Microsoft 365 Community Community Demos, 19 May 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Exploring the depths of undocumented admin REST API through an SPFx solution

Description

In this 16-minute developer-focused demo, Michaël Maillot points out there is no SharePoint Admin REST API documentation as the APIs are not intended for external use. The APIs do provide a means to address admin actions without using external tools, requires no back-end, and uses current user context. The presenter’s AdminSpoWebPart app is used to manage sites in tenant specifically - Site capabilities, CDN, Themes, and External Users. Caution: Use undocumented APIs at your own risk.

This PnP Community demo is taken from the Viva Connections & SharePoint Framework Bi-weekly sync call recorded on February 23, 2023.

Demo Presenter
• Michaël Maillot (onepoint) | @michael_maillot

Supporting materials
• Resource - SharePoint REST API Metadata Explorer | https://s-kainet.github.io/sp-rest-explorer
• Library - PnP/PnPjs sp-admin | https://pnp.github.io/pnpjs/sp-admin
• Repo – michaelmaillot / spfx-form-boilerplate | https://github.com/michaelmaillot/spfx-form-boilerplate

Learn more
• Microsoft 365 Unified Sample gallery - https://aka.ms/community/samples
• Microsoft 365 Platform Community in YouTube - https://aka.ms/community/videos
• Microsoft 365 Platform Community - http://aka.ms/community/home

A

B

Good morning, good evening, good afternoon, wherever you are around the world under the snow today, I'm going to show you a sneak peek about possibilities around SharePoint, rest API, but not booze who's, we know but who's. We don't know introducing the SharePoint undocumented admin. Rest API.

B

My name is Michael I'm, a 265 Solutions developer at one point: I live in noun France, uh you can reach out on Twitter GitHub and I also have personal site when I share some stuff, so first of all happy anniversary to sharpen framework yay.

B

So we all know about boost rest apis we're using them since the Stone Age or almost we played with list items with sites, user contacts, permissions, apps and content types and so much more, and we always wanted to provide more to achieve more from a client-side perspective. So when using tools such as PNP, Powershell or CLI for Microsoft 665, we know that there is a big one, which is called the clients SVC. But we also know that it's hard to play with it, since it requires a bunch of unreadable parameters.

B

But yet we try to play with it, but to go further by still playing with your browser developer console. For example, you see many and many many rest API calls made by by uh by Microsoft 65, and we we can see that there are other features that can be reachable through API such as Microsoft 365 groups, Senate, Administration and website properties, team channels, policies and many more but okay I know you are going to change.

B

You're gonna tell me that there is already some arrest API documentation, which is called Microsoft graph right right, okay, but the thing is that to in order to explore the Microsoft graph, you need Azure ID permissions with application, dedicated context which can be unreachable or difficult to obtain for some developers, depending on their context on the company on the IIT governance security. This can be painful to obtain and also it's it's limited to specific options depending on what you want to interact with.

B

So now. Let's talk about a SharePoint and Main rest, API, documentation or well. Let's not talk about it, since there is currently no existing documentation, but that doesn't stop us from digging up. So I was thinking um about the use case to get involved into those undocumented admin.

B

Rest API, I thought about uh the scenario where I'm, an I.T guy, which works with Lieutenant I, mean on a daily basis and I'm working with The Chaperone Enlightenment admin, user interface, from which I can get sites information, but if I want to go further into working with sites, properties, I need extra commands, so I need to use third-party tools. I need to to use command line interfaces.

B

Also, the governance can be hard when you want, for example, to have a list of all the site- collection, Hub, catalogs, or to get all the external users that are declared in some sharpen sites and if you are working in it departments with tickets submitted by users which needs you to make some repetitive actions can be really painful uh in the long term perspective.

B

So my idea was to provide the solution that covers those actions that can't be available through the user interface and without using a third-party tool that way I can take advantage of the undocumented rest apis without any backend applications and with the current user context.

B

So, let's have a demo about this here, I'm in my spfx teams, web Parts app yeah, that's a bunch of passwords in it, but anyway, I got this user interface when I can access to all my sites that exist on my tenants and also my what I call the special sites with which are, for example, the redirect sites when you rename a sharpenside URL um I can have also my the point. Publishing Hub I can have my internet app catalog here and I.

B

Have my templates I have the information if it's a group connected site or not which okay? This is something that is already available in the native user interface. But what is not available is the information. If my this site collection has the app the site collection, app, catalog enabled which here's the case for this site here, for example, I also have the information about which site is currently configured as my home sites, and also a bunch of extra options here that are available or not depending on the targeted site.

B

So, for example, I can decide to set a site as read-only, for example. So here, if I take my this site and decided to lock it okay, now my site is supposed to be locked. This is to be in recently States, so here, for example, I I can edit. My page I can add a new ad new page if I just make a refresh here now my site is Unwritten State and if you have also this beautiful message bar that states that it has been updated as recently so this is.

B

This is something that is interesting uh from my perspective, but which is not available.

B

In some company that for which they are using another search bar or another search engine other than Microsoft search, yes, it exists and I can also decide to block the file. Downloads and I can also have access to some extra options here, like, for example, um I can decide if I want to disable the comments on site Pages, which is only available, for example, of our communication sites.

B

uh Also, if I want to set this site as a home site here, I can decide to disable the options to run the flow power, automate flows and also to disable the sharing capabilities, but only for this, the one side- and this is pretty interesting. Furthermore, I- can, through always through uh admin rest apis I can handle the CDN, for example, which currently doesn't have an user interface, even if the private CDN will be handled by Microsoft in the short term, it's still an option that is available.

B

I can also decide to add a new origin. For example, let's say that I want to add the master page. Origin I have also the state of my lcdn, because it takes some time to be fully enabled. So this is so. This is something that I wanted to to to provide as an extra option.

B

I can also handle the organization themes. For example, I can add a new new theme with color palettes and, as you can see, I'm not using interface guy developer. So it's pretty ugly, but you did this this. Can the idea was to give you a sneak peek about what you can achieve with just a few lines of code and apis and of course, I can decide to edit my theme or add add a new one here wow which are available.

B

Then, when you want to change the look of a site you have access to these themes are organization teams and finally, I can have also my external users, which is typically an interface that is only available through the M365 admin Center. But here from sharpen online admin, rest API, you can access to to this feature. So now, let's have a look at the code, so here I mean my web part definition file, which is called admin, SPO webpart web part yeah. The name is bring by the teams toolkit generator. Thank you anyway.

B

In my own init method, I'm creating two contexts with pnp.js, which is declared here. The first is with the current spfx context, and the second one is with Azure ID and MSL 1.0, because this is currently this version that is supported by pen pages and I, admit that I a little bit lied to you, because for some endpoints you have to request. Some endpoints can only be requested through the sharpen online admin.

B

Url I'll show you a little bit later, but that's why I uh declared two contexts so once uh everything is declared we're going to the main web part here, which only consists in the Declaration of my main components through before, like, for example, the sites components which, when loaded I'm loading all my sites, but as you can see here, I've also loaded on in my in Microsoft log, all the available site templates, but also the existed environments, perhaps environments. Sorry, but here for my need.

B

I wanted to get all the site collection, app, catalog, so I'm going to request a search query with this information and also getting the site properties for my SharePoint sites. With this method, and once everything is ready, I got I'm I'm, designing my site, stable, with all my extra options.

B

That I showed you before, like, for example, how to set a site as read-only here and for which I'm sending a site property and calling genetic method which is called update, site properties and which just calls a generic method, which is called sites where, from the tenants, endpoints and with the site ID as a property I'm just sending the site properties that I want to update.

B

So now, if I want to block the download, the file downloads is pretty much the same. And now, if I wanted to access to my extra options like, for example, set site as a home site here, a demo action components. We got some properties depending on the site, template if it's a communication site. So, for example, I can disable the comments on the side on side Pages or set a site as a home site.

B

In any case, when I want to update site properties. I refer to this generic beta that I just showed you before, and to set the site as a home site. I'm going to work with the SPH sites, endpoints, which provides me a method to update a site as a home site this method. This endpoint also provide me the current home site for my tenants and to finish I've got the create group panel here, which requests a group name, an EDS and a parameter to state.

B

If the group is public or not, this is the case when I want to create a group for a SharePoint team site, modern team site, which is not group connected so I'm, calling the create group site method for new group site manager, endpoints these three parameters and that's it for the demo, just a overview of some arrow that I met when I testing some endpoints I got, the authentication method is dotted out. I got the method. Operation is not implemented, so, but it's a it's available anyway.

B

I got the specified method is not supported, but it and again it's it was it's something that is available. I got the optional problems which is not supposed but available as a parameter and I got this special one. The requested operations part of an experimental feature. That is not supporting the current environments, which is what what I wanted to get on sites from the tennis Administration tenant endpoints. So maybe it's a new feature to come because it gets on sites.

B

I, don't know so a few examples of metals that the chicken query that are available you can. You have to create group that I showed before you had the site, rename jobs which is called when you want to rename a site URL you have to get available tax for sites into which is related to the compliance Center.

B

You can validate to group name through the ideas before creating it. With this method, you can get the members of uh of m265 group. You can get the configuration of two of your Viva dashboard. You can get to recent list. You can have statues if you create a site as a parameter. Is a communication site or not, and you have many many more. So what helped me to achieve this, so I I use.

B

Of course, the developer console I also make many requests with the postman, with the sharpen access token that I got through PNP Powershell, but also the form digest value object from the SP page context, info JavaScript objects and a lot of patients. So, to finish most comments, your only works in post requests and then for some comments. They only work with the X request, digest header and some others only works with the admin and URL and some others request.

B

The metadata objects specified in the payload and, of course, all of these options depends on the API response, and that's it here. What's really at me, you have to sharpen rest API metadata Explorer, which was provided by Sergey, which is a really really awesome to face that display all the objects, all the endpoints available, and also the admin points provided by the pen, pgs and the repo for the app that I use for my demo.

B

A

Thank you, Michael I will jump in and just remind everybody that any API which is not documented is not supported by Microsoft. So, yes, these are good exercises and and there's a lot of things where an apis which are not unfortunately, exposed for third party.

A

um You can call them, but they might be actually get updated without any further notice because, as they still not documented, that means that they are not intended to be used externally, but there's a lot of things, of course, from these apis, which we can learn and also create reminder for Microsoft on on page. We need this apis. We need this capabilities for our Solutions.