Documentation

# Site Collection Configuration

Configures the provisioning of a SharePoint site collection, including URL patterns, storage quotas, sharing policies, sensitivity labels, and associated site structure.

Referenced by: SiteCollection file handler via the SiteCollectionSet column.

# Overview

SiteCollectionCfg defines the properties and structure applied when creating a new SharePoint site collection. It references a SiteCfg (for site structure) and optionally a GroupCfg (for group definitions).

Child configurations:

  • SiteCfg — site structure, columns, content types, libraries (referenced via SiteSet)
  • GroupCfg — SharePoint groups to create (referenced via GroupSet)

# Applied when

A site collection is provisioned when:

  • The SiteCollection file handler references this configuration name
  • The provisioning job creates a new site collection using this template
  • The Owner account exists in the directory and has permissions to create site collections
  • Applied once during site collection creation; retroactive updates to the site collection structure require re-provisioning or manual SharePoint administration
  • ConvertToGroupOrTeam or ConvertToGroupOrTeamGroupSet conversion (if configured) occurs immediately after site collection creation, routing to the named Office 365 Group configuration

# Core settings

# Name

Type: string | Default: — | Required: Yes

Unique name for this configuration. Referenced from file handlers via SiteCollectionSet column.

# FormatUrl

Type: string | Default: — | Required: Yes

Server-relative URL pattern. Supports dynamic variables: {ClientCode}, {MatterCode}. Example: /teams/{MatterCode}

# Owner

Type: string | Default: — | Required: Yes

Login name of the site collection primary administrator.

# SiteSet

Type: string | Default: — | Required: Yes

Name of the SiteCfg to apply as the root site template.

# GroupSet

Type: string | Default: — | Required: No

Name of the GroupCfg to apply (creates groups on the site collection).

# Language

Type: integer? | Default: — | Required: No

LCID (opens new window) for site collection language (e.g., 1033 = English US).

# Version

Type: enum? | Default: — | Required: No

SharePoint version: SP2010 (14), SP2013 (15). Only for SharePoint on-premises.

# TimeZone

Type: integer? | Default: 4 | Required: No

SharePoint time zone ID. See time zone reference (opens new window).

# WaitTimeWhenSiteCollectionIsCreated

Type: integer | Default: 5 | Required: No

Seconds to wait after creation for SharePoint propagation. Increase if SharePoint Online is slow.

# ConvertToGroupOrTeam

Type: string | Default: — | Required: No

Convert this site collection to a Microsoft 365 Group or Team using the default Office 365 Group Set. Values: "true", "false", or variable like "{IsTeam}".

Cannot be set together with ConvertToGroupOrTeamGroupSet — use one or the other.

# ConvertToGroupOrTeamGroupSet

Type: string | Default: — | Required: No

Name of the Office365GroupCfg to use when converting this site collection to a Microsoft 365 Group or Team. Supports dynamic variables (e.g. "{Division}_Groups"). When set, this named group configuration is used for group creation instead of the default.

Mutually exclusive with ConvertToGroupOrTeam — setting both causes a validation error when saving in the Configurator and a provisioning failure at runtime.

Behavior:

  • If only ConvertToGroupOrTeamGroupSet is set → conversion is triggered using the named Office365GroupCfg.
  • If only ConvertToGroupOrTeam is set → conversion is triggered using the default group configuration (existing behavior).
  • If both are set → error at save time (Configurator) and at runtime (provisioning service).
  • If neither is set → no conversion; a standard SharePoint site collection is created.

# Storage quotas (SharePoint on-premises)

# StorageMaximumLevel

Type: long? | Default: — | Required: No

Maximum storage quota in GB.

# StorageWarningLevel

Type: long? | Default: — | Required: No

Storage quota warning threshold in GB.

# UserCodeMaximumLevel

Type: double? | Default: — | Required: No

Maximum machine resources for user code.

# UserCodeWarningLevel

Type: double? | Default: — | Required: No

Warning threshold for user code resources.

# SharePoint Online settings

Note: All properties in this section apply only to SharePoint Online. They are ignored on SharePoint 2016 and on-premises deployments.

# SharingCapabilities

Type: enum? | Default: — | Required: No

External sharing level: Disabled, ExternalUserSharingOnly, ExternalUserAndGuestSharing, ExistingExternalUserSharingOnly.

# Classification

Type: string | Default: — | Required: No

Site classification (custom values or Microsoft 365 default classifications).

# SensitivityLabel

Type: string | Default: — | Required: No

Sensitivity label ID to apply. See sensitivity labels for sites and groups (opens new window).

# HubSiteUrl

Type: string | Default: — | Required: No

URL of the hub site (opens new window) to associate with.

# HubSiteId

Type: Guid? | Default: — | Required: No

Hub site ID (alternative to HubSiteUrl).

# BlockDownloadPolicy

Type: bool? | Default: — | Required: No

Prevent file downloads for users without managed devices. See block download policy (opens new window).

# ExcludeBlockDownloadPolicySiteOwners

Type: bool? | Default: — | Required: No

Only applies when BlockDownloadPolicy is true. Exclude site owners from the block download policy. Site owners can download files regardless of device management status.

# ReadOnlyForBlockDownloadPolicy

Type: bool? | Default: — | Required: No

Only applies when BlockDownloadPolicy is true. Enable read-only mode for users affected by block download policy (users can view but not download or edit).

# ConditionalAccessPolicy

Type: enum? | Default: — | Required: No

Conditional access policy type: AllowFullAccess, AllowLimitedAccess, BlockAccess. Determines what actions unmanaged devices can perform on site content.

# AuthenticationContextName

Type: string | Default: — | Required: No

Only applies when ConditionalAccessPolicy is AuthenticationContext. Name of the authentication context to enforce for this site.

# LimitedAccessFileType

Type: enum? | Default: — | Required: No

Only applies when ConditionalAccessPolicy is AllowLimitedAccess. Specifies which file types are allowed for unmanaged devices: OfficeOnlineFilesOnly (web-only), WebPreviewableFiles (web preview only), OtherFiles (other types).

# AllowEditing

Type: bool? | Default: — | Required: No

Only applies when ConditionalAccessPolicy is AllowLimitedAccess. Allow users on unmanaged devices to edit documents (web version).

# ReadOnlyForUnmanagedDevices

Type: bool? | Default: — | Required: No

Only applies when ConditionalAccessPolicy is AllowLimitedAccess. Force read-only mode for all users on unmanaged devices.

# ModernPageExtension

Type: bool? | Default: — | Required: No

Enable modern page extensions (SharePoint Online only).

# Document ID settings

# DocIDProviderUseDefaultPrefix

Type: bool? | Default: — | Required: No

Use the default tenant Document ID prefix. Set to false to use a custom prefix.

# DocIDProviderPrefixFormat

Type: string | Default: — | Required: No

Custom Document ID prefix (max 13 characters). Supports {MatterCode}. Ignored if DocIDProviderUseDefaultPrefix is true.

# Farm features

# FarmFeatures

Type: Guid (list) | Default: [DocIDProvider] | Required: No

Array of farm feature GUIDs to activate.

# DeactivateFarmFeatures

Type: Guid (list) | Default: — | Required: No

Array of farm feature GUIDs to deactivate.

# Modern site settings (SharePoint Online)

# CommunicationSiteDesign

Type: enum? | Default: — | Required: No

Modern site design: Team (-1), Topic (0), Showcase (1), Blank (2).

# CommunicationSiteDesignId

Type: Guid? | Default: — | Required: No

Site design template ID for custom designs.

# UseGraphSiteCreation

Type: bool | Default: false | Required: No

When enabled, site collections are created via Microsoft Graph (POST /beta/sites) using the Sites.Create.All application permission, instead of the SharePoint CSOM Tenant API (Sites.FullControl.All). Reduces the permission footprint for the "Matter = Site Collection" design — no tenant-wide Sites.FullControl.All is required.

Requirements:

  • Sites.Create.All, Sites.Selected, and TermStore.ReadWrite.All Graph application permissions granted in Entra ID (Azure AD). Sites.Create.All alone is not sufficient — it only allows creating the site; Sites.Selected is required for provisioning to make further changes to the site afterwards. The app is automatically granted full control on the sites it creates, so no manual grant is needed for those new matter sites.
  • The Sites.Selected SharePoint application permission — a permission distinct from the Graph Sites.Selected above, granted on the SharePoint API rather than Microsoft Graph — plus a fullcontrol grant on the central DMS site. Unlike the matter sites the app creates, this site pre-exists and is not covered by the automatic grant above, so it needs this one-time manual grant (write is not sufficient — provisioning manages lists on that site).
  • After changing application permissions in Entra ID, restart the provisioning service — it caches its access token for about an hour, so new permissions do not take effect immediately.

See API Permissions (Registered Application) for the full permissions reference.

Limitations:

  • Only team sites are supported. CommunicationSiteDesign = Team (a team site, created via Graph with template sts) and no design (the default) are created via Graph. Combining UseGraphSiteCreation = true with CommunicationSiteDesign = Topic, Showcase, or Blank, or with any CommunicationSiteDesignId, throws NotSupportedException at provisioning time — use the standard (CSOM) creation path for communication sites and custom site designs. This includes CommunicationSiteDesignId combined with CommunicationSiteDesign = Team: the CSOM path silently ignores the design ID in that combination, but the Graph path rejects it.
  • Uses the Microsoft Graph beta endpoint. Will switch to v1.0 once generally available.
  • The configured TimeZone is applied through the site's regional settings, which needs no tenant admin permission. Other site collection settings that require tenant admin permission (storage quotas, SharingCapabilities, hub site connection) are skipped with a warning in the log that names the affected settings. Apply those manually or use the standard (CSOM) creation path with Sites.FullControl.All.
Last Updated: 8/24/2026, 3:33:05 PM

← Site Configuration →