#governance 11 articles
/_api/HubSites returns an empty list (HTTP 200) when the caller cannot see the hub sites gotchas / rest-api The hub list is security-trimmed, so an account that cannot read the hub sites gets value: [] with HTTP 200; "this site has no hub" and "no inherited owner" must never be derived from it — read IsHubSite/HubSiteId from… MajorVersionLimit: 0 means unlimited, not none gotchas / lists One integer covering "no limit", "keep n" and "versioning is off"; the library your report calls tidiest is the one eating the quota A deleted site and a site you cannot see are two different answers — read the status, not ok gotchas / rest-api _api/web on a non-existent site collection answers 404 (measured, no redirect), so if (!r.ok) return unknown makes a dead row in your own site inventory look like a site you merely lack permission on; keep r.status… A library with NoCrawl returns nothing from Search — and silently blinds anything built on Search gotchas / search Excluded containers return 0 with HTTP 200 and no log, so Search-backed AI never sees them; provisioning that excludes data lists must not inherit that onto content libraries; reindex can't be forced over REST… A list with WriteSecurity 4 ignores Contribute — only ManageLists gets through gotchas / permissions Only ManageLists (Design/Edit/Full Control) overrides the item-level write block, so "break inheritance + give the group Contribute" grants nothing; resolve the role by RoleTypeKind, not by its localised name A version is a full copy, not a delta — and a metadata-only edit costs one gotchas / lists The quota counts every version at full file size and a metadata-only edit costs one; measured on a live tenant, three column edits took a 1 MiB file to 4 MB JoinHubSite silently moves a site that already belongs to another hub gotchas / rest-api Calling JoinHubSite on a site that sits in hub A returns 200 and the site is in hub B at once — no unjoin step, no warning, so any "apply hub" plan must read the current hub first Renaming your SharePoint domain (contosoltd.sharepoint.com to contoso.sharepoint.com) guides Scheduling a tenant rename on a fresh tenant – checking the name is free, adding the matching .onmicrosoft.com domain the right way, the 24-hour scheduling floor (error -772), what -WhatIf and the status output look… Restoring inheritance is a one-way door — snapshot the unique assignments first gotchas / permissions resetroleinheritance throws away every unique role assignment and SharePoint keeps no copy, so an "undo" is only possible if the code saved the assignments BEFORE the call; re-breaking with copyRoleAssignments=true… Sensitivity labels in SharePoint Search — the managed property works, but licensing gates it gotchas / search InformationProtectionLabelId returns a GUID only after AIP-enable + label + crawl; unlicensed tenants can't even create a label (InvalidLicenseException) The memberOf operator in dynamic group rules stops working on 3 November 2026 — groups freeze instead of failing gotchas / graph Entra ends the memberOf preview operator in dynamic membership rules on 3 Nov 2026 (MC1448379): affected groups, dynamic admin units and auto-assignment policies keep their last membership and never update again.…