrypted individually with a key stored in the SQL content store. The encryption key protected in code by the authorization layer and not exposed directly to the end user. SharePoint has real-time monitoring to detect when an HTTP request reads or writes data for more than one tenant. The request identity *SubscriptionId* is tracked against the *SubscriptionId* of the accessed resource. Requests to access resources of more than one tenant should never happen by end users. Service requests in a multi-tenant environment are the only exception. For example, the search crawler pulls content changes for an entire database all at once. This usually involves querying sites of more than one tenant in a single service request, which is done for efficiency reasons.

+- SharePoint site content and the files stored within that site.

+ - TLS termination or deep packet inspection of any M365 domains with customer proxies or other types of network devices or services.

+Due to the increased demand for Microsoft's cloud services during the COVID-19 crisis, we're providing information about the health of Microsoft's global network and information about network quality issues that our customers might experience but that we don't control.

+_There might be delays in the updates to this page. We're updating it manually while we build a more automated solution._

+- **Quality of Experience**. The percentage of audio streams for which Quality of Experience (QoE) telemetry was received by the Teams service. Data can be received up to 3 days after call completion. If the rate drops, investigate your network configuration to ensure that the Microsoft Teams telemetry URLs are not being blocked. The telemetry URLs can be found here: [Office 365 URLs and IP address ranges - Microsoft 365 Common and Office Online](urls-and-ip-address-ranges.md#microsoft-365-common-and-office-online)

+- **UDP Stream Establishment**. The percentage of audio streams established over UDP (User Datagram Protocol). Real-time media established over UDP is more efficient and provides better call quality. If the rate drops, investigate your network configuration to ensure that the ports and protocols required by Microsoft Teams are not being blocked. The required IP addresses, hostnames, ports, and protocols can be found here: [Office 365 URLs and IP address ranges - Skype for Business Online and Microsoft Teams](urls-and-ip-address-ranges.md#skype-for-business-online-and-microsoft-teams)

+For quite some time, VPN models where all connections from the remote user device are routed back into the on-premises network (known as _forced tunneling_) were largely sustainable as long as the concurrent scale of remote users was modest and the traffic volumes traversing VPN were low. Some customers continued to use VPN force tunneling as the status quo even after their applications moved from inside the corporate perimeter to public SaaS clouds.

+The use of forced tunneled VPNs for connecting to distributed and performance-sensitive cloud applications is suboptimal, but the negative effects have been accepted by some enterprises so as to maintain the security status quo. An example diagram of this scenario can be seen here:

+This problem has been growing for many years, with many customers reporting a significant shift of network traffic patterns. Traffic that used to stay on premises now connects to external cloud endpoints. Many Microsoft customers report that previously, around 80% of their network traffic was to some internal source (represented by the dotted line in the preceding diagram). In 2020 that number decreased to around 20% or lower as they have shifted major workloads to the cloud. These trends aren't uncommon with other enterprises. Over time, as the cloud journey progresses, the above model becomes increasingly cumbersome and unsustainable, preventing an organization from being agile as they move into a cloud-first world.

+For customers who connect their remote worker devices to the corporate network or cloud infrastructure over VPN, Microsoft recommends that the key Microsoft 365 scenarios **Microsoft Teams**, **SharePoint**, and **Exchange Online** are routed over a _VPN split tunnel_ configuration. This becomes especially important as the frontline strategy to facilitate continued employee productivity during large-scale work-from-home events such as the COVID-19 crisis.

+The essence of this approach is to provide a method for enterprises to mitigate the risk of VPN infrastructure saturation and dramatically improve Microsoft 365 performance in the shortest timeframe possible. Configuring VPN clients to allow the most critical, high volume Microsoft 365 traffic to bypass the VPN tunnel achieves the following benefits:

+ The recommended solution specifically targets Microsoft 365 service endpoints categorized as **Optimize** in the article [Microsoft 365 URLs and IP address ranges](./urls-and-ip-address-ranges.md). Traffic to these endpoints is highly sensitive to latency and bandwidth throttling, and enabling it to bypass the VPN tunnel can dramatically improve the end-user experience as well as reduce the corporate network load. Microsoft 365 connections that don't constitute the majority of bandwidth or user experience footprint can continue to be routed through the VPN tunnel along with the rest of the Internet-bound traffic. For more information, see [The VPN split tunnel strategy](#the-vpn-split-tunnel-strategy).

+For a step-by-step process to configure Microsoft 365 for remote workers, see [Set up your infrastructure for remote work](..\solutions\empower-people-to-work-remotely.md).

+Traditional corporate networks are often designed to work securely for a precloud world where most important data, services, applications are hosted on premises and are directly connected to the internal corporate network, as are the majority of users. Thus network infrastructure is built around these elements in that branch offices are connected to the head office via _Multiprotocol Label Switching (MPLS)_ networks, and remote users must connect to the corporate network over a VPN to access both on premises endpoints and the Internet. In this model, all traffic from remote users traverses the corporate network and is routed to the cloud service through a common egress point.

+_Figure 2: A common VPN solution for remote users where all traffic is forced back into the corporate network regardless of destination._

+The COVID-19 crisis aggravated this problem to require immediate solutions for the vast majority of organizations. Many customers have found that the forced VPN model isn't scalable or performant enough for 100% remote work scenarios such as that which this crisis has necessitated. Rapid solutions are required for these organizations to operate efficiently.

+For the Microsoft 365 service, Microsoft has designed the connectivity requirements for the service with this problem squarely in mind, where a focused, tightly controlled and relatively static set of service endpoints can be optimized simply and quickly so as to deliver high performance for users accessing the service, and reducing the burden on the VPN infrastructure so it can be used by traffic that still requires it.

+- Are dedicated to core Microsoft 365 workloads such as Exchange Online, SharePoint, Skype for Business Online, and Microsoft Teams

+### How do I stop users accessing other tenants I don't trust where they could exfiltrate data?

+The answer is a [feature called tenant restrictions](/azure/active-directory/manage-apps/tenant-restrictions). Authentication traffic isn't high volume nor especially latency sensitive so can be sent through the VPN solution to the on-premises proxy where the feature is applied. An allowlist of trusted tenants is maintained here and if the client attempts to obtain a token to a tenant that isn't trusted, the proxy simply denies the request. If the tenant is trusted, then a token is accessible if the user has the right credentials and rights.

+So even though a user can make a TCP/UDP connection to the Optimize marked endpoints, without a valid token to access the tenant in question, they simply cannot log in and access/move any data.

+- IP ΓÇô is the authentication request coming from a known corporate IP address? Or from a country/region we don't trust?

+Again, Microsoft 365 provides protection for the Optimize marked endpoints in various layers in the service itself, [outlined in this document](/office365/Enterprise/office-365-malware-and-ransomware-protection). As noted, it's vastly more efficient to provide these security elements in the service itself rather than try to do it in line with devices that may not fully understand the protocols/traffic. By default, SharePoint [automatically scans file uploads](../security/office-365-security/anti-malware-protection-for-spo-odfb-teams-about.md) for known malware

+description: "In this article, you'll find the resources to help you migrate your organization data to Microsoft 365."

+- [Migrate to SharePoint and OneDrive](/sharepointmigration/migrate-to-sharepoint-online). (Administrator)

+ Title: "Minification and bundling in SharePoint"

+description: Learn how to use minification and bundling techniques with Web Essentials to reduce HTTP requests and the time it takes to load pages in SharePoint.

+# Minification and bundling in SharePoint

+This article describes how to use minification and bundling techniques with Web Essentials to reduce the number of HTTP requests and to reduce the time it takes to load pages in SharePoint.

+ Title: "Optimize custom extensions in SharePoint modern site pages"

+description: "Learn how to optimize the performance of custom extensions in SharePoint modern site pages."

+# Optimize custom extension performance in SharePoint modern site pages

+The Page Diagnostics for SharePoint tool is a browser extension for the new Microsoft Edge (https://www.microsoft.com/edge) and Chrome browsers that analyzes both SharePoint modern portal and classic publishing site pages. The tool provides a report for each analyzed page showing how the page performs against a defined set of performance criteria. To install and learn about the Page Diagnostics for SharePoint tool, visit [Use the Page Diagnostics tool for SharePoint](page-diagnostics-for-spo.md).

+>The Page Diagnostics tool only works for SharePoint, and cannot be used on a SharePoint system page.

+When you analyze a SharePoint site page with the Page Diagnostics for SharePoint tool, you can see information about custom extensions that exceed the baseline metric in the **Extensions are impacting load time** and/or the **Too many extensions used** result in the _Diagnostic tests_ pane.

+- **Improvement Opportunities** (yellow) If **five** or more extensions are used they'll be highlighted in this section as a warning until seven or more are used which will be highlighted as Attention Required.

+If an extension is impacting page load time or there are too many extensions on the page, the result appears in the **Attention required** section of the results. Select the result to see details about which extension is loading slowly or too many extensions has been highlighted. Future updates to the Page Diagnostics for SharePoint tool might include updates to analysis rules, so please ensure you always have the latest version of the tool.

+- **Total** shows the total time for the extension to module load and initialize. It's the total relative time taken by the extension to execute on the page, from beginning to the end.

+ It's an asynchronous call and init time is the calculation of time for the onInit function when the returned promise is resolved.

+- **Module load** is how long it takes to load the extension, which is impacted by the size of an extension so it's a good idea to only bundle the necessary libraries in the extension and to also choose lighter libraries.

+ - Use of the Office 365 CDN is required for optimal static resource download. Public CDN origins are preferable for _js/css_ files. For more information about using the Office 365 CDN, see [Use the Office 365 Content Delivery Network (CDN) with SharePoint](use-microsoft-365-cdn-with-spo.md).

+ - Ensure that you're using the latest version of the SharePoint Framework, and upgrade to new versions as they become available.

+ - Alternatively, if some elements of data require a slower API, but aren't critical to initial rendering, decouple these to a separate call that is executed after critical data is rendered.

+ - Any media sources like images and videos should be sized to the limits of the container, device and/or network to avoid downloading unnecessary large assets. For more information about content dependencies, see [Use the Office 365 Content Delivery Network (CDN) with SharePoint](use-microsoft-365-cdn-with-spo.md).

+ - Avoid API calls that cause reflow, complex CSS rules or complicated animations. For more information, see [Minimizing browser reflow](https://developers.google.com/speed/docs/insights/browser-reflow).

+ - If a certain browser doesn't support a feature used in rendering, either load a polyfill or exclude running dependent code. If the feature isn't critical, dispose resources such as event handlers to avoid memory leaks.

+## Related articles

+[Tune SharePoint performance](tune-sharepoint-online-performance.md)

+[Use the Office 365 Content Delivery Network (CDN) with SharePoint](use-microsoft-365-cdn-with-spo.md)

+ Title: "Optimize iFrames in SharePoint modern and classic publishing site pages"

+description: "Learn how to optimize the performance of iFrames in SharePoint modern and classic publishing site pages."

+# Optimize iFrames in SharePoint modern and classic publishing site pages

+>For more information about performance in SharePoint modern sites, see [Performance in the modern SharePoint experience](/sharepoint/modern-experience-performance).

+The Page Diagnostics for SharePoint tool is a browser extension for the new Microsoft Edge (https://www.microsoft.com/edge) and Chrome browsers that analyzes both SharePoint modern portal and classic publishing site pages. The tool provides a report for each analyzed page showing how the page performs against a defined set of performance criteria. To install and learn about the Page Diagnostics for SharePoint tool, visit [Use the Page Diagnostics tool for SharePoint](page-diagnostics-for-spo.md).

+>The Page Diagnostics tool only works for SharePoint, and cannot be used on a SharePoint system page.

+[Tune SharePoint performance](tune-sharepoint-online-performance.md)

+ Title: "Optimize images in SharePoint modern site pages"

+description: Learn how to use the tools included in SharePoint to optimize images in SharePoint modern site pages.

+# Optimize images in SharePoint modern site pages

+This article will help you understand how to optimize images in SharePoint modern site pages.

+For information about optimizing images in classic publishing sites, see [Image optimization for SharePoint](image-optimization-for-sharepoint-online.md).

+>For more information about performance in SharePoint modern portals, see [Performance in the modern SharePoint experience](/sharepoint/modern-experience-performance).

+The Page Diagnostics for SharePoint tool is a browser extension for the new Microsoft Edge (https://www.microsoft.com/edge) and Chrome browsers that analyzes both SharePoint modern portal and classic publishing site pages. The tool provides a report for each analyzed page showing how the page performs against a defined set of performance criteria. To install and learn about the Page Diagnostics for SharePoint tool, visit [Use the Page Diagnostics tool for SharePoint](page-diagnostics-for-spo.md).

+>The Page Diagnostics tool only works for SharePoint, and cannot be used on a SharePoint system page.

+- **Attention required** (red): The page contains **one or more** images over 300 KB in size

+- **No action required** (green): The page contains no images over 300 KB in size

+If a page contains images over 300 KB in size, select the **Large images detected** result to see which images are too large. In modern SharePoint pages, renditions of images are automatically provided and sized depending on the size of the browser window and the resolution of the client monitor. You should always optimize images for web use prior to upload to SharePoint. Very large images will be automatically reduced in size and resolution which can result in unexpected rendering characteristics.

+## Related articles

+[Tune SharePoint performance](tune-sharepoint-online-performance.md)

+[Use the Office 365 Content Delivery Network (CDN) with SharePoint](use-microsoft-365-cdn-with-spo.md)

+ Title: "Optimize page calls in SharePoint modern and classic publishing site pages"

+description: "Learn how to optimize modern and classic publishing site pages in SharePoint by limiting the number of calls to SharePoint service endpoints."

+# Optimize page calls in SharePoint modern and classic publishing site pages

+Both SharePoint modern and classic publishing sites contain links that load data from (or make calls to) SharePoint features and CDNs. The more calls made by a page, the longer the page takes to load. This is known as **end user perceived latency** or **EUPL**.

+>For more information about performance in SharePoint modern portals, see [Performance in the modern SharePoint experience](/sharepoint/modern-experience-performance).

+The Page Diagnostics for SharePoint tool is a browser extension for the new Microsoft Edge (https://www.microsoft.com/edge) and Chrome browsers that analyzes both SharePoint modern portal and classic publishing site pages. The tool provides a report for each analyzed page showing how the page performs against a defined set of performance criteria. To install and learn about the Page Diagnostics for SharePoint tool, visit [Use the Page Diagnostics tool for SharePoint](page-diagnostics-for-spo.md).

+>The Page Diagnostics tool only works for SharePoint, and cannot be used on a SharePoint system page.

+[Tune SharePoint performance](tune-sharepoint-online-performance.md)

+[Use the Office 365 Content Delivery Network (CDN) with SharePoint](use-microsoft-365-cdn-with-spo.md)

+ Title: "Optimize page weight in SharePoint modern site pages"

+description: Learn how to use the Page Diagnostics tool to optimize page weight in SharePoint modern site pages.

+# Optimize page weight in SharePoint modern site pages

+SharePoint modern site pages contain serialized code that is required to render page content of the page, including images, text, objects in the content area underneath navigation/command bars and other HTML code that forms the framework of the page. Page weight is a measurement of this HTML code, and should be limited to ensure optimal page load times.

+>For more information about performance in SharePoint modern portals, see [Performance in the modern SharePoint experience](/sharepoint/modern-experience-performance).

+The Page Diagnostics for SharePoint tool is a browser extension for the new Microsoft Edge (https://www.microsoft.com/edge) and Chrome browsers that analyzes both SharePoint modern portal and classic publishing site pages. The tool provides a report for each analyzed page showing how the page performs against a defined set of performance criteria. To install and learn about the Page Diagnostics for SharePoint tool, visit [Use the Page Diagnostics tool for SharePoint](page-diagnostics-for-spo.md).

+>The Page Diagnostics tool only works for SharePoint, and cannot be used on a SharePoint system page.

+[Tune SharePoint performance](tune-sharepoint-online-performance.md)

+[Use the Office 365 Content Delivery Network (CDN) with SharePoint](use-microsoft-365-cdn-with-spo.md)

+ Title: "SharePoint modern portal site limits"

+description: Learn about performance recommendations for modern sites in SharePoint, such as limiting calls to SharePoint and external endpoints.

+# SharePoint modern portal site limits

+This article provides performance recommendations for modern portal sites in SharePoint. Use the guidelines in this article to optimize modern portal site performance and avoid common performance issues.

+From the standpoint of performance optimization, there are a few characteristics that make modern portal sites unique. The principal difference between collaboration and portal sites in SharePoint is scale. Portal sites are generally expected to serve more page views to a greater number of users than collaboration sites, and are likely to contain more static content and fewer editable resources. Additionally, the architecture of modern sites differs from classic sites in that most of the processing involved in rendering pages and executing code takes place on the client rather than the server.

+Many of the guidelines in this article focus on minimizing and optimizing calls to SharePoint. Making repetitive calls each time a page is loaded will impact performance for users as the information will be retrieved from the service each time even if it has not changed. As such, requests to SharePoint can be categorized either as calls that are common for all users or calls required for each individual user. Results from these two call categories should be cached to optimize the user experience.

+>Use the [Page Diagnostics for SharePoint tool](./page-diagnostics-for-spo.md) as a starting point to analyze specific performance metrics on SharePoint site pages.

+|Web parts on a page <br/> |20 per page <br/> |We recommend using 20 or fewer total web parts per page, including both out-of-the-box Microsoft web parts and custom web parts. <br/> For more information, see [Optimize web part performance in SharePoint modern site pages](modern-web-part-optimization.md). <br/> |

+|Dynamic web parts on a page <br/> |4 per page <br/> |Dynamic web parts that make one or more queries to SharePoint to fetch the latest data should be limited to 4 per page. The _News_ web part is an example of a dynamic web part. <br/> For more information, see [Optimize web part performance in SharePoint modern site pages](modern-web-part-optimization.md). <br/> |

+|Items in site navigation <br/> |100 per site <br/> |We recommend adding fewer than 100 items to site navigation, and that you make use of out-of-the-box navigation controls. <br/> For more information, see [Optimize page weight in SharePoint modern site pages](modern-page-weight-optimization.md). <br/> |

+|Maximum image size <br/> |300 Kb per image <br/> |We recommend limiting the size of images to 300kb or smaller, and using a CDN to host images, stylesheets and scripts. <br/>For more information, see [Optimize images in SharePoint modern site pages](modern-image-optimization.md) and [Use the Office 365 Content Delivery Network (CDN) with SharePoint](use-microsoft-365-cdn-with-spo.md). <br/> |

+|Third party iFrames <br/> |2 per page <br/> |iFrames are unpredictably slow because they load a separate external page including all associated content such as javascript, CSS and framework elements. If you must use iFrames, limit their number to 2 or fewer per page.<br/> For more information, see [Optimize iFrames in SharePoint modern and classic publishing site pages](modern-iframe-optimization.md). <br/> |

+|Calls to the Taxonomy service <br/> |5 per user per hour <br/> |We recommend that you make no _per request_ calls to the Taxonomy service. If Taxonomy service calls are necessary, cache the information for reuse in the same session. <br/> For more information, see [Optimize page calls in SharePoint modern and classic publishing site pages](modern-page-call-optimization.md). <br/> |

+[Tune SharePoint performance](tune-sharepoint-online-performance.md)

+[SharePoint limits](/office365/servicedescriptions/sharepoint-online-service-description/sharepoint-online-limits)

+[Performance guidance for SharePoint portals](/sharepoint/dev/solution-guidance/portal-performance)

+ Title: "Optimize web part performance in SharePoint modern site pages"

+description: Learn how to use Page Diagnostics to optimize the performance of web parts in SharePoint modern site pages.

+# Optimize web part performance in SharePoint modern site pages

+SharePoint modern site pages contain web parts that can contribute to overall page load times. This article will help you understand how to determine how web parts in your pages affect user perceived latency, and how to remediate common issues.

+> For more information about performance in SharePoint modern portals, see [Performance in the modern SharePoint experience](/sharepoint/modern-experience-performance).

+The Page Diagnostics for SharePoint tool is a browser extension for the new Microsoft Edge (https://www.microsoft.com/edge) and Chrome browsers that analyzes both SharePoint modern portal and classic publishing site pages. The tool provides a report for each analyzed page showing how the page performs against a defined set of performance criteria. To install and learn about the Page Diagnostics for SharePoint tool, visit [Use the Page Diagnostics tool for SharePoint](page-diagnostics-for-spo.md).

+> The Page Diagnostics tool only works for SharePoint, and cannot be used on a SharePoint system page.

+- **Attention required** (red): Any _custom_ web part that is visible in the viewport (screen visible portion of the page, which is loaded first) that takes longer than **two** seconds to load. Any _custom_ web parts outside of the viewport that take longer than **four** seconds to load. Total load time is displayed in test results and is broken down by module load, lazy load, init, and render.

+- **Improvement opportunities** (yellow): Items that might be impacting page load time are shown in this section and should be reviewed and monitored. This might include "out of the box" (OOTB) Microsoft web parts. Results for any Microsoft web parts shown in this section are automatically reported to Microsoft, so **no action is required**. You should only log a support ticket for investigation if you're experiencing slow performance on the page and **all Microsoft web parts** on the page appear in the results in the **Improvement opportunities** section. A future Page Diagnostics for SharePoint tool update will further break down the results based on the specific configuration of the Microsoft web part.

+If the **Web parts are impacting page load time** result appears in either the **Attention required** or **Improvement opportunities** section of the results, select the result to see details about which web parts are loading slowly. Future updates to the Page Diagnostics for SharePoint tool might include updates to analysis rules, so please ensure you always have the latest version of the tool.

+- **Total** shows the total time for the web part to module load, initialize and render. It's the total relative time taken by the web part to render on the page, from beginning to the end.

+- **Module Load** shows the time taken to download, evaluate, and load the extensions JavaScript and CSS files. It will then start the Init process.

+- **Lazy Load** shows the time for deferred loading of web parts not seen in the main section of the page. There are certain conditions where there are too many web parts to render, and they're queued to render to minimize the page load time.

+ It's an asynchronous call and init time is the calculation of time for the onInit function when the returned promise is resolved.

+ It's the JavaScript execution time to mount the DOM in the document (page).

+There are three categories of possible causes for poor web part performance. Use the following information to determine which issues apply to your scenario and remediate them.

+ - Use of the Office 365 CDN is required for optimal static resource download. Public CDN origins are preferable for _js/css_ files. For more information about using the Office 365 CDN, see [Use the Office 365 Content Delivery Network (CDN) with SharePoint](use-microsoft-365-cdn-with-spo.md).

+ - Ensure that you're using the latest version of the SharePoint Framework, and upgrade to new versions as they become available.

+ - Alternatively, if some elements of data require a slower API, but aren't critical to initial rendering, decouple these to a separate call that is executed after critical data is rendered.

+ - Any media sources like images and videos should be sized to the limits of the container, device and/or network to avoid downloading unnecessary large assets. For more information about content dependencies, see [Use the Office 365 Content Delivery Network (CDN) with SharePoint](use-microsoft-365-cdn-with-spo.md).

+ - Avoid API calls that cause reflow, complex CSS rules or complicated animations. For more information, see [Minimizing browser reflow](https://developers.google.com/speed/docs/insights/browser-reflow).

+ - If a certain browser doesn't support a feature used in rendering, either load a polyfill or exclude running dependent code. If the feature isn't critical,

+## Related articles

+[Tune SharePoint performance](tune-sharepoint-online-performance.md)

+[Use the Office 365 Content Delivery Network (CDN) with SharePoint](use-microsoft-365-cdn-with-spo.md)

+description: "In this article, you'll learn about the tools and techniques you can use to monitor and maintain Microsoft 365 connectivity."

+|**Getting notified of new Microsoft 365 endpoints** <br/> |If you're [Managing Microsoft 365 endpoints](https://support.office.com/article/99cab9d4-ef59-4207-9f2b-3728eb46bf9a), you'll want to receive notifications when we publish new endpoints, you can subscribe to our RSS feed using your favorite RSS reader. Here's how to [subscribe via Outlook](https://go.microsoft.com/fwlink/p/?LinkId=532416) or you can [have the RSS feed updates emailed to you](https://go.microsoft.com/fwlink/p/?LinkId=532417). <br/> |

+|**Use System Center to Monitor Microsoft 365** <br/> |If you're using Microsoft System Center, you can download the [Microsoft System Center Operations Manager Management Pack for Microsoft 365](https://www.microsoft.com/download/details.aspx?id=103379) to begin monitoring Microsoft 365 today. For more detailed guidance, see the management pack operations guide. <br/> |

+|**Monitoring the health of Azure ExpressRoute** <br/> |If you're connecting to Microsoft 365 using Azure ExpressRoute for Microsoft 365, you'll want to ensure that you're using both the Microsoft 365 Service Health Dashboard as well as the Azure [Reducing troubleshooting time with Azure Resource health](https://azure.microsoft.com/blog/reduce-troubleshooting-time-with-azure-resource-health/) <br/> |

+|**Using Microsoft Entra Connect Health with AD FS** <br/> |If you're using AD FS for single sign-on with Microsoft 365, you'll want to begin [using Microsoft Entra Connect Health to monitor your AD FS infrastructure](/azure/active-directory/hybrid/how-to-connect-health-adfs). <br/> |

+## Related articles

+You can use the built-in **Office 365 Content Delivery Network (CDN)** to host static assets (images, JavaScript, Stylesheets, WOFF files) to provide better performance for your SharePoint pages. The Office 365 CDN improves performance by caching static assets closer to the browsers requesting them, which helps to speed up downloads and reduce latency. Also, the Office 365 CDN uses the HTTP/2 protocol for improved compression and HTTP pipelining. The Office 365 CDN service is included as part of your SharePoint subscription.

+For more detailed information, see [Use the Office 365 Content Delivery Network (CDN) with SharePoint](use-microsoft-365-cdn-with-spo.md).

+> As images are now automatically managed in a SharePoint service-managed Private CDN, the manually configured Private CDN is in the process of being deprecated. This means that customers no longer need to configure private CDN. The recommended practice remains unchanged as images will be hosted via the service-managed Private CDN automatically and Public CDN will continue to be available for all other file types, like CSS and JS. Any customers using Private CDN for file types other than images, will need to move those files into Public CDN. Public CDN is recommended for these file types, to enhance performance.

+You can use the **Page Diagnostics for SharePoint tool** browser extension to easily list assets in your SharePoint pages that can be added to a CDN origin.

+The **Page Diagnostics for SharePoint tool** is a browser extension for the new Microsoft Edge (<https://www.microsoft.com/edge>) and Chrome browsers that analyzes both SharePoint modern portal and classic publishing site pages. The tool provides a report for each analyzed page showing how the page performs against a defined set of performance criteria. To install and learn about the Page Diagnostics for SharePoint tool, visit [Use the Page Diagnostics tool for SharePoint](./page-diagnostics-for-spo.md).

+When you run the Page Diagnostics for SharePoint tool on a SharePoint page, you can select the **Diagnostic Tests** tab to see a list of assets not being hosted by the CDN. These assets are listed under the heading **Content Delivery Network (CDN) check** as shown in the screenshot following.

+>The Page Diagnostics tool only works for SharePoint, and cannot be used on a SharePoint system page.

+The Office 365 CDN is designed to optimize performance for users by distributing frequently accessed objects like images and JavaScript files over a high-speed global network, reducing page load time and providing access to hosted objects as close as possible to the user. The CDN fetches your assets from a location called an _origin_. An origin can be a SharePoint site, document library, or folder that is accessible by a URL.

+- **Public CDN** is designed to be used for JS (JavaScript), CSS (StyleSheets), Web Font File (WOFF, WOFF2) and nonproprietary images like company logos.

+Before you make changes to the tenant CDN settings, you should verify that it meets compliance, security, and privacy policies of your organization.

+For more detailed configuration settings, or if you have already enabled CDN and want to add additional locations (origins), see the section [Set up and configure the Office 365 CDN by using the SharePoint Management Shell](use-microsoft-365-cdn-with-spo.md#set-up-and-configure-the-office-365-cdn-by-using-the-sharepoint-online-management-shell)

+Connect to your tenant using the SharePoint Management Shell:

+[Use the Page Diagnostics tool for SharePoint](./page-diagnostics-for-spo.md)

+[Use the Office 365 Content Delivery Network (CDN) with SharePoint](use-microsoft-365-cdn-with-spo.md)