1

Our tenant received a new feature which allows for access requests to be directed to the $Context.Web.AssociatedOwnerGroup property. This is a nice feature because you can now have it automatically notify the owners instead of a distribution list or comma separated list of email addresses. Below is a screenshot from Microsoft's page on the feature.

Access Request Settings

Previously to return the list of emails/individual for receiving the emails you could run this sequence to retrieve the property.

$Context.Web.Retrieve('RequestAccessEmail')
$Context.ExecuteQuery()
$Context.Web.RequestAccessEmail
useremail@contoso.com

I have found that you can see the accessrequestsitedescription property by pulling all properties for the site.

$Context.Load($Context.Web.AllProperties)
$Context.ExecuteQuery()
$Context.Web.AllProperties.FieldValues.accessrequestsitedescription
Test Message

What I am trying to determine is how to identify if the Access Request configuration is pointing to the $Context.Web.AssociatedOwnerGroup, or just not configured at all. I have also confirmed that Get-PnPRequestAccessEmails does not return this information as of now.

1

Found a workaround until an interface is published or the CSOM is updated. All it needs is an authenticated CSOM Context object or an authenticated WebRequestSession against the tenant.

I am using this to make sure someone is going to receive access requests if they are enabled, and that the employee is still with the organization through other checks with our Active Directory.

# Build an SPOSession using the $Context object to pull an authentication cookie for that user.
$SPOSession = New-Object Microsoft.PowerShell.Commands.WebRequestSession
$SPOSession.Cookies.SetCookies($Context.Url, $Context.Credentials.GetAuthenticationCookie($Context.Url, $true))
$SPOSession.Headers.Add("Accept", "application/json;odata=verbose")

# Pull the data down using the SPOSession cookie
$URL = $Context.Url + '/_layouts/15/setrqacc.aspx?type=web'
$Data = Invoke-WebRequest -WebSession $SPOSession -Method GET -Uri $URL

# Parse the HTML for member sharing settings.
$MembersCanShare = ($Data.ParsedHtml.getElementById('ctl00_PlaceHolderMain_ctl00_chkMembersCanShare')).getAttribute('checked')
$MembersCanInvite = ($Data.ParsedHtml.getElementById('ctl00_PlaceHolderMain_ctl00_chkMembersCanAddToGroup')).getAttribute('checked') 

# Parse the HTML for Access Requests
$AccessRequestsAllowed = ($Data.ParsedHtml.getElementById('ctl00_PlaceHolderMain_ctl00_chkRequestAccess')).getAttribute('checked') 
$AccessRecipientGroup = ($Data.ParsedHtml.getElementById('ctl00_PlaceHolderMain_ctl00_ctl04_defaultValue')).getAttribute('checked') 
$AccessRecipientUsers = ($Data.ParsedHtml.getElementById('ctl00_PlaceHolderMain_ctl00_ctl04_otherValue')).getAttribute('checked') 
$RequestMessage = ($Data.ParsedHtml.getElementById('ctl00_PlaceHolderMain_ctl00_ctl04_txtAccreqCustomMsg')).InnerText
If($AccessRequestsAllowed -AND $AccessRecipientGroup)
{
    $AccessRecipientType = 'Group'
    $AccessRecipientName = ($Data.ParsedHtml.getElementById('ctl00_PlaceHolderMain_ctl00_ctl04_labelDefaultSection')).InnerText
}
ElseIf($AccessRequestsAllowed -AND $AccessRecipientUsers)
{
    $AccessRecipientType = 'Email'
    $AccessRecipientName = ($Data.ParsedHtml.getElementById('ctl00_PlaceHolderMain_ctl00_ctl04_txtEmail1')).Value
}
Else
{
    $AccessRecipientType = 'Disabled'
    $AccessRecipientName = 'None'
}
# Build a PSObject to pass
$AccessRequestObj = New-Object PSObject -Property `
    @{ 'MembersCanShare'         = $MembersCanShare;
       'MembersCanInvite'        = $MembersCanInvite;
       'AccessRequests'          = $AccessRequestsAllowed;
       'AccessRecipientType'     = $AccessRecipientType;
       'AccessRecipient'         = $AccessRecipientName;
       'AccessDeniedMessage'     = $RequestMessage;
     }
# Return or manipulate further

Sample output:

$AccessRequestObj | Format-List
AccessDeniedMessage : This is a sample custom message to users who receive access denied.
MembersCanShare     : True
AccessRecipient     : AccessRecipient@contoso.com
AccessRequests      : True
AccessRecipientType : Email
MembersCanInvite    : False
  • Hello i tried this script but its not working for me. the GetElementbyID is always null and GetAttribute cause an error. Can you check if its working for you? Or something what i need to do? – Zdeněk Vinduška Oct 31 '18 at 10:04
  • I found that if you have the default members group removed it will error out due to a null entry, specifically when it creates the $MembersCanInvite variable. Do you have a default members group? See the screenshot here that I tested it on to see that error. i.imgur.com/23su5YJ.png – Taylor Oct 31 '18 at 16:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.