SharePoint practice questions

Question 1

On the Site creation page in the SharePoint admin center, an administrator clears the 'Users can create SharePoint sites' checkbox. A user later reports they were still able to get a brand-new SharePoint team site created. How is this possible?

Accepted Answer

Creating a Microsoft 365 group or a Team still provisions a connected team site; that checkbox doesn't govern group creation. The 'Users can create sites' toggle controls self-service creation from SharePoint, OneDrive, PnP PowerShell, and the REST API. It does not stop users from creating Microsoft 365 groups or Teams elsewhere in Microsoft 365, and each group always comes with a connected team site.

Question 2

A user creates a private channel in a Teams team. Afterward, a new SharePoint site you didn't provision appears in Active sites, and its permissions show as read-only in the SharePoint admin center. What is happening?

Accepted Answer

Private (and shared) channels each provision a separate SharePoint site; its membership is managed in Teams, so SharePoint shows it read-only. Both private and shared channels create their own separate SharePoint site (a channel site) distinct from the parent team's site. Channel-site permissions must be managed in Teams - channel owners/members become site owners/members - so SharePoint displays them in read-only mode. Channel sites are also blocked from joining hubs.

Question 3

Contoso's tenant was created in 2017, so the root site at https://contoso.sharepoint.com is a classic team site. The administrator wants a modern intranet landing page at the root URL using the Replace site (site swap) operation in the SharePoint admin center. Which candidate satisfies the documented requirements for the incoming site?

Accepted Answer

A communication site (SITEPAGEPUBLISHING#0) on which the publishing feature has never been activated and which is neither a hub site nor associated with any hub. Microsoft Learn lists the site swap limitations: the new root site must be a communication site (SITEPAGEPUBLISHING#0) or a modern team site that is not connected to a Microsoft 365 group (STS#3), and one where the publishing feature has never been activated. Additionally, when replacing the root site, neither the current site nor the new site can be hub sites or associated with a hub; hubs must be unregistered (or sites disassociated) first, then re-registered after the swap. The root site itself cannot be deleted and cannot be connected to a Microsoft 365 group, which is why swap is the supported replacement path.

Question 4

In the SharePoint admin center an administrator lowers the default OneDrive storage limit from 1024 GB to 200 GB. Several users are currently storing between 300 GB and 500 GB in their OneDrive. What happens to those over-limit users' OneDrive?

Accepted Answer

Their OneDrive becomes read-only until their stored data drops below the new 200 GB limit. Decrease the storage limit below what a user already stores, and that user's OneDrive flips to read-only: they can still view and download, but they can't add or modify content. It stays that way until usage falls back under the new limit.

Question 5

You want every newly created Microsoft 365 group-connected team site to default to the Eastern time zone and a specific default storage limit. In the SharePoint admin center, where do you configure these defaults for new sites?

Accepted Answer

Settings, then Site creation. The Site creation page (under Settings) is where you choose the managed path (/sites or /teams) for new group-connected team sites and set the default time zone and default storage limit applied to newly created sites. Per-site overrides happen later on an individual site's General tab.

Question 6

A site template references site scripts that together contain 120 actions. When an administrator applies it with Invoke-SPOSiteDesign, the run fails, but applying the same template through the site's UI succeeds. What explains the difference?

Accepted Answer

Invoke-SPOSiteDesign applies scripts synchronously and is capped at 30 actions; the UI (and Add-SPOSiteDesignTask) apply asynchronously with a 300-action / 100,000-character limit. Applying a site design synchronously via Invoke-SPOSiteDesign is capped at 30 actions/subactions. Applying it asynchronously - through the UI or Add-SPOSiteDesignTask - raises the limit to 300 actions (or 100,000 characters), so a 120-action design succeeds there.

Question 7

A Multi-Geo tenant's primary geography is North America (NAM), with Europe (EUR) configured as a satellite location. A user whose Preferred Data Location (PDL) is EUR creates a new Microsoft 365 group from Outlook, which provisions a group-connected SharePoint site. Where are the group's SharePoint site and mailbox created?

Accepted Answer

In EUR, because the group's PDL is automatically set to the creating user's PDL, and the group site and mailbox are provisioned in that geo location. Microsoft Learn states: 'When users in a multi-geo environment create a Microsoft 365 group, the group preferred data location (PDL) is automatically set to that of the user,' and both the group mailbox and the SharePoint site associated with the group are provisioned in that PDL. Administrators (Global, SharePoint, and Exchange admins) can additionally create groups in any geography they select, either from the geo-specific SharePoint admin center or with New-UnifiedGroup -MailboxRegion. Note that group site provisioning is on-demand: the site is created the first time an owner or member accesses it. If a user's PDL is not set or points to a non-configured location, resources land in the primary provisioned geography instead.

Question 8

A SharePoint Administrator needs to organize 50 department sites so that each department site inherits navigation and theme from a central departmental landing page. The sites must remain independent site collections with no shared permissions. Which SharePoint feature should the administrator configure?

Accepted Answer

Hub site registration and site association Hub sites connect and organize independent site collections so that associated sites inherit the hub navigation and theme. Hub association does not affect the permissions of either the hub site or the associated sites, which satisfies the requirement for independent permission management. Up to 2,000 hub sites can be registered per tenant.

Question 9

The internal communications team needs a new SharePoint site where a handful of authors will publish company news, policies, and announcement pages for thousands of employees to read. The team explicitly does not want a shared mailbox, Planner plan, or Teams team provisioned alongside the site. Which site type should the administrator create?

Accepted Answer

A communication site A communication site is designed for exactly this pattern: a small number of content authors creating and maintaining content for a much wider audience that consumes it. Per Microsoft Learn, a communication site does not have a backing Microsoft 365 group, so no group mailbox, Planner, or Teams resources are provisioned with it. Access is managed through SharePoint groups and permission levels, which lets the owners keep authoring rights narrow while granting broad read access.

Question 10

An organization is standardizing new-site provisioning by building custom site scripts and site templates (site designs). What is the per-tenant maximum number of each that SharePoint allows?

Accepted Answer

100 site scripts and 100 site templates per tenant. SharePoint caps a tenant at 100 site scripts and 100 site templates (site designs). The 30 and 300 numbers are per-application action limits, not the count of stored objects.

Question 11

A multi-geo tenant has its Primary Provisioned Geography in North America (NAM) and satellite locations in EUR and AUS. A user whose Preferred Data Location (PDL) has never been set creates a Microsoft 365 group-connected team site. Where is the site (and its group mailbox) provisioned?

Accepted Answer

In the Primary Provisioned (central) geography - NAM. In multi-geo, the creating user's PDL determines the geography for a group-connected site. If the PDL isn't set (or is set to a geo that isn't configured as a satellite), the site and its group mailbox are created in the Primary Provisioned Geography (the central location).

Question 12

Your HR department needs a site to broadcast policy updates to all 20,000 employees. A handful of HR editors will author content; everyone else should only read it. You want the simplest permissions model, with no group mailbox or shared calendar attached. Which site type fits best, and how are its permissions managed?

Accepted Answer

A communication site, managed through the site's Owners, Members, and Visitors SharePoint groups. Communication sites are built for broadcasting news and content to a broad audience with a few authors and many readers. They are not connected to a Microsoft 365 group (no mailbox or calendar) and use the standard SharePoint Owners, Members, and Visitors groups for permissions.

Question 13

A tenant has been manually assigning per-site storage limits (for example 50 GB and 100 GB on various sites). An administrator opens Settings, then Site storage limits, and switches the option from Manual to Automatic. What happens to the previously configured per-site limits?

Accepted Answer

Each site's limit is reset to 25 TB (25600 GB), and sites then draw from the shared pool as needed. When you switch from manual limits to pooled (Automatic) storage, SharePoint resets all site limits to 25 TB (25600 GB); sites then consume from the central pool as needed. The tenant's actual total storage may be less than 25 TB.

Question 14

To reduce site sprawl, an admin clears 'Users can create SharePoint sites' on the Site creation page. Weeks later, new team sites keep appearing whenever employees create teams in Microsoft Teams. Why, and what actually controls this?

Accepted Answer

Creating a Microsoft 365 group (for example, via a new team) always provisions a connected team site; to stop this you must restrict who can create Microsoft 365 Groups. The 'Users can create SharePoint sites' setting governs site creation from SharePoint, OneDrive, PnP PowerShell, and REST, but it does not stop Microsoft 365 group creation. Every Microsoft 365 group (including one a new team creates) comes with a connected team site. To block those, you must manage who can create Microsoft 365 Groups (in Microsoft Entra).

Question 15

You are planning a hub-site information architecture for your organization. Which statement about hub site limits in SharePoint Online is correct?

Accepted Answer

You can create up to 2,000 hub sites per organization; any site designated as a hub counts toward that limit (including hub-to-hub associations), and a site already associated with another hub cannot be converted into a hub. SharePoint Online allows up to 2,000 hub sites per organization. Any site labeled as a hub counts against this limit, and this applies to hub-to-hub associations as well. There is no hard limit on the number of sites you can associate to a single hub, and a site already associated with another hub can't itself be turned into a hub.

Question 16

Users can already find documents by typing an author's name in the search box, but the administrator now wants them to be able to narrow results to a specific field by typing author:Smith. Which managed property setting must be enabled for that field so it can be addressed by name in a query?

Accepted Answer

Queryable Queryable is the setting that lets a managed property be addressed by name in a query, so author:Smith only works once the property is marked Queryable. Searchable is the trap here: it adds the property's content to the full-text index, which is why a bare keyword like 'Smith' already finds the documents, but it does not enable property:value syntax.

Question 17

The facilities team wants to catalog physical assets in SharePoint Online. Each catalog entry is primarily structured metadata (asset tag, location, assigned owner, purchase date), and an entry occasionally needs two or three photos or receipts attached to that same record. There is no single authored 'document' at the center of each entry. Which container best fits these requirements?

Accepted Answer

A custom SharePoint list, using item attachments for the photos and receipts A document library is file-centric: every item is built around exactly one primary file. A list is record-centric: each item is a row of column metadata and can carry multiple file attachments (up to 250 MB per attached file). For asset records that are mostly metadata with a few supporting files, a custom list with attachments is the correct fit.

Question 18

Site owners report that the Information Rights Management link is missing from their document library's Library Settings. You have already activated the Azure Rights Management service for the tenant. Where do you turn on the IRM service so the library-level option appears?

Accepted Answer

In the SharePoint admin center, open the classic settings page, select "Use the IRM service specified in your configuration," then choose Refresh IRM Settings. IRM is enabled at the tenant level from the SharePoint admin center's classic settings page by choosing "Use the IRM service specified in your configuration" and then Refresh IRM Settings. Only after that refresh does the Information Rights Management link appear in Library Settings and List Settings (it can take up to an hour). Azure Rights Management must be activated first, which the scenario states is already done.

Question 19

A 'Project Charter' content type was published from the SharePoint admin center content type gallery and is in use across 40 site collections. To retire central management of it, an administrator selects Unpublish in the Manage Publishing panel. What happens to the copies already in use on the 40 subscriber sites?

Accepted Answer

They remain but are converted to local content types on each site, no longer receiving updates from the hub. Per Microsoft Learn, when you unpublish a content type, any copies of that content type being used in other sites are converted to a local content type. They are not deleted; in no situation is a content type automatically removed from a subscribing site collection. They are, however, severed from the hub and will no longer receive republish (central) updates. Restoring central management requires republishing and re-establishing the subscription, so unpublishing is not a clean rollback.

Question 20

A team wants a single tagging field on a library that lets users apply several free-form tags per document, drawing type-ahead suggestions from managed term sets as well as previously used tags, without binding to one specific term set. The administrator also plans to index this field to support filtered views on a library expected to exceed 5,000 items. Which statement is correct?

Accepted Answer

Add the Enterprise Keywords column; it is always multi-value, draws suggestions from managed term sets and the Keywords set, and cannot be indexed. The Enterprise Keywords column is, by default, a multi-value column that surfaces type-ahead suggestions from managed term sets and the Keywords term set and lets users enter new values, which is exactly the free-form, multi-tag behavior described. Because it is inherently multi-value, it cannot be added as an indexed column, so it will not support filtered views once the library passes the 5,000-item list view threshold. The scenario's two goals are in tension: whole-store free-form tagging and indexing cannot both be satisfied by this one column.

Question 21

An administrator is wiring a custom Text site column named 'Contract Owner' to an unused RefinableString slot so it can be used as a refiner. Searching the crawled properties returns two entries for the column: ows_q_TEXT_ContractOwner and ows_Contract_Owner. Which crawled property should be mapped to the RefinableString managed property, and why?

Accepted Answer

ows_Contract_Owner, because when mapping to a refinable managed property you select the ows_ prefixed variant, not the automatically created ows_q_ / ows_r_ / ows_taxId_ one. A crawled site column typically surfaces two crawled properties: the automatically created ows_q_<TYPE>_ (or ows_r_, ows_taxId_) variant that already feeds the auto-generated managed property, and an ows_ prefixed variant. Microsoft Learn is explicit that when mapping a crawled property to a refinable managed property you should select the crawled property that begins with ows_. After mapping (and setting an alias) you reindex the library so the change is picked up.

Question 22

A site owner creates a brand-new document library on a modern team site in SharePoint Online and uploads a document without ever opening Versioning settings. Which statement correctly describes the library's version history behavior out of the box?

Accepted Answer

Major versioning is enabled by default, and the shipped organization default retains up to 500 major versions. In SharePoint Online, document versioning is active by default on new libraries, and the shipped organization-level default version history limit is Manual with a 500 major-version count and no expiration. A brand-new library therefore keeps up to 500 major versions unless the organization default or the library is changed. Minor/draft versioning is a separate opt-in and is not on by default.

Question 23

A policy library uses major and minor (draft) versioning with content approval. Authors report that colleagues with read-only access can see unapproved 0.x drafts. The admin wants only the item's author and users who can approve items to be able to see drafts, while readers see only the latest approved major version. Which setting should the admin change?

Accepted Answer

Versioning settings, then Draft Item Security, then 'Only users who can approve items (and the author of the item)' Draft Item Security controls who can see minor (draft) versions. Setting it to 'Only users who can approve items (and the author of the item)' restricts draft visibility to approvers plus the author, while readers still see the last approved major version - meeting the requirement without altering permissions or the versioning scheme.

Question 24

In the SharePoint admin center, under Content services, then Content type gallery, an administrator selects a published site content type named 'Contract' and chooses Unpublish. Several sites across the tenant are already using 'Contract' on their libraries. What happens to those existing content types when the change syncs?

Accepted Answer

Existing copies in use are converted to local (site-level) content types and stop receiving updates from the gallery Unpublishing makes a content type unavailable for download to other sites, and any copies already in use are converted to local content types. They remain in place with their data, but no longer receive published updates from the gallery. Publish/Republish pushes updates; Unpublish severs the update link without deleting content.

Question 25

An admin applies column formatting JSON to a Person column so it displays the assignee's name, using "txtContent": "@currentField". Instead of a name, the column renders blank or shows an object. Which JSON correctly displays the person's name?

Accepted Answer

"txtContent": "@currentField.title" Person fields are represented as objects, and the display name is held in the object's title property. The formatter must therefore reference @currentField.title. (Lookup fields, by contrast, expose their display text in the lookupValue property.)

Question 26

A subscriber site collection receives several custom document content types published from the content type hub. An admin sets one of those published content types as the default on a library, then enables the Document ID Service site collection feature. Afterward, documents in that library still aren't getting Document IDs and the Document ID column doesn't appear. What is the correct fix?

Accepted Answer

Enable the Document ID Service feature on the content type hub site collection, then republish the content types. Content types published from the hub are set to read-only on subscriber sites, so the Document ID Service cannot provision its required columns onto them. The documented fix is to enable the Document ID Service on the content type hub site collection itself, then republish the syndicated content types so subscribers receive the updated, Document ID-enabled content types.

Question 27

A site owner wants the ENTIRE row in a list view to be shaded red whenever the 'Status' choice column equals 'Overdue', so overdue records are visually flagged for reviewers. The underlying data must not change. Which approach accomplishes this?

Accepted Answer

Apply view formatting to the view (for example, additionalRowClass) using a conditional expression on the Status field Column formatting styles a single field (only that one cell), whereas view formatting (via additionalRowClass or rowFormatter) styles the whole row based on field values. To conditionally shade an entire row, use view formatting; like column formatting, it only changes how the row is displayed, not the underlying data.

Question 28

From the Content type gallery in the SharePoint admin center, an admin has published a custom "Contract" content type. They now want that content type to be automatically added to every new list and library created on a set of hub-associated sites, without site owners adding it manually. What must be true for this "push content types to a hub" capability to work?

Accepted Answer

The content type must already be published, and the feature requires a pay-as-you-go (Microsoft Syntex) license. Pushing content types to hub sites (so they are automatically added to new lists/libraries and to newly associated sites) is a paid capability that requires a pay-as-you-go (Microsoft Syntex) license, and the content type being pushed must already be published from the Content type gallery first.

Question 29

A records manager wants to add a 'Case File' Document Set content type to a document library so that related case documents can be created and managed as one unit with shared metadata. On a brand-new site, 'Document Set' does not appear as a content type they can add. What must be done first?

Accepted Answer

Activate the Document Sets site collection feature Document Sets are delivered by a site collection feature that must be activated (Site settings, then Site collection features, then Document Sets, then Activate) before Document Set content types become available. Only after the feature is on can you create or add a Document Set content type to a library.

Question 30

As a site collection administrator you want to see the searches users ran on your site collection that returned no results (a 'No result queries' report), so you can improve findability. In current SharePoint Online, where do you access this report and what time ranges does it cover?

Accepted Answer

Site Settings, then Site Collection Administration, then Microsoft Search, then Configure search settings, then Insights; reports cover the past 31 days and past 12 months The updated site-collection search usage reports are reached from Site Settings under Site Collection Administration via Microsoft Search, then Configure search settings, then Insights. They include five reports (top queries, abandoned queries, query rule usage, no result queries, and query volume trends), are available for the past 31 days and past 12 months (the prior window was 14 days), and only site collection admins can view them.

Question 31

The tenant's organization-wide external sharing (SharingCapability) is set to 'New and existing guests' (ExternalUserSharingOnly). A site owner asks the admin to enable 'Anyone' links on just their one site by running Set-SPOSite -SharingCapability ExternalUserAndGuestSharing. What is the outcome?

Accepted Answer

The change is rejected/ineffective because a site's sharing can't be more permissive than the tenant setting A site's external sharing can be equal to or MORE restrictive than the tenant, but never more permissive. With the tenant at ExternalUserSharingOnly, a site may be Disabled, ExistingExternalUserSharingOnly, or ExternalUserSharingOnly, but not ExternalUserAndGuestSharing. Anyone links must be enabled at the tenant first.

Question 32

Access requests are enabled on a classic team site. A user who holds 'Edit' permission on the site, but is not a site owner or a site collection administrator, opens the Access Requests list to approve a pending request and receives 'Access Denied / Request approval failed.' Who is able to approve or decline pending access requests on the site?

Accepted Answer

Only site collection administrators or members of the site's Owners group (and the Owners group must have Full Control to access the Access Requests list) Only site collection administrators or users who are members of the Owners group for the site can approve or decline pending requests in the Access Requests list. When approvers are members of the Owners group, that group must also retain Full Control permissions so it can access the Access Requests list. A user with only Edit permission does not qualify, which is why they receive Access Denied.

Question 33

A user needs to send a contract to two named external partners so that only those two recipients can open it. If either recipient forwards the message, the forwarded link must NOT grant access to anyone else. Which sharing link type meets this requirement?

Accepted Answer

Specific people Specific people links work only for the individuals the sender specifies when the link is created. They are non-transferable: if a recipient forwards the link, anyone not on the named list is denied. It is the only link type that guarantees access is limited to the named recipients, and it works for external users (guests) as well as internal users.

Question 34

A SharePoint Administrator runs against a site collection: Set-SPOSite -Identity <url> -DefaultLinkToExistingAccess $true. The same site already had -DefaultSharingLinkType Internal and -DefaultLinkPermission Edit configured. What default sharing link will users see when they click Share?

Accepted Answer

"People with existing access," because setting DefaultLinkToExistingAccess to $true overrides the DefaultSharingLinkType and DefaultLinkPermission values. Setting DefaultLinkToExistingAccess to True makes "People with existing access" the default link, and Microsoft documents that this value overrides the DefaultSharingLinkType and DefaultLinkPermission settings. Existing-access links grant no new permissions.

Question 35

Your organization-level external sharing is set to Anyone. For one project site, external sharing is set to "New and existing guests" (recipients must sign in or use a verification code). As SharePoint Administrator you set that site's default sharing link type to "Anyone with the link." A user on that site clicks Share on a document. Which link type will be selected by default in the Share dialog?

Accepted Answer

Only people in your organization Microsoft Learn states that if the default is set to "Anyone with the link" but the site (or OneDrive) is configured to allow sharing only with guests who sign in or provide a verification code, the effective default link shown is "Only people in your organization." Because this site requires authenticated guests ("New and existing guests"), Anyone links aren't valid, so SharePoint falls back to the org default. The user must manually choose "Specific people" to share externally.

Question 36

External sharing is set to New and existing guests. A guest who was granted Edit permission on a document library reports she cannot reshare a file in that library with a colleague at her own company, while internal users with Edit can reshare. Which organization-level setting, when enabled, lets guests share items they do not own without giving them Full Control?

Accepted Answer

Allow guests to share items they don't own By default, guests must have Full Control permission to share items externally. The More external sharing settings option Allow guests to share items they don't own removes that requirement, so a guest with only Edit can reshare content she does not own.

Question 37

On a classic team site, access requests are enabled and routed to the site Owners group. Site owners report that when they open the Access Requests list and click Approve, they receive "Access Denied" / "Request approval failed." A recent permissions cleanup on the site preceded the problem. What is the most likely root cause and fix?

Accepted Answer

During cleanup the Owners group lost its permission to the hidden Access Requests list; re-grant the Owners group access (Full Control) to that list so members can approve. Only site collection administrators or members of the site's Owners group can approve or decline pending requests, and when owners approve, the Owners group must have Full Control permission to the Access Requests list. If a permissions change removed the Owners group from that list, owners get "Access Denied"/"Request approval failed." Re-granting the Owners group access to the Access Requests list resolves it.

Question 38

A SharePoint administrator must configure the tenant so that users can share content only with guests who are ALREADY present in the organization's directory (for example, guests added earlier through Azure B2B or previous invitations). No NEW external people may redeem invitations. Which value of Set-SPOTenant -SharingCapability meets this requirement?

Accepted Answer

ExistingExternalUserSharingOnly ExistingExternalUserSharingOnly permits sharing only with guests already in the organization's directory; it blocks inviting any new external users, which exactly matches the 'existing guests only' requirement.

Question 39

External sharing is enabled for a tenant. A guest is added to a site with Edit permissions on a document library. Using the default tenant sharing settings, can that guest reshare a file they don't own with another external person?

Accepted Answer

No - by default "Allow guests to share items they don't own" is off, so a guest must have Full Control on an item to share it externally Learn states that, by default, guests must have Full Control permission to share items externally; the "Allow guests to share items they don't own" setting is off by default. A guest with only Edit can't reshare items they don't own unless an admin enables that setting or grants Full Control.

Question 40

A OneDrive owner wants to be emailed only when OTHER users invite additional external users to files that were already shared from the owner's OneDrive, not for routine file activity and not when an anonymous link is made. Which Set-SPOTenant parameter maps to exactly this "Email OneDrive owners when" notification?

Accepted Answer

Set-SPOTenant -NotifyOwnersWhenItemsReshared The "Email OneDrive owners when other users invite more external users to shared files" notification maps to Set-SPOTenant -NotifyOwnersWhenItemsReshared. The trap is the near-identical parameter names: Reshared is the one that fires when an existing share is widened to additional external users, not on general file activity and not on anonymous links.

Question 41

A site owner on a communication site holding several critical document libraries wants members to add, edit, and delete documents inside existing libraries, but NOT create new libraries, remove columns, or delete entire lists. The Members group is currently assigned the Edit permission level. Which permission level should the owner assign to the Members group, and what specific capability is the reason?

Accepted Answer

Assign Contribute; Edit includes Manage Lists (create/delete lists and columns), which Contribute lacks Edit includes the Manage Lists permission, which allows creating and deleting lists/libraries, adding or removing columns, and managing public views. Contribute grants add, edit, and delete of items and documents within existing lists and libraries but does NOT include Manage Lists. Assigning Contribute lets members work with content without restructuring or deleting libraries, exactly matching the requirement.

Question 42

A team site's Members group has Edit across the whole site. HR needs one document library on that site locked down so only three named HR staff can open it, while every other library and page on the site stays exactly as it is. What is the correct library-level approach?

Accepted Answer

On the library, stop inheriting permissions, remove the Members group, and grant the three HR users directly A list or library inherits permissions from its parent site by default. To secure just that one library, break inheritance on the library to create a unique permission scope, remove the inherited Members group, and grant the three HR users directly. Because only the library's scope changes, the rest of the site keeps its inherited permissions.

Question 43

A governance standard states that on a given team site, members and users with Edit permissions may share files and folders, but only site owners may share the site itself. Which "how members can share" option matches this, and what is its equivalent MembersCanShare PowerShell value?

Accepted Answer

"Site owners and members, and people with Edit permissions can share files and folders, but only site owners can share the site." (MemberShareFileAndFolder) The "how members can share" control has three values. MemberShareFileAndFolder maps to "Site owners and members, and people with Edit permissions can share files and folders, but only site owners can share the site": exactly the requirement that members/Edit users share content but only owners share the site.

Question 44

A site owner of a group-connected team site wants to change the site's external sharing setting from 'New and existing guests' to 'Anyone.' They cannot find any option to make this change in the site settings. Assuming the organization-level setting permits Anyone, why can't the site owner change it?

Accepted Answer

Changing a site's external sharing setting requires at least the SharePoint Administrator role; site owners are not allowed to change it Microsoft documents that you must be at least a SharePoint Administrator to change the sharing settings for a site, and that site owners aren't allowed to change these settings. Per-site external sharing is configured in the SharePoint admin center (Active sites, then select the site, then Sharing), a surface site owners don't have. Site owners can control member sharing options and access request settings, but not the site's external sharing tier.

Question 45

An organization's SharePoint tenant-level sharing is set to 'Anyone'. The security team notices that anonymous sharing links from multiple sites are being forwarded externally with no expiration. The administrator wants to enforce that all 'Anyone' links tenant-wide expire within 30 days and can only grant View permission to files. Where is this configuration made?

Accepted Answer

SharePoint admin center, then Policies, then Sharing, then Advanced settings for 'Anyone' links The expiration and permissions settings for 'Anyone' links are configured in the SharePoint admin center under Policies, then Sharing, in the 'Advanced settings for Anyone links' section. Admins can require link expiration (setting a maximum number of days) and restrict link permissions to View only for files and/or folders. These settings apply at the organization level to all sites.

Question 46

External sharing is enabled for a collaboration site. The security team is concerned that when users upload new files, a guest could access a sensitive file during the delay between upload and when Microsoft Purview DLP finishes scanning it. Which SharePoint control blocks guest access to newly uploaded files until DLP has scanned them?

Accepted Answer

Set-SPOTenant -MarkNewFilesSensitiveByDefault BlockExternalSharing The 'sensitive by default' tenant setting, configured with Set-SPOTenant -MarkNewFilesSensitiveByDefault BlockExternalSharing, blocks guest access to newly added SharePoint and OneDrive files until DLP has crawled them and evaluated content-based rules. Guests who try to open a file during the scan window are told it is being scanned; once scanning completes with no blocking match, access is allowed. Two caveats: it applies only to newly added files (not existing files or existing shares), and it blocks guest access to files in any location not covered by a DLP policy. The setting can take up to 60 minutes to take effect.

Question 47

The tenant unmanaged-device policy is set to AllowLimitedAccess (web-only). For a highly sensitive site, an admin wants users on unmanaged devices to preview ONLY Office files in the browser, with no preview or download of any other file type (PDF, images, .zip). Which Set-SPOSite parameter/value achieves the most restrictive preview?

Accepted Answer

-LimitedAccessFileType OfficeOnlineFilesOnly OfficeOnlineFilesOnly restricts in-browser preview to Office files only, the most secure LimitedAccessFileType option, blocking preview/download of non-Office types.

Question 48

An administrator applies a sensitivity label to a SharePoint team site. The label is configured with the 'Private' privacy setting and the 'Only people in your organization' external sharing option. A site owner later tries to change the site privacy from Private to Public in SharePoint settings. What happens?

Accepted Answer

The privacy setting is locked by the sensitivity label; the site owner must remove or change the label before altering privacy Microsoft Learn states that when a sensitivity label sets privacy to Public or Private on a container (site or group), that setting is locked. Users cannot change the privacy setting while the label is applied. To change privacy, the site owner (or administrator) must first remove or change the sensitivity label from the site.

Question 49

A user's Microsoft 365 account is deleted. By default, how long are that user's OneDrive files preserved, and who automatically receives access to them?

Accepted Answer

Files are preserved for 30 days and the user's manager automatically receives access Microsoft Learn states that when a user's Microsoft 365 account is deleted, their OneDrive files are preserved for 30 days. By default, the deleted user's manager is automatically given access to the user's OneDrive. Both the retention period and the manager access behavior can be changed by the administrator.

Question 50

For one project site containing sensitive files, an admin wants users to keep browser-only access (view/preview) but be unable to download, print, sync, or open files in desktop apps, without creating any Conditional Access policy. Which command applies this?

Accepted Answer

Set-SPOSite -Identity <SiteURL> -BlockDownloadPolicy $true BlockDownloadPolicy is a per-site (Set-SPOSite) control, part of SharePoint Advanced Management, that grants browser-only access (no download/print/sync/app access) and also blocks moving files to other sites, without any Conditional Access policy.

Question 51

A site was closed and set to read-only by a SharePoint site closure policy. To reopen it for editing, an admin runs Set-SPOSite -Identity <url> -LockState Unlock, but the site remains read-only. What is the reason?

Accepted Answer

When a site was closed and made read-only through a site closure policy, the Set-SPOSite unlock command doesn't work; the closure must be reversed through the policy (reopen the site). Microsoft documents that if a site was closed and made read-only through a site closure policy, the PowerShell Set-SPOSite -LockState Unlock command will not lift the read-only state. The read-only condition is owned by the site closure policy, so it must be cleared by reopening the site through that policy rather than by the lock-state cmdlet.

Question 52

In the SharePoint admin center, Data access governance (DAG) reports are grouped into two families: snapshot reports and activity reports. Which of the following is an activity report that surfaces only the last 28 days of sharing behavior rather than a point-in-time snapshot?

Accepted Answer

Content shared with 'Everyone except external users' (EEEU) report. DAG reports split into snapshot reports (site permissions / oversharing baseline, site permissions for users, and sensitivity labels for files) that show status as of the generation date, and activity reports (sharing links, and content shared with EEEU) that cover recent activity in the last 28 days. The EEEU report is an activity report; the other three are snapshots.

Question 53

In the SharePoint admin center under Policies, then Site lifecycle management, which set of policy types is available to govern sites at scale?

Accepted Answer

Site ownership policies, inactive site policies, and site attestation policies. SharePoint site lifecycle management (part of SharePoint Advanced Management) provides three policy types: site ownership policies (minimum owners/admins), inactive site policies (detect and act on idle sites), and site attestation policies (owners periodically confirm a site is still needed).

Question 54

A SharePoint administrator turns on an inactive site policy in the Site lifecycle management area of the SharePoint admin center, expecting it to automatically delete any site that no one has used in over a year. A colleague pushes back. Which statement accurately describes how site lifecycle management policies (site ownership, inactive site, and site attestation) behave?

Accepted Answer

The policies never delete sites directly; they notify site owners or admins and, if unaddressed, can take configured enforcement actions such as read-only or archive. Site lifecycle management policies (site ownership, inactive site, and site attestation) do not delete SharePoint sites directly. They monitor sites, notify the responsible site owners or site admins, collect responses (for example, a 'Certify site' confirmation), and take a configured enforcement action only when there is no response after the notification cycle. Once a site is certified, lifecycle management doesn't check that site's activity again for one year. The available enforcement actions are 'Do nothing' (report only), set the site to read-only, or archive the site after a mandatory read-only period via Microsoft 365 Archive.

Question 55

A compliance engineer applies a 'Confidential' sensitivity label scoped to Groups & sites to a SharePoint team site, expecting every document already stored in the site's libraries to automatically become encrypted and labeled 'Confidential.' What is the actual effect of applying this container-scoped label to the site?

Accepted Answer

The label controls container-level settings (privacy, external sharing, unmanaged-device / Conditional Access access) but does not label or encrypt the files inside the site. A sensitivity label scoped to Groups & sites is a container label. It applies classification and access-control settings to the container itself, privacy (public/private/none), external user access and external sharing level, and access from unmanaged devices or an authentication context, but it does not label, classify, or encrypt the documents stored inside the site. To label the files themselves, you must separately enable sensitivity labels for Office files in SharePoint and OneDrive and apply file-level labels (manually or via auto-labeling). Container labels and file labels are independent controls.

Question 56

Using SharePoint's built-in information management policy features (not Microsoft Purview), an organization wants to define a single retention/expiration and auditing policy once, then reuse the exact same policy across multiple site collections in a standardized, exportable way. Where should the policy be created?

Accepted Answer

In the Site Collection Policies gallery on the top-level site, then exported and imported into other site collections. The top-level site of a site collection contains a Site Collection Policies gallery where an admin authors a reusable information management policy (retention stages, auditing, expiration, and so on). That policy can be exported and imported into other site collections' galleries to standardize policy across the organization; associating it with a content type then enforces it and prevents list owners from modifying it.

Question 57

A file in a SharePoint library triggers a DLP rule configured with policy tips. Users see the tip in the SharePoint web experience and in Word for the web, but one user insists they never see a tip. On which client is a DLP policy tip NOT displayed for that file?

Accepted Answer

The SharePoint/OneDrive sync (Win32) desktop client in File Explorer. DLP policy tips aren't supported on the SharePoint/OneDrive Win32 (sync) desktop client. They are supported on the SharePoint/OneDrive web client, in Word/Excel/PowerPoint for the web, and in Office desktop apps when the document is stored on SharePoint or OneDrive. (Office mobile apps also don't show policy tips.)

Question 58

A SharePoint document has a retention label that marks it as a record, and record versioning is enabled. The record is currently Locked. A user sets the Record status to Unlocked to make an update. What happens at the moment of unlocking?

Accepted Answer

A Copy to action copies only the latest version of the document into the Records folder of the site's Preservation Hold library, and the document becomes editable but still cannot be deleted. When a locked record is unlocked, SharePoint performs a Copy to that stores ONLY the latest version (no prior versions) in the Records folder of the site's Preservation Hold library; that copy is flagged 'Record' in version history. The original then becomes editable but still can't be deleted, and 'Item is a Record' stays Yes. A retained record version is captured each time you unlock.

Question 59

A Data access governance report flags a SharePoint site as oversharing content with 'Everyone except external users.' For compliance reasons, the admin's role cannot view the file- and item-level detail needed to decide what to trim, so the admin wants the site owner to review and remediate the specific permissions. Which SharePoint Advanced Management capability fits this need?

Accepted Answer

Initiate a site access review from the Data access governance report. Site access reviews let IT delegate remediation of overshared sites (surfaced by Data access governance reports) to the site owners, who can see and fix the item-level permissions that the admin cannot view for compliance reasons. The owner receives a targeted email and works through the specific oversharing issue. Site access reviews support SharePoint sites (not OneDrive), and you can initiate them for up to 100 sites from the report UI (more via PowerShell). RAC is a valid immediate admin control but hard-gates the whole site to a group rather than delegating an owner-driven item-level review.

Question 60

You create an inactive site policy under Site lifecycle management in the SharePoint admin center. The owners of a flagged site ignore the notification emails. When does enforcement take effect, and what enforcement actions can you configure?

Accepted Answer

After three (monthly) notifications with no response; the configurable actions are Do nothing, put the site in read-only access, or archive the site (after a mandatory read-only period) via Microsoft 365 Archive. Inactive site (and other lifecycle) policies send notifications to owners/admins for three months, and if there's no response after those three notifications, the chosen enforcement action runs. The options are Do nothing, Read-only access, or Archive sites after a mandatory read-only period (3, 6, 9, or 12 months) using Microsoft 365 Archive. There is no built-in 'auto-delete' enforcement action.

Question 61

A developer who is not a SharePoint or tenant administrator, but is an Owner of the tenant app catalog site, needs to set a tenant property (storage entity) that can be read through the SharePoint REST API. Which approach lets them do this without elevated admin rights?

Accepted Answer

Connect with Connect-PnPOnline and run Set-PnPStorageEntity. PnP PowerShell's *-PnPStorageEntity cmdlets (after Connect-PnPOnline) can set tenant properties without tenant administrator privileges: any Owner of the app catalog site can do it. By contrast, the SharePoint Online Management Shell's *-SPOStorageEntity cmdlets require first connecting with Connect-SPOService, which requires the SharePoint Administrator role.

Question 62

Your tenant's Site storage limits are set to Automatic (pooled). You run Set-SPOSite -Identity <url> -StorageQuota 5000 to cap one site, but PowerShell returns a generic error. What is the correct explanation and remedy?

Accepted Answer

Per-site quotas can't be set while Site storage limits are Automatic; switch that setting to Manual, set the quota, then switch back if desired. Switching back to Automatic resets all site limits to 25,600 GB (25 TB). When the tenant uses Automatic (pooled) site storage management, you cannot set an individual site's quota; Set-SPOSite -StorageQuota returns a generic error. The documented workaround is to switch Site storage limits to Manual, set the quota, then switch back to Automatic if desired. Note that switching (back) to Automatic/pooled resets every site's limit to 25,600 GB (25 TB).

Question 63

You are preparing to run the SharePoint Migration Assessment Tool (SMAT) against a large SharePoint Server 2013 farm before migrating to Microsoft 365. The default assessment includes an Alerts scan that your organization has decided is irrelevant, and the full run is taking too long. You want to exclude only that one scan while keeping every other scan, and reduce overall execution time. What should you do?

Accepted Answer

Edit ScanDef.json in the SMAT directory and set the Alerts scan's "Enabled" property to false. ScanDef.json (installed in the same directory as SMAT) is the config file used to enable or disable individual scans. Locating the Alerts entry and setting its "Enabled" value to false removes that scan from the run, which reduces the tool's overall execution time. If ScanDef.json is missing or corrupt, SMAT falls back to a default configuration embedded in the executable.

Question 64

An SPFx web part requests the Microsoft Graph permission Group.Read.All through webApiPermissionRequests. The request appears as pending on the API access page in the SharePoint admin center. You must approve it using the least-privileged Microsoft Entra role possible. Which role must you use?

Accepted Answer

Global Administrator Approving permissions for Microsoft Graph (or any other Microsoft API) on the API access page requires the Global Administrator role. Application Administrator is sufficient only for third-party APIs registered in the tenant, and that is the trap: the least-privilege instinct steers you away from Global Admin, but for a Graph scope no lesser role can approve.

SharePoint practice questions, with full explanations

The SharePoint bookshelf

Work the 75 questions, one topic at a time

SharePoint Sites and Architecture (15 questions)