Restrict Which SharePoint Sites Users Can Add in New harmon.ie

As a harmon.ie administrator, you can control which SharePoint sites your users can add to New harmon.ie. The rules are configured centrally and apply to every user in your organization.

This article explains how site access rules work, how to apply them through the provisioning file, and how to define the sites in each list. It ends with common examples.

How site access rules work

You define the rules with two lists:

  • Allow list: the only sites users can add. Leave it empty to allow every site (the default).
  • Block list: the sites users cannot add. Leave it empty to block no sites (the default).

A user can add a site only if both conditions are met: the site is allowed and it is not blocked. A site that appears in both lists is therefore not available, because it fails the second condition. Sites the rules do not permit are not listed when a user adds a site.

Where the rules apply

The rules apply everywhere a user can add a SharePoint site:

  • The site suggestions shown during onboarding.
  • The “Add a site” list in Manage Sites.
  • The Followed sites group and the frequently-used sites harmon.ie suggests. Because these sites are added for users automatically, rather than chosen explicitly, restricted ones are filtered out.
Sites that a user has already added remain available even if you block them later, so you can tighten the rules without disrupting users mid-work. Once a user removes a blocked site, they cannot add it again.

Set the site access rules

The rules are configured in the New harmon.ie provisioning file, as a SiteAccessPolicy entry.

To edit and apply the rules:

  1. Download Provisioning.zip and extract it to a local folder.
  2. Edit the Provisioning.json file. Add or update the SiteAccessPolicy entry with your allow and block lists (see Define a site). Each list is an array of site entries, separated by commas.
    Example:

    "SiteAccessPolicy": {
  "allow": ["/sites/site1", "/teams/team1"],
  "block": ["/sites/site2"]
}
  3. Import the Provisioning.json file to New harmon.ie via the Admin tab in harmon.ie settings.
  • The file you import may contain only the SiteAccessPolicy section. Any other settings you have already provisioned are preserved, so you can manage each section independently.
  • Do not edit the Provisioning.json file directly in the “harmon.ie Files” library. Always edit it locally and then import it, as the import process validates the file and checks for errors.
  • We recommend editing the .json file using VS Code, which will warn you about syntax errors.

Define a site

Each entry in the allow or block list identifies a SharePoint site:

  • Use the site path. An entry is the path of a SharePoint site: the portion of the URL that follows your SharePoint domain. For https://contoso.sharepoint.com/sites/marketing, the path is /sites/marketing.
  • An entry includes sub-sites. An entry matches the specified site and all of its sub-sites.
  • Use a wildcard to match a range of sites. Add the * wildcard at the end of an entry to match every site whose path begins with the same text. For example, /sites/market* matches every site under /sites whose name begins with “market” (such as Marketing and MarketA). The * wildcard is supported only at the end of an entry.
  • Block entries must be site collections. A block entry targets a whole site collection (for example /sites/marketing), not a sub-site within it. You cannot block a single sub-site.
  • The block list cannot block every site (/*). To restrict users to specific sites and exclude the rest, including the root site, use the allow list instead (for example, allow /sites and /teams).

Examples

GOAL ALLOW LIST BLOCK LIST RESULT
Allow only specific sites /sites/marketing (empty) Users can add only the Marketing site and its sub-sites. Everything else is hidden.
Block specific sites (empty) /sites/hr Users can add any site except HR.
Allow only /sites and /teams sites /sites, /teams (empty) Users can add any site under /sites or /teams. The root site collection and its sub-sites are blocked.
Block everything under /sites (empty) /sites Sites under /sites are blocked. The root site collection, its sub-sites, and /teams sites remain available.
Allow /sites and /teams, but block one sensitive site /sites, /teams /sites/confidential Any /sites or /teams site except Confidential.