Control Add Shortcut to OneDrive with a tenant-level setting
Diesen Beitrag auf Deutsch lesen
A focused PnP PowerShell script disables SharePoint Online Add Shortcut to OneDrive across the tenant using certificate-based authentication.
TL;DR
Set DisableAddToOneDrive = True to disable SharePoint Online Add Shortcut to OneDrive at tenant level. The described PnP PowerShell workflow connects to the SharePoint Online administration site with an Azure AD app registration and certificate, logs execution, reports success or failure, and disconnects cleanly.
Original by Josiah Opiyo, on Microsoft 365 and Power Platform Community Blog. Read the original
This is our own summary, not a republication or full translation.
Governance takeaway
- Admins/CoE: Apply DisableAddToOneDrive at tenant level with a focused PnP PowerShell script when site-by-site or manual administration is unsuitable.
- Security/Compliance: Use the described non-interactive app registration and certificate authentication, while retaining configuration and execution logging for a repeatable administrative process.
- Leadership/Business: Decide whether the convenience of SharePoint shortcuts outweighs governance and support concerns, since the setting removes the feature across the tenant.
Frequently asked questions
Which setting turns off Add shortcut to OneDrive for the whole SharePoint tenant?
The setting is called DisableAddToOneDrive and is set to True. It applies at tenant level rather than per site and is set with a PnP PowerShell script.
Why use a script instead of manual administration for this SharePoint setting?
The author did not want to manage the setting manually or site by site, because the requirement was a tenant-level change.
How does the script sign in to the tenant without an interactive login?
It uses non-interactive certificate-based authentication through an Azure AD app registration. For that you need the client ID, the certificate thumbprint and the tenant identifier.