Hey everyone,

With Microsoft 365 Copilot adoption ramping up, one of the biggest governance challenges tenant admins face is oversharing. If legacy SharePoint sites were historically shared with "Everyone except external users", Copilot will index and surface those confidential documents (salaries, HR notes, acquisition data) to general staff in chat responses.

While trimming permissions on individual libraries takes weeks, Microsoft introduced **Restricted Site Access (RSA)** policies to immediately lock down citations at the container level.

### How RSA Works

RSA restricts access to the site collection strictly to members of a designated Entra ID Security Group—even if individual files or subfolders had broader permissions. Copilot citations from that site are instantly restricted to group members.

### Quick PowerShell Implementation:

Here is the baseline script to apply RSA using the SharePoint Online PowerShell module:

```powershell

Import-Module Microsoft.Online.SharePoint.PowerShell -ErrorAction Stop

Connect-SPOService -Url "https://yourtenant-admin.sharepoint.com"

# Enforce Restricted Site Access (RSA) for Copilot Governance

$SiteUrl = "https://yourtenant.sharepoint.com/sites/ConfidentialFinance"

$AllowedGroupId = "YOUR-ENTRA-SECURITY-GROUP-OBJECT-ID"

Set-SPOSite -Identity $SiteUrl `

-RestrictedAccessControl $true `

-RestrictedAccessControlGroups $AllowedGroupId

Write-Host "RSA successfully enforced! Copilot will only cite content for members of group $AllowedGroupId." -ForegroundColor Green

```

### Key Considerations:

1. **Propagation Time:** Changes typically take 1 to 2 hours for Copilot's semantic search index to reflect the boundary.

2. **Readiness:** Unmanaged/BYOD users on Conditional Access Limited Access sessions are also gated by this rule.

I wrote a detailed enterprise masterclass breaking down the architecture, automated audit script, and edge cases here:

https://lovesharepointblog.blogspot.com/2026/11/microsoft-365-copilot-governance.html

Hope this helps anyone dealing with Copilot security audits! Let me know how your teams are approaching Copilot data governance.

Hi everyone,
We use SharePoint Online as our company intranet, and we are experiencing a strange issue when creating and publishing news posts. Sometimes, the Description field (under Page details) changes language on its own.
Has anyone else run into this on their intranet? We are trying to figure out if it's caused by browser auto-translate overwriting the field when an editor saves/publishes, SharePoint's auto-generated description pulling text from somewhere else, or something related to site/user language settings. Or if the post has been created with copilot - or if the field somehow tries to auto fill the text?
Any ideas on what triggers this and how to prevent it? Thanks!

Hi everyone,

I created a test tenant and signed up for a trial subscription so I could practise using SharePoint sites, permissions, Intune, and other Microsoft 365 features. I used the trial link, selected 10 licences, entered my card and personal details, and then received a message on the final page saying that it could take up to 48 hours to process my request.

I didn’t receive any emails at my original email address. However, after two days, I tried signing in to the Microsoft 365 admin centre, and it worked. The problem is that I can’t find the trial licences anywhere. Under Billing > Your products, all I can see is Microsoft Entra ID Free.

When I created the account and my card was verified, I remember seeing a message saying that I could cancel the trial before 10 December to avoid being charged. However, I can’t find the trial subscription or a cancellation button now.

I’m a little confused about what happened. I didn’t receive an email saying that the trial had been approved or rejected, so I’m unsure whether the subscription is active or whether the application failed.

Has anyone experienced something similar? I’m planning to call Microsoft support on Monday because I don’t want any unexpected charges!

Thanks.

Hi all,
I just got my SP or SPO (?), not sure paying 8$ to test my school coding project. I need to upload some files using Python to SPO/site. And I can't find how to add site, can you help if you know how to do this, all www google stuff says to click on + sign, but I don't see it.

Thanks so much, maybe I'm on a wrong plan ?

BTW is anybody especially student needs sandbox let me know I will add you to my SP.
That what I see , see pic below
my SP sites

Hi

I d like to test my student python project to upload download files to SPO.

Is there any option ti get test or trial env?

Are all SPO these days are using MFA?

Tx all for help

We've hit this on a few engineering firms' RFI registers in SharePoint Online. Posting the fix because most of what search turns up is SharePoint Server advice.

Quick context: 5,000 is the list view threshold. An Online list can hold up to 30 million items. The error fires when one view tries to return more than 5,000.

What fixed it:

1. Make a new test view so the team's default stays untouched.

2. Write down what the failing view asks for: filters, sort, Group By/Totals, every lookup and person column.

3. Pick the column that narrows daily work most (usually Project or Status). List settings > Indexed columns > index it.

4. Make that column the FIRST filter (Project equals current job). Confirm it returns well under 5,000, then add Status is not Closed.

5. Strip grouping, totals and nonessential lookups from the working view. Whoever needs them gets a separate, narrower view.

6. Using project folders? Leave "Show all items without folders" off. It flattens everything into one query and the error comes right back.

Gotchas:

- An index won't rescue an unselective view. All-history plus heavy grouping or lookups can still fail.
- Export to Excel is one-way. Edits in the workbook never reach SharePoint, and a refresh overwrites them. Date the file name, treat it as read-only.
- Raise the threshold, Access Services, reset the old sync client: that's Server/legacy advice. In Online the lever is the view.
- If a flow reads the register, filter Get items on the same indexed column.

While the view is down, one named PM works from the last dated export and keeps a short exception log, then reconciles it to the register once the view is live.

If a cross-project open-RFI view still returns 5,000+ after filtering, the next step is a data-model review (how RFIs, projects and submittals relate, which lookups the views lean on). Record count alone isn't a reason to migrate.

Full write-up with the exact steps:
Read the full write-up!

For context, we are a small manufacturing company. We would like to have this SharePoint site available on all workstations on our floor that direct production / maintenance members to resources such as Work Instructions or HR resources. The issue is that Production employees do not have M365 accounts as its not required for their job in any way. Everyone in Office does have M365 accounts.

The obvious issue here is that you are required to be signed into a Microsoft Account in order to view a SharePoint site. A workaround could be a single "Production" M365 account that's signed into all work stations on the floor and used publicly. It would be signed in on approx. 60 devices though and I assume would break some sort of ToS with Microsoft since accounts are supposed to be per user.

Are there any other work arounds here? Id love to use SharePoint but if we can't I assume ill just have to make some sort of custom website solution, unless someone more knowledgeable in the Microsoft World could give me some advice!

Thanks!

Hi
After some recommendations for a scrolling news ticker banner for SPO.
Something that sits at the top of the page (not in the editable page section) but at the top of the page. Above the navigation.

I work at a financial institution that is on SP Subscription Edition. We have TONS of 2010 workflows built and maintained via SP Designer. We also have a lot of InfoPath forms throughout the various SP Lists and Libraries across the entire company. Per Microsoft, both the workflows and InfoPath Form Services will be removed by July 2027.

Our company does not currently have a plan for implementing alternative solutions or tools. The logical step would be to move to Power Automate and Power Apps but because we are a financial services company, security concerns will prevent using those tools due to them being cloud-based.

What options would make sense in this scenario? My biggest question and concern is all existing data and processes. Any ideas for viable solutions would be appreciated.

Hi, I'm trying to set a script to upload multiple files into SPO. Originally was thinking to use Python script, but was told that I can use only existing account which currently working with few PA flows.
I'm new to Authentication, so trying to check if this is doable.

Looks like SPO requires MFA so it's not possible to use that PA account, do you know how to find the best way to achieve this ? What information I can collect from SPO to confirm all settings.

Simple call for office365 package give this error like below, does it mean that I can't use this account and I need to go with App Registration ?

from shareplum import Office365
authcookie = Office365(base_path, username=username, password=password).GetCookies()

Error: in get_security_token   raise Exception('Error authenticating against Office 365. HEre is 'the SOAP response from office 365,response.content

Cheers
VA

I work with SharePoint and I'm trying to tighten up the checklist I use before moving file shares and older sites into SharePoint Online. Right now I check who actually owns each site (and whether they still work here), how many sites have unique permissions, what still relies on old workflows or InfoPath, and how much of it is stale enough to archive instead of migrate. Long paths and blocked file types too, but those are usually the easy ones. I'm curious what others have learned the hard way. What do you check that most people skip? And how do you get site owners to reply when you ask them to clean up?

I finally found some time to try out the new HTML pages, but can't seem to enable them as I can't seem to find the "File Types" toggle in the Site Pages library in any of my test or prod sites.

Is this because I don't have the co-pilot license, or has it just not been rolled out to my tenant yet?

Hi all, I'm trying to move away from PAutomate to python to get multiple files posted to SPO.

Tried this code for Auth and failed, for my case error says need to use client_id which I believe = EntraID? For this I think I need to contact somebody with proper rights.

I afraid that modern MS Security is faster then Python libs, is anybody is running this code successfully in Nov 2026? Surely I will try to set all configuration values rights.

Or can you recommend other approach.

from office365.runtime.auth.user_credentials import UserCredential
from office365.sharepoint.client_context  import ClientContext

# 1. Configuration                        
site_url = r"https://asratomkaX.sharepoint.com"
teenant = 'asratomkaX'
client_id = '123456' # <===????? ke paso ?
username = r'[email protected]'
password = r'welcommen1'
 
# Use with_username_and_password(tenant, client_id, username, password) instead.  For on-premises SharePoint, use allow_ntlm=True.

# 2. Authenticate
#ctx = ClientContext(site_url).with_credentials(UserCredential(username, password))
ctx = ClientContext(site_url)
ctx.with_username_and_password( teenant,client_id, username, password)

Traceback (most recent call last):
File "C:\Users\mocado\PyCharmMiscProject\.venv\Lib\site-packages\msal\authority.py", line 98, in __init__
openid_config = tenant_discovery(
tenant_discovery_endpoint,
self._http_client)
File "C:\Users\mocado\PyCharmMiscProject\.venv\Lib\site-packages\msal\authority.py", line 298, in tenant_discovery
raise ValueError("OIDC Discovery failed on {}. HTTP status: {}, Error: {}".format(
...<3 lines>...
))
ValueError: OIDC Discovery failed on https://login.microsoftonline.com/mocado/v2.0/.well-known/openid-configuration. HTTP status: 400, Error: {"error":"invalid_tenant","error_description":"AADSTS90002:

New small tenant, subscription Active. SharePoint and OneDrive worked normally for about 2 weeks, then suddenly all writes started failing in the browser and in sync. Outlook still works. Billing, subscription and user licences all look right. Microsoft’s tenant storage diagnostic shows 0.01 GB used of 1,274 GB, and PowerShell shows every site as Unlock. Microsoft support is looking into it. I’ve seen two similar reports on Microsoft Q&A within the last week (both new tenants). Is anyone else experiencing this and/or know if a fix?

Firstly, I apologize if this question been asked before. I did search previous posts but none of the solutions offered worked for me and my colleagues. Also, I apologize if this question is rather juvenile (we are rather old).

My department created a folder on our company's Sharepoint and the owner gave "Edit" permissions to the rest of the colleagues. The ones with "Edit" permission are able to view folder, open file, and create new folder. However, we are not able to move any files into the sub-folders that we have created. We tried the "Copy to" option but it did not work as well. I suspect this could be a permissions problem but the Owner said there are only 3 types of permissions available:

1. Can edit

2. Can view

3. Can't download

This is the SP address in case there's something you can figure out (company name and employee name redacted):

https://COMPANY NAME.sharepoint.com/personal/EMPLOYEE NAME/Documents/Forms/All

There is no "Gear" icon on the upper right hand side of the page. There is only "Help" and "Provide feedback to Microsoft" icons.

Is there a solution to our issue? Is it because it is under Employee's personal folder?

https://www.microsoft.com/en/microsoft-365/roadmap?id=569208

I have been very excited about this and was hoping there was an update. Has anyone gotten a chance for early access or know if there has been any updates?

Thank you!

I’m asked as the only IT hire to build a contact directory that can sync to teams and outlook, user friendly, accessible on mobile(on the go). I thought well, Sharepoint list can do this, now the former directory(sits on just a laptop) has 7000 entries on Microsoft access(which I’ve exported and formatted to my columns in an excel file) not yet imported to my Sharepoint list. I’ve tested out joining the site on teams and it works, created an entry and all. there’s a caveat in the syncing with outlook. Most users that’ll be using the directory use the Outlook PWA which support for it is limited

I need help from pros who have tackled something like this before, am I going at this wrong? Is there a better way to approach this. What should I look out for

Hi r/sharepoint, I'm on the SPFx team at Microsoft.

We're running our SPFx developer survey and want to hear from people who build with SPFx day to day: what works, what slows you down, and what you'd like us to focus on next.

Our blog post explains why we run the survey, how we use the results, and what we shipped this year, and it links to the survey: https://devblogs.microsoft.com/microsoft365dev/your-voice-shapes-spfx-take-our-developer-survey/

Feedback form directly available at https://aka.ms/spfx/feedback - please elaborate your input so that we know how to fix things and help you in future 🙏

The results feed directly into SPFx planning. I'll be reading this thread too, so feel free to share thoughts or questions in the comments.

Can I add temp storage and remove later.

I'm an admin and I want to add it to the tenant

Cheers

Hi, our organization has decided to migrate SharePoint 2016 sites to SPO.

We have around 1600 sites and 24 TB of overall data. Sharegate pro migratory (5 machine) has been requested.

I would like to know what are server specifications required to run the migration? Eg Cpu cores, RAM size, storage and network bandwidth. Thank you in advance.

Here it says "Knowledge Base is currently available only to users enabled for usage-based billing". Three days ago, I enabled usage-based billing for a M365 group that I am a member of. But I still do not see the option in SharePoint. Do I also need a Copilot License or are there other requirements not mentioned on the MS Tech community page?

I've been tasked with shifting several very large folders going back 16 years+ from a network share drive to SharePoint Online. I have ShareGate to help with the actual data transfer (and is working well so far) and Linktek's Linkchecker software which is supposed to help fix hard coded links (eg D:\ to SharePoint URL).

The problem I'm having is that Linkchecker seems to be struggling to parse VBA/macros in Excel spreadsheets - the scans become extremely slow (estimate to take days) and eventually time out. I've increased the timeout value but it makes no difference. Linktek support has been unresponsive.

Is there another/better way to scan Excel files for hardcoded file path links and change them to valid SharePoint site/document library/file urls?

I'm looking for a Microsoft 365 solution for a fairly common records-management scenario.

I have already set up several working flows that process every email that comes into a specified shared Outlook email box, and copy the attachment(s) to SharePoint. Then, they apply metadata including 4 fields from the email.

In another shared email, we receive too much clutter to do this to every incoming message. We sometimes receive emails that contain documents we want preserved in a SharePoint document library. Most emails do not belong there, so the user must make a deliberate decision on a case-by-case basis.

Requirements:

• User receives an email in Outlook.

• At some later time, the user decides, "This email should be imported into SharePoint."

• The solution should preserve as much email metadata as possible:

  • Sender

  • Recipients

  • Subject

  • Received date/time

• Attachments must also be preserved.

• Standard M365 / Power Automate solutions preferred.

• Avoid custom code if possible.

What I've already investigated:

• Outlook folder-based workflows (move email to a folder and trigger Power Automate).

• Outlook categories as a designation mechanism.

• Saving the email as a .msg file and uploading to SharePoint.

• Forwarding to a monitored mailbox.

• Using the 'When an email is flagged (V4)' trigger. That appears to only work on the owners mailbox.

Problems encountered:

• I have not found a reliable Power Automate trigger for "user moved an existing email" or "user categorized an existing email."

• Saving a .msg file appears to preserve the email but may not provide an easy way to work with the attachment separately.

• Forwarding creates a new email and loses some of the original transport metadata.

Questions:

1. How are people solving this today in Microsoft 365?

2. Is there a Power Automate trigger such as "For a selected message" that can be launched directly from Outlook and then save both the email metadata and attachments to SharePoint?

3. Are there third-party Outlook/SharePoint integrations that do this particularly well?

4. If you had to design this from scratch for occasional ad hoc records retention, what approach would you use?

I'm interested in both out-of-the-box and practical real-world solutions. If you've implemented this in production, I'd especially like to hear what worked and what turned into a dead end.

Thank you!

One of my users just got an email saying:

"You've been invited to access a file"

The e-mail comes from [email protected].

The message has a body text:

[Redacted Greeting with User's Name]
Do we have an updated Directory?

It then links to an outdated file of the company's directory within our SharePoint stores, with buttons below to "Open" or "Share".

I am aware that [email protected] is sometimes used for phishing e-mails, but I am pretty sure that this is a legitimate e-mail because the invitation text uses a nickname for the target recipient User that wouldn't be widely known outside the company, and it has a link to a file that actually exists inside of our SharePoint.

What me and the User want to figure out at this point is:

• Who sent this invitation?
  There is a question attached, but we don't know who to respond to.

• Also, who designed such an obtuse system where you receive anonymous invitations to access files within a Microsoft tenant?