Setting conditional access policy

[pratheep-r]

I need to setup conditional access policy
The policy name - "EU SharePoint"
Authentication context - "SharePoint - Restricted Site"

The only parameter I can provide the policy name appears is ProtectionLevelName

Tried various combinations including the below
Set-PnPTenantSite -Identity "https://tenant.sharepoint.com/sites/Policy-Test" -ConditionalAccessPolicy AuthenticationContext -ProtectionLevelName "EU SharePoint"

Can someone advise what's the right parameter please?

[tltaylor1]

ProtectionLevelName takes the name of the authentication context, not the name of the Conditional Access policy. SharePoint never references the policy; it tags the site with the context, and the policy in Entra targets that context.

So for your setup:

Set-PnPTenantSite -Identity "https://tenant.sharepoint.com/sites/Policy-Test" -ConditionalAccessPolicy AuthenticationContext -ProtectionLevelName "SharePoint - Restricted Site"

Two things to check if it still refuses the name: the authentication context must be published in Entra (Protection, Conditional Access, Authentication contexts, with "Publish to apps" on), and the Conditional Access policy "EU SharePoint" must list that context under Target resources. Once both are true, opening the site triggers the policy.

[pratheep-r]

Many thanks Terry. Spot on applying the policy works.
However, I am unable to get the applied authentication. Tried below, I will do some more digging in later, in the meantime throwing in here if you know anything on top of your head.

[tltaylor1]

Glad it worked. The blank is not your tenant; it is a gap in the cmdlet.

When Set-PnPTenantSite applies the context it writes the name to the site property AuthContextStrength. Get-PnPTenantSite builds its output from that same property set, and its model declares ProtectionLevelName but never copies AuthContextStrength into it, so the field comes back empty no matter what is applied. The ConditionalAccessPolicy column reads correctly because that one is copied.

Two ways to read the applied name today:

1. The SharePoint Online management shell exposes it directly:

   Get-SPOSite -Identity "https://tenant.sharepoint.com/sites/Policy-Test" | Select-Object Url, ConditionalAccessPolicy, AuthenticationContextName

2. Staying in PnP, read the site properties through the connection's own context:

   $ctx = Get-PnPContext
   $tenant = New-Object Microsoft.Online.SharePoint.TenantAdministration.Tenant($ctx)
   $props = $tenant.GetSitePropertiesByUrl("https://tenant.sharepoint.com/sites/Policy-Test", $true)
   $ctx.Load($props)
   $ctx.ExecuteQuery()
   $props.AuthContextStrength

The right fix is one line in the module, mapping AuthContextStrength to ProtectionLevelName in the site model, and it is worth an issue on this repository so the property reads back the same way it is written.

If this answers it, please mark the thread as accepted so the next person finds it. And if you are curious what I build, my repositories are at github.com/tltaylor1; a ⭐ on anything you find interesting is always appreciated.

[pratheep-r]

Many thanks again Terry.
Please feel free to open an issue, since you have better background. However, I am happy to open if you want me to.