Docs update tracker

Updates from: 03/15/2022 02:28:44

Service	Microsoft Docs article	Related commit history on GitHub	Change details
SharePoint	Control Access From Unmanaged Devices	https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/control-access-from-unmanaged-devices.md	Title: "Control access from unmanaged devices" + Title: "Control unmanaged device access to SharePoint and OneDrive" - admindeeplinkSPO -# Control access from unmanaged devices +# Control unmanaged device access to SharePoint and OneDrive As a SharePoint or global admin in Microsoft 365, you can block or limit access to SharePoint and OneDrive content from unmanaged devices (those not [hybrid AD joined](/azure/active-directory/devices/overview#hybrid-azure-ad-joined-devices) or compliant in Intune). You can block or limit access for:
SharePoint	Create B2b Extranet	https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/create-b2b-extranet.md	Depending on your collaboration needs, you can include Microsoft 365 groups or M Seamless collaboration: Collaborate with your partner users as if they are part of your organization, including allowing them chat and conferencing through Teams. - Auditing and reporting. Microsoft 365 B2B extranet offers visibility into the access of your content by external partner users. One of the key IT benefits is to be able to audit usage, including being able to see who is inviting whom and when an external user logs in to access the content. See [Search the audit log in the Security & Compliance Center](/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance) for more information. + Auditing and reporting. Microsoft 365 B2B extranet offers visibility into the access of your content by external partner users. One of the key IT benefits is to be able to audit usage, including being able to see who is inviting whom and when a guest logs in to access the content. See [Search the audit log in the Security & Compliance Center](/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance) for more information. Security and governance. Microsoft 365 features such as [data loss prevention](/microsoft-365/compliance/data-loss-prevention-policies) and [Microsoft Cloud App Security](/cloud-app-security/what-is-cloud-app-security) provide a robust feature set to help you create a secure guest sharing environment. Depending on your collaboration needs, you can include Microsoft 365 groups or M \|Condition \|Microsoft 365 extranet \|SharePoint "on-premises" extranet \| \|--\|--\|--\| -\|Firewall access required for external users \|No \|Yes \| +\|Firewall access required for guests \|No \|Yes \| \|Complex network and infrastructure configuration required \|No \|Yes \| \|Security hardening \|Managed through Microsoft 365 configurations \|Manually configured by IT staff \| \|IT labor intensive \|No \|Yes \| To get started setting up a SharePoint extranet site: ## See also -[Microsoft 365 guest sharing settings reference](/Office365/Enterprise/microsoft-365-guest-settings) +[Microsoft 365 guest sharing settings reference](/Office365/Enterprise/microsoft-365-guest-settings)
SharePoint	Information Barriers	https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/information-barriers.md	When using information barriers with SharePoint, the following IB modes are supp \| Mode \| Description \| Examples \| \|:- \|:-\|:-\| -\| Open \| When a SharePoint site does not have segments, the site's IB mode is automatically set as Open. See [this section](#view-and-manage-segments-as-an-administrator) for details on managing segments with the Open mode configuration. \| A Team site created for picnic event for your organization. \| -\| Owner Moderated \| When a SharePoint site is created for collaboration between incompatible segments moderated by the site owner, the site's IB mode should be set as Owner Moderated. This mode is currently supported only for sites that are not connected to a Microsoft 365 group. See [this section](#owner-moderated-mode-scenario-preview) for details on managing Owner Moderated site. \| A site is created for collaboration between VP of Sales and Research in the presence of VP of HR (site owner). \| -\| Implicit \| When a site is provisioned by Microsoft Teams, the site's IB mode is set as Implicit by default. A SharePoint admin or global admin cannot manage segments with the Implicit mode configuration. \| A Team is created for all Sales segment users to collaborate with each other. \| +\| Open \| When a SharePoint site doesn't have segments, the site's IB mode is automatically set as Open. See [this section](#view-and-manage-segments-as-an-administrator) for details on managing segments with the Open mode configuration. \| A Team site created for picnic event for your organization. \| +\| Owner Moderated (preview) \| When a SharePoint site is created for collaboration between incompatible segments moderated by the site owner, the site's IB mode should be set as Owner Moderated. This mode is currently supported only for sites that aren't connected to a Microsoft 365 group. See [this section](#owner-moderated-mode-scenario-preview) for details on managing Owner Moderated site. \| A site is created for collaboration between VP of Sales and Research in the presence of VP of HR (site owner). \| +\| Implicit \| When a site is provisioned by Microsoft Teams, the site's IB mode is set as Implicit by default. A SharePoint admin or global admin can't manage segments with the Implicit mode configuration. \| A Team is created for all Sales segment users to collaborate with each other. \| \| Explicit \| When segment is added to a SharePoint site either via end-user site creation experience or by a SharePoint admin adding segment to a site, the site's IB mode is set as Explicit. See [this section](#view-and-manage-segments-as-an-administrator) for details on managing segments with the Explicit mode configuration. \| A research site is created for Research segment users. \| ## Sharing sites for IB modes When a site has information barriers mode is set to Owner Moderated: - The site and its content can be shared with existing members. - The site and its content can be shared only by the site owner per their IB policy. -### Explicit and Implicit +>[!NOTE] +>Owner Moderated mode is supported for non-group connected sites only. + +### Implicit + +When a site's information barriers mode is set to Implicit: + +- The option to share with Anyone with the link is disabled. +- The option to share with Company-wide link is disabled. +- The site and its content can be shared with existing members via a sharing link. +- New users can't be added to the site directly. The Team owner should add users to the Team's group using Microsoft Teams. + +>[!NOTE] +>If you've enabled information barriers for SharePoint in your organization before March 15, 2022, see the Enable SharePoint and OneDrive information barriers section in this article. + +### Explicit -When a site's information barriers mode is set to Explicit or Implicit: +When a site is associated with segment(s) and site's information barriers mode is set to Explicit: - The option to share with Anyone with the link is disabled. - The option to share with Company-wide link is disabled.-- The site and its content can be shared only with users whose segment matches that of the site. +- The site and its content can be shared only with users whose segment matches that of the site. For example, if a site is associated with the HR segment, the site can be shared with just HR users (even though HR is compatible with both Sales and Research segments). +- New users can be added as site members only if their segment matches the segment of the site. ## Access control for IB modes For a user to access a SharePoint site with site's information barriers mode is >[!NOTE] >Owner Moderated mode is only supported for non-group connected sites. -### Explicit and Implicit mode +### Implicit mode -For a user to access SharePoint sites that have segments and site's information barriers mode is Explicit or Implicit: +For a user to access SharePoint sites that have information barriers mode set to Implicit: + +- The user must be a member of the Microsoft 365 group connected to the site +- User who isn't a member of the Microsoft 365 group connected to the site won't have access to the site +- The information barriers compliance assistant ensures the group membership is IB compliant. + +>[!NOTE] +>If you've enabled information barriers for SharePoint in your organization before March 15, 2022, see the Enable SharePoint and OneDrive information barriers section in this article. + +### Explicit mode + +For a user to access SharePoint sites that have segments and site's information barriers mode is Explicit: - The user's segment must match a segment that is associated with the site. For a user to access SharePoint sites that have segments and site's information - The user must have access permission to the site. -Non-segment users can't access a site associated with segments. They will see an error message. +Non-segment users can't access a site associated with segments. They'll see an error message. ## Example scenario SharePoint Administrators or Global Administrators can enable information barrie 4. After you've enabled information barriers for SharePoint and OneDrive in your organization, wait for approximately 1 hour for the changes to take effect. +>[!NOTE] +>If you have enabled information barriers for SharePoint in your organization before March 15, 2022, the default access and sharing control for Implicit mode for Microsoft Teams-connected sites are based on the segments associated with the site. + +To enable Microsoft 365 group-membership based access and sharing control for all Implicit mode Teams-connected sites in your tenant, run the following command: + +```powershell +Set-SPOTenant - IBImplicitGroupBased $true +``` + >[!NOTE] >If you have Microsoft 365 Multi-Geo, you must run this command for each of your geo-locations. If you installed a previous version of the SharePoint Online Management Shell, c 7. After you've configured information barriers in SharePoint and OneDrive in your organization, wait for approximately 1 hour for the changes to take effect. +>[!NOTE] +>If you have enabled information barriers for SharePoint in your organization before March 15, 2022, the default access and sharing control for Implicit mode for Microsoft Teams-connected sites are based on the segments associated with the site. + +To enable Microsoft 365 group-membership based access and sharing control for all Implicit mode sites in your organization, run the following command: + +```powershell +Set-SPOTenant - IBImplicitGroupBased $true +``` + >[!NOTE] >If you have Microsoft 365 Multi-Geo, you must run this command for each of your geo-locations. To update a site's mode to Owner Moderated, run the following PowerShell comma Set-SPOSite -Identity <siteurl> -InformationBarriersMode OwnerModerated ``` -Owner Moderated IB mode cannot be set on a site with segments. Remove the segments first before setting IB mode as Owner Moderated. Access to an Owner Moderated site is allowed to users who have site access permissions. Sharing of an Owner Moderated site and its contents is only allowed by the site owner per their IB policy. +Owner Moderated IB mode can't be set on a site with segments. Remove the segments first before setting IB mode as Owner Moderated. Access to an Owner Moderated site is allowed to users who have site access permissions. Sharing of an Owner Moderated site and its contents is only allowed by the site owner per their IB policy. ## Auditing For more information about SharePoint segment auditing in Office 365, see [Searc When a segmented user creates a SharePoint site, the site is associated with the user's segment and site's information barriers mode is automatically set to Explicit. -In addition, the site owners have the capability to add more segments to a SharePoint site that already has segments with site's mode set as Explicit. Site owners cannot remove added segments from sites. SharePoint admins will have to remove added segments in your organization if needed. +In addition, the site owners have the capability to add more segments to a SharePoint site that already has segments with site's mode set as Explicit. Site owners can't remove added segments from sites. SharePoint admins will have to remove added segments in your organization if needed. -When a non-segmented user creates a SharePoint site, the site is not associated with any segment and site's information barriers mode is automatically set to Open. +When a non-segmented user creates a SharePoint site, the site isn't associated with any segment and site's information barriers mode is automatically set to Open. When a SharePoint admin creates a SharePoint site from the <a href="https://go.microsoft.com/fwlink/?linkid=2185219" target="_blank">SharePoint admin center</a>, the site isn't associated with any segment and the site's IB mode is set to Open. To help site owners add a segment to a site, share the [Associate information se When a team is created in Microsoft Teams, a SharePoint site is automatically created for the team's files. Within 24 hours, the segments associated with the team's members are automatically associated with the site and site's information barriers mode is automatically set as Implicit. SharePoint admins can't change the segments associated with a site when the site is connected to a team and mode as Implicit. For more information, see [Learn more about information barriers in Teams](/microsoftteams/information-barriers-in-teams). -The Teams connected site with information barriers mode as Implicit will have access and sharing based on the segments of the site. For example: +Teams-connected sites with the information barrier mode as Implicit have site access based on Microsoft 365 group membership. -- The site and its content is shared with user whose segment matches that of the site.-- A user has access to the site if they have same segment as that of the site and they have site access permissions. +For example, users have access to the Teams-connected site if they're members of the Microsoft 365 group connected to the site. The Microsoft 365 group connected to the Team is IB compliant. + +If you have enabled information barriers for SharePoint in your organization before March 15, 2022, the Teams-connected site's access and sharing is based on the segments of the site. For example: + +- The site and its content can be shared with user whose segment matches that of the site. +- The site and its content can be accessed by a user if they have same segment as that of the site and have site access permissions. + +To enable Microsoft 365 group membership-based access and sharing control for all Implicit mode sites in your organization, run the following command as a SharePoint Administrator: + +```powershell +Set-SPOTenant - IBImplicitGroupBased $true +``` + +>[!NOTE] +>When you create a new team or private channel in Microsoft Teams, a team site in SharePoint is automatically created. To edit the site description or classification for this team site, go to the channel settings in Microsoft Teams.. Learn more about managing [Microsoft Teams connected teams sites](/SharePoint/teams-connected-sites). Users will see search results from: ## Effects of changes to user segments -If a SharePoint site owner or site member's segment changes, they will continue to have access to the site or content per the site's IB mode: +If a SharePoint site owner or site member's segment changes, they'll continue to have access to the site or content per the site's IB mode: - Open mode: User can access the site if they have existing site access permissions.-- Owner Moderated: User can access the site if they have existing site access permissions..-- Explicit and Implicit Mode: If the user's new segment matches the site's segments and user has site access permissions, they will continue to have access to the site. +- Owner Moderated: User can access the site if they have existing site access permissions. +- Implicit Mode: If the user is a member of the Microsoft 365 group, they'll continue to have access to the site. +- Explicit Mode: If the user's new segment matches the site's segment and user has site access permissions, they'll continue to have access to the site. ## Effects of changes to existing information barrier policies With Information barriers policy compliance report, the SharePoint admin will ha To manage out of compliance sites: - In Explicit mode, a SharePoint admin must change the associated segments to bring them in to IB compliance.-- In Implicit mode for a site with segments, a SharePoint admin cannot manage segments directly. We recommend the Teams admin to manage the Team's membership to bring the Teams membership roster and segments in to IB compliance. +- In Implicit mode, a SharePoint admin can't manage segments directly. We recommend the Teams admin to manage the Team's membership to bring the Teams membership roster and segments in to IB compliance. -## How to suspend SharePoint and OneDrive information barriers in your tenant +## How to suspend SharePoint and OneDrive information barriers in your organization If your organization would like to temporarily suspend information barriers on SharePoint, you must use SharePoint Online Management Shell and the [Set-Spotenant](/powershell/module/sharepoint-online/set-spotenant) cmdlet.
SharePoint	Set Up Site Design Hub Site	https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/set-up-site-design-hub-site.md	Title: "Set up a site design for your hub site" + Title: "Set up a site template for your hub site" search.appverid: description: In this article, you will learn how to run scripts on sites when they're associated with a hub site. -# Set up a site design for your hub site +# Set up a site template for your hub site -A site design is one or more site scripts that Microsoft SharePoint runs when a site is associated with a hub site. Actions describe changes to apply to the new site, such as creating a new list or adding nodes to the site navigation. Site designs provide reusable lists and custom actions so your users can quickly get started with the features they need. +A site template is one or more site scripts that Microsoft SharePoint runs when a site is associated with a hub site. Actions describe changes to apply to the new site, such as creating a new list or adding nodes to the site navigation. Site templates provide reusable lists and custom actions so your users can quickly get started with the features they need. > [!NOTE] -> For organizations using Multi-Geo Capabilities in Microsoft 365, hub site designs work only when sites are in the same geo location as the hub site. +> For organizations using Multi-Geo Capabilities in Microsoft 365, hub site templates work only when sites are in the same geo location as the hub site. > [!NOTE] > These instructions require the SharePoint admin or Global Admin role in Microsoft 365. -## 1. Create a JSON script, add it, and create the site design +## 1. Create a JSON script, add it, and create the site template -Follow the steps in [Get started creating site designs and site scripts](/sharepoint/dev/declarative-customization/get-started-create-site-design/). For the full list of supported actions, see [Site design JSON schema](/sharepoint/dev/declarative-customization/site-design-json-schema/). Note that when you create the site design, the site template you provide ("64" for team site or "68" for communication site) doesn't matter. +Follow the steps in [Get started creating site templates and site scripts](/sharepoint/dev/declarative-customization/get-started-create-site-design/). For the full list of supported actions, see [Site template JSON schema](/sharepoint/dev/declarative-customization/site-design-json-schema/). Note that when you create the site template, the site template you provide ("64" for team site or "68" for communication site) doesn't matter. -## 2. Scope access to the hub site design +## 2. Scope access to the hub site template -When a site design is first created, it is available to everyone. You can grant View rights to the site design. After rights are granted, only the users or groups (principals) specified have access. We recommend granting access to the same principal used to scope the hub site. +When a site template is first created, it is available to everyone. You can grant View rights to the site template. After rights are granted, only the users or groups (principals) specified have access. We recommend granting access to the same principal used to scope the hub site. ```PowerShell Grant-SPOSiteDesignRights Grant-SPOSiteDesignRights Replace \<ID\> with the site design ID from when you added the site script. -## 3. Set your site design for the hub site -You can set the hub site design in two ways. You can do it using the following PowerShell command: +## 3. Set your site template for the hub site +You can set the hub site template in two ways. You can do it using the following PowerShell command: ```PowerShell Set-SPOHubSite https://contoso.sharepoint.com/sites/Marketing Set-SPOHubSite https://contoso.sharepoint.com/sites/Marketing Replace \<ID\> with the site script ID from when you added the site script. -You can also let hub site owners set the hub site design by using a new option available in the UI. For info about the hub site settings available to site owners, see [Set up your SharePoint hub site](https://support.office.com/article/e2daed64-658c-4462-aeaf-7d1a92eba098). +You can also let hub site owners set the hub site template by using a new option available in the UI. For info about the hub site settings available to site owners, see [Set up your SharePoint hub site](https://support.office.com/article/e2daed64-658c-4462-aeaf-7d1a92eba098).
SharePoint	Sharepoint Azureb2b Integration	https://github.com/MicrosoftDocs/OfficeDocs-SharePoint/commits/public/SharePoint/SharePointOnline/sharepoint-azureb2b-integration.md	This integration isn't supported in the following Microsoft 365 This integration requires that your organization also enable [Azure AD email one-time passcode authentication](/azure/active-directory/b2b/one-time-passcode). > [!NOTE] - > When the integration is enabled, people outside the organization will be invited via the Azure B2B platform when sharing from SharePoint. If the Azure B2B One Time Passcode option is enabled, recipients that don't have password-backed accounts will get a sign-in experience through Azure AD that uses One Time Passcodes. Otherwise, they will authenticate via their own Azure AD account or via an MSA account. + > When the integration is enabled, people outside the organization will be invited via the Azure B2B platform when sharing from SharePoint. When the Azure B2B One Time Passcode option is enabled, recipients that don't have password-backed accounts will get a sign-in experience through Azure AD that uses One Time Passcodes. Otherwise, they will authenticate via their own Azure AD account or via an MSA account. > When the integration isn't enabled, people outside the organization will continue to use their existing accounts created when previously invited to the tenant. Any sharing to new people outside the organizaton may result in either Azure AD-backed accounts or SharePoint-only email auth guests that use a SharePoint One Time Passcode experience to sign in. >[!NOTE]