#Configure Management Services

This section details services that support ongoing workspace maintenance, including permission changes, guest user handling, and updates to settings or configurations.

After you add an element to a dynamic service, you must complete the corresponding configurations. For more details on how to configure each type of element, refer to the instructions in the corresponding section below:

#Change Contact Service

A Change contact service allows you to define the primary or secondary contact change service template for your business users. Business users can request to change the primary and secondary contacts of distribution groups, security groups, mail-enabled security groups, shared mailboxes, guest users, site collections, Microsoft 365 Groups, Microsoft Teams, Power Platform environments, Power Apps, Power Automate flows, Power BI workspaces, or Viva Engage communities via this service.

The following settings are the default settings of a Change contact service, and they are required to be configured:

• Scope – Choose to define the scope or inherit the scope from a previous service.

  • Define scope – Define the object types in a Microsoft 365 tenant or specific containers whose contacts can be changed via requests for this service from business users.

    • Object type – Select the object types from the drop-down list. Business users can submit requests for this service to manage the object types in the defined scope.

      After you select the Power App object type, you can also choose whether to allow requests for the quarantined or inactive apps.

      After you select the Power Automate flow object type, you can also choose whether to allow requests for the disabled or suspended flows.

      When only one object type is selected, or one or more of the following object types are selected: Microsoft Team, Viva Engage community, Microsoft 365 Group, distribution group, security group, mail-enabled security group, you can choose whether to Hide this field from the request page. With this option selected, this field will be hidden from the request page and business users do not need to select an object type before specifying the object of which they want to change contact.

    • Scope – The scope can be a Microsoft 365 tenant or specific containers.

      • Select a tenant as the scope – Business users can submit requests for this service to manage the defined object types in the selected tenant. Your Microsoft 365 tenant is displayed here when your tenant has a Microsoft Entra ID app profile configured in AvePoint Online Services.

      • Select containers as the scope – Business users can only manage the defined object types in specific containers. Click Add to open the Select scope from tree panel, select one or more containers from the data tree, and then click Add to add the selected containers to the table. In the panel, you can also enter the keyword of a container in the search box to search for a container. To ensure this setting takes effect, make sure an app profile for Cloud Governance for Exchange service app has been created in AvePoint Online Services. If your tenant uses the custom app, make sure you add the Exchange.ManageAsApp permission to the custom Azure app, assign the Exchange Administrator role to the app, and re-authorize the app.

    • Choose whether to Limit the groups or teams whose contact can be changed. With the option enabled, select a people picker filter profile from the drop-down list to limit the people picker fields in the service request in the Cloud Governance Portal. The profile will determine what groups and teams are available in the people picker fields when changing the contact with requests for this service.

      You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

      To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

  • Inherit from the previous service – If you have already added a Change metadata, Change ownership or membership, Change shared mailbox permission, Change site setting, Change team profiles, Change team settings, or Convert Microsoft 365 Group to team service to the flow in the previous step, you can choose this option and select the service from the drop-down list to use the scope configured for the service as the service request scope.

• Change contact – Define whether you allow requesters to change the primary contact or secondary contact.

  • Allow requesters to change the primary contact – With this checkbox selected, business users can request to change the primary contact of groups or shared mailboxes.

    • People picker filter profile – Select a people picker filter profile from the drop-down list to determine the users that will be specified as the primary contact in the request form. You can click View profile details to view details of your selected profile.

      You can click the create button or go to Management > Profiles & templates > People picker filter profiles to create a people picker filter profile. For more instructions, refer to Configure People Picker Filter Profiles. You can also click the refresh button to retrieve the latest available profiles.

    • Choose whether to Notify the newly assigned contacts. With this checkbox selected, select an email template from the drop-down list.

  • Allow requesters to change the secondary contact – With this checkbox selected, business users can request to change the secondary contact of the groups or shared mailboxes.

    • Require a secondary contact – With this checkbox selected, a secondary contact is required in the request form.

    • People picker filter profile – Select a people picker filter profile from the drop-down list to determine the users that be specified as the secondary contact in the request form. You can click View profile details to view details of your selected profile.

      You can click the create button or go to Management > Profiles & templates > People picker filter profiles to create a people picker filter profile. For more instructions, refer to Configure People Picker Filter Profiles. You can also click the refresh button to retrieve the latest available profiles.

    • Choose whether to Notify the newly assigned contacts. With this checkbox selected, select an email template from the drop-down list.

#Change Distribution Group Settings Service

A Change distribution group settings service allows you to define the Change distribution group service template for your business users. Business users can request to change the group name, description, email addresses, Exchange global address list setting, send as delegates, send on behalf delegates, and delivery management settings via this service.

The Scope is the default setting of a Change distribution group settings service, and it is required to be configured. Choose to define the scope or inherit the scope from a previous service.

• Define scope – Define the service scope for distribution groups whose settings can be changed via requests for this service. The service scope can be a Microsoft tenant or specific containers.

  • Select a tenant as the scope – Business users can submit requests for this service to change the settings of distribution groups in the selected tenant.

  • Select containers as the scope – Business users can submit requests for this service to change the settings of distribution groups in specific containers. Click Add to open the Select scope from tree panel, select one or more containers from the data tree, and then click Add to add the selected containers to the table.

    In the panel, you can also enter the keyword of a container in the search box to search for a container.

  • Choose whether to Limit the groups whose settings can be changed. With the option enabled, select a people picker filter profile from the drop-down list to limit the distribution groups in the service request in the Cloud Governance Portal. The profile will determine what groups are available in the people picker fields when changing distribution group settings with requests for this service.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

• Inherit from the previous service – If you have already added any of the following services to the flow in the previous step, you can choose this option and select the service from the drop-down list to use the scope configured for the service as the service request scope.

  • Change contact service with the distribution group object type selected

  • Change metadata service with the distribution group object type selected

  • Change ownership or membership service with the distribution group object type selected

Apart from the scope, you can click the add button to add any of the following settings to a Change distribution group settings service based on your requirement, and then complete the configurations:

• Change delivery management settings – Allow business users to change sender options and specified senders via requests for this service.

  • Allow requesters to change sender options – Business users can change sender options via this service request.

  • Allow requesters to manage specified senders – Define how business users can manage specified senders via this service request.

    • Allow requesters to add new senders – Business users can add new senders via this service request. With the option selected, select a people picker filter profile from the drop-down list to determine what users and groups can be added as senders with requests for this service.

      You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

      To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

    • Allow requesters to remove existing senders – Business users can remove existing senders via this service request.

• Change Exchange global address list setting – Allows business users to change whether to hide the group from the Exchange global address list via requests for this service.

• Change group description – Allow business users to change the group description via requests for this service.

  Choose whether to Require a group description. With the option selected, the group description will be a required field on the request form.

• Change group email addresses – Allow business users to change the group primary email address and aliases via requests for this service. You can also limit the domains that business users can use.

  • Allow requesters to change the primary email address – Define how the primary email address can be changed via this service request.

    • Allow requesters to change the domain of primary email address – Business users can change the domain of primary email address via this service request.

    • Remove original primary email address from alias – With the option selected, once the primary email address is changed, the original primary email address will be automatically removed from aliases.

  • Allow requesters to manage aliases – Define how aliases can be managed via this service request.

    • Allow requesters to add new aliases – Business users can add new aliases via this service request.

    • Allow requesters to remove existing aliases – Business users can remove existing aliases via this service request.

  • Limit the domain scope – Limit the domain scope that business users can use for the primary email address and new aliases on the request form. With the option selected, select the domains to be available for business users in the table.

    NOTE

    Without the settings enabled, all domains in the tenant can be used.

• Change group name – Allow business users to change the group name with requests for this service. Choose whether to Do not allow duplicate group name.

  Choose whether to Apply a validation rule to the group name on the request page. With this option selected, select a group name validation rule from the drop-down list to determine what rule is applied to validate the group name on the request form.

  You can click View rule details to view the details of the selected validation rule. You can also click the create button to create a new rule. For more information about how to create a validation rule, refer to Configure Text Validation Rules.

  To retrieve the latest validation rules that are available, you can click the refresh button.

• Change send as – Allow business users to change the delegates who will have the Send as permission to send emails from the group via this service request. From the recipient’s perspective, the emails were sent by the group.

  • Allow requesters to change send as delegates – Business users can change send as delegates via this service request. With the option selected, select a people picker filter profile from the drop-down list to determine what users and groups can be specified as send as delegates via this service request.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

  • Allow requesters to remove send as delegates – Business users can remove send as delegates via this service request.

• Change send on behalf – Allow business users to change the delegates who will have the Send on behalf permission to send emails on behalf of the group via this service request.

  • Allow requesters to change sendon behalf delegates – Business users can change send on behalf delegates via this service request. With the option selected, select a people picker filter profile from the drop-down list to determine what users and groups can be specified as send on behalf delegates via this service request.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create (button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

  • Allow requesters to remove sendon behalf delegates – Business users can remove send on behalf delegates via this service request.

#Change Library Settings

A Change library settings service allows you to define the Change library service template for your business users. Business users can request to change the library name and library description via this service.

The Scope is the default setting of a Change library settings service, and it is required to be configured. Choose to define the scope or inherit the scope from a previous service.

• Define scope – Select the SharePoint Online environments as the service request scope:

  • Choose from scope – Add one or more containers/sites as the service request scope. Click Add to open the Select scope from tree panel, select one or more containers/sites from the data tree, and then click Add to add the selected containers/sites to the table.

    In the panel, you can also enter the keyword of a container/site in the search box to search for a container/site.

  • Manually enter the URL – Enter a site collection URL in the text box and click Add to add the URL to the table. You can add multiple URLs.

  • Inherit from the previous service – If you have already added a Create team, Create Microsoft 365 Group, or Create site collection service to the flow in the previous step, you can choose this option to use the object created in the service as the service request scope.

Apart from the default settings, you can click the add button to add any of the following settings to Change library settings service based on your requirement, and then complete the configurations:

• Change library description – With this setting added to the service, business users can change the library description via this service request.

• Change library name – With this setting added to the service, business users can change the library name via this service request.

• Change navigation setting – With this setting added to the service, business users can change whether to display this document library on the Quick Launch via this service request.

• Change version settings – With this setting added to the service, business users can change version settings via this service request.

#Change Mail-enabled Security Group Settings Service

A Change mail-enabled security group settings service allows you to define the Change mail-enabled security group service template for your business users. Business users can request to change the group name, description, Exchange global address list setting, communication settings, send as delegates, and send on behalf delegates via this service.

The Scope is the default setting of a Change mail-enabled security group settings service, and it is required to be configured. Choose to define the scope or inherit the scope from a previous service.

• Define scope – Define the service scope for mail-enabled security groups whose settings can be changed via requests for this service. The service scope can be a Microsoft tenant or specific containers.

  • Select a tenant as the scope – Business users can submit requests for this service to change the settings of mail-enabled security groups in the selected tenant.

  • Select containers as the scope – Business users can submit requests for this service to change the settings of mail-enabled security groups in specific containers. Click Add to open the Select scope from tree panel, select one or more containers from the data tree, and then click Add to add the selected containers to the table.

    In the panel, you can also enter the keyword of a container in the search box to search for a container.

  • Choose whether to Limit the groups whose settings can be changed. With the option enabled, select a people picker filter profile from the drop-down list to limit the mail-enabled security groups in the service request in the Cloud Governance Portal. The profile will determine what groups are available in the people picker fields when changing mail-enabled security group settings with requests for this service.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

• Inherit from the previous service – If you have already added any of the following services to the flow in the previous step, you can choose this option and select the service from the drop-down list to use the scope configured for the service as the service request scope.

  • Change contact service with the mail-enabled security group object type selected

  • Change metadata service with the mail-enabled security group object type selected

  • Change ownership or membership service with the mail-enabled security group object type selected

Apart from the scope, you can click the add button to add any of the following settings to a Change mail-enabled security group settings service based on your requirement, and then complete the configurations:

• Change Exchange global address list setting – Allows business users to change whether to hide the group from the Exchange global address list via requests for this service.

• Change communication setting – Allows business users to change the communication setting of the mail-enabled security group to decide whether to let people outside the organization email the group via requests for this service.

• Change group description – Allow business users to change the group description via requests for this service.

  Choose whether to Require a group description. With the option selected, the group description will be a required field on the request form.

• Change group name – Allow business users to change the group name with requests for this service. Choose whether to Do not allow duplicate group name.

  Choose whether to Apply a validation rule to the group name on the request page. With this option selected, select a group name validation rule from the drop-down list to determine what rule is applied to validate the group name on the request form.

  You can click View rule details to view the details of the selected validation rule. You can also click the create button to create a new rule. For more information about how to create a validation rule, refer to Configure Text Validation Rules.

  To retrieve the latest validation rules that are available, you can click the refresh button.

• Change send as – Allow business users to change the delegates who will have the Send as permission to send emails from the group via this service request. From the recipient’s perspective, the emails were sent by the group.

  • Allow requesters to change send as delegates – Business users can change send as delegates via this service request. With the option selected, select a people picker filter profile from the drop-down list to determine what users and groups can be specified as send as delegates via this service request.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

• Allow requesters to remove send as delegates – Business users can remove send as delegates via this service request.

• Change send on behalf – Allow business users to change the delegates who will have the Send on behalf permission to send emails on behalf of the group via this service request.

  • Allow requesters to change sendon behalf delegates – Business users can change send on behalf delegates via this service request. With the option selected, select a people picker filter profile from the drop-down list to determine what users and groups can be specified as send on behalf delegates via this service request.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

  • Allow requesters to remove sendon behalf delegates – Business users can remove send on behalf delegates via this service request.

#Change Metadata Service

A Change metadata service allows you to define the Change metadata service template for your business users. Business users can request to change metadata values, add metadata, or remove metadata of site collections, Microsoft Teams, Microsoft 365 Groups, distribution groups, mail-enabled security groups, security groups, shared mailboxes, Viva Engage communities, room mailboxes, equipment boxes, guest users, Microsoft 365 users, Power Apps, Power Automate flows, Power Bi workspaces, and environments via this service.

The following settings are the default settings of a Change metadata service, and they are required to be configured.

• Scope – Choose to define the scope or inherit the scope from a previous service.

  • Define scope – Define the object types in a Microsoft 365 tenant or specific containers whose metadata can be changed via requests for this service from business users.

    • Object type – Define the object types from the drop-down list. Business users can submit requests for this service to change metadata of the object types in the defined scope.

      After you select the Power App object type, you can also choose whether to allow requests for the quarantined or inactive apps.

      After you select the Power Automate flow object type, you can also choose whether to allow requests for the disabled or suspended flows.

      When only one object type is selected, or one or more of the following object types are selected: Microsoft Team, Viva Engage community, Microsoft 365 Group, distribution group, security group, mail-enabled security group, you can choose whether to Hide this field from the request page. With this option selected, this field will be hidden from the request page and business users do not need to select an object type before specifying the object of which they want to change metadata.

    • Scope – The scope can be a Microsoft 365 tenant or specific containers.

      • Select a tenant as the scope – Business users can submit requests for this service to change metadata of the defined object types in the selected tenant.

      • Select containers as the scope – Business users can submit requests for this service to change metadata of the defined object types in specific containers. Click Add to open the Select scope from tree panel, select one or more containers from the data tree, and then click Add to add the selected containers to the table.

      In the panel, you can also enter the keyword of a container in the search box to search for a container.

      To ensure this setting takes effect, make sure an app profile for Cloud Governance for Exchange service app has been created in AvePoint Online Services. If your tenant uses the custom app, make sure you add the Exchange.ManageAsApp permission to the custom Azure app, assign the Exchange Administrator role to the app, and re-authorize the app.

    • Choose whether to Limit the groups or teams whose metadata can be changed. With the option enabled, select a people picker filter profile from the drop-down list to limit the people picker fields in the service request in the Cloud Governance Portal. The profile will determine what groups and teams are available in the people picker fields when changing the metadata with requests for this service.

      You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

      To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

  • Inherit from the previous service – If you have already added any of the following services in the previous step, you can choose this option and select the service from the drop-down list to use the scope configured for the service as the service request scope.

    • Change contact service

    • Change distribution group settings service

    • Change mail-enabled security group settings service

    • Change Microsoft 365 Group profiles service

    • Change Microsoft 365 Group settings service

    • Change Microsoft 365 user settings service

    • Change ownership or membership service

    • Change resource mailbox permission service

    • Change security group settings service

    • Change shared mailbox permission service

    • Change site collection profiles service

    • Change site settings service

    • Change team profiles service

    • Change team settings service

    • Manage Microsoft 365 licenses service

    • Convert Microsoft 365 Group to team service

  • Metadata changing mode – Select a changing mode for the metadata from one of the following options:

    • Manual change – With the option selected, you need to configure the Change metadata setting.

    • Dynamic assignment – With the option selected, you need to configure the Dynamic metadata setting.

• Change metadata (Configure this setting when metadata changing mode is set to Manual change) – Define whether you allow requesters to change metadata values, add metadata, or remove metadata.

  • Allow requesters to change metadata values – With the option selected, business users can request to change all or specific metadata values. Metadata values within the defined metadata scope can be changed regardless of the assign by settings of the metadata.

    • Allow requesters to change all metadata values – Business users can submit requests for this service to change all metadata values.

    • Allow requesters to change specific metadata values – Business users can submit requests for this service to change specific metadata values. With the option selected, click Add to open the Add metadata panel, select one or more metadata from the data tree, and then click Add to list to add the selected metadata to the table. In the panel, you can also enter the keyword of a metadata in the search box to search for a metadata.

      Choose whether you Require value for a metadata in the table.

      Add the metadata again if the values, default value, people picker, text validation rule, URL, choice type, or Microsoft Entra property settings of the metadata are changed.

  • Allow requesters to add metadata – With the option selected, business users can request to add metadata to objects in the defined scope. You can manage the metadata that can be added via this service request. Click Add to open the Add metadata panel, select one or more metadata from the data tree, and then click Add to list to add the selected metadata to the table.

    In the panel, you can also enter the keyword of a metadata in the search box to search for a metadata.

    You can edit the default value and value determined by setting of a metadata in this service requests by clicking the Edit button in the table.

    Add the metadata again if the values, default value, people picker, text validation rule, URL, choice type, or Microsoft Entra property settings of the metadata are changed.

  • Allow requesters to remove metadata – With this option selected, business users can request to remove all or specific metadata from objects in the defined scope.

    • Allow requesters to remove all metadata – Business users can submit requests for this service to remove all metadata.

    • Allow requesters to remove specific metadata – Business users can submit requests for this service to remove specific metadata. With the option selected, click Add to open the Add metadata panel, select one or more metadata from the data tree, and then click Add to list to add the selected metadata to the table.

      In the panel, you can also enter the keyword of a metadata in the search box to search for a metadata.

• Dynamic metadata (Configure this setting when metadata changing mode is set to Dynamic assignment) – Define the dynamic metadata profile that will be applied to the target object. Select a dynamic metadata profile from the drop-down list.

  You can also click the create button to create a new profile. For more information about how to create a dynamic metadata profile, refer to Configure Dynamic Metadata Profiles.

Apart from the default settings, you can click the add button to add the Set mandatory metadata setting to a Change metadata service based on your requirement, and then complete the configurations:

Set mandatory metadata – Define the mandatory metadata that will be applied to the target object.

Click Add to open the Add metadata panel, select one or more metadata from the data tree, and then click Add to list to add the selected metadata to the table.

For metadata in the table, you can click the edit button in the Action column to modify the value or click the delete button to remove the metadata.

The configured metadata will be applied to the target object.

#Change Microsoft 365 Group Profiles Service

A Change Microsoft 365 Group profiles service allows you to define the Microsoft 365 Group profiles change service template for your business users. Business users can request to change the Microsoft 365 Group contact election profile, external sharing profile, renewal profile, and storage management profile via this service request.

The Scope is the default setting of a Change Microsoft 365 Group profiles service, and it is required to be configured. Choose to define the scope or inherit the scope from a previous service.

• Define scope – Define the service scope for Microsoft 365 Groups whose profiles can be changed via requests for this service. The service scope can be a Microsoft tenant or specific containers.

  • Select a tenant as the scope – Business users can submit requests for this service to change the profiles of groups in the selected tenant.

  • Select containers as the scope – Business users can submit requests for this service to change the profiles of groups in specific containers. Click Add to open the Select scope from tree panel, select one or more containers from the data tree, and then click Add to add the selected containers to the table.

    In the panel, you can also enter the keyword of a container in the search box to search for a container.

  • Choose whether to Limit the groups whose profiles can be changed. With the option enabled, select a people picker filter profile from the drop-down list to limit the groups in the service request in the Cloud Governance Portal. The profile will determine what groups are available in the people picker fields when changing the profile of groups with requests for this service.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

• Inherit from the previous service – If you have already added any of the following services to the flow in the previous step, you can choose this option and select the service from the drop-down list to use the scope configured for the service as the service request scope.

  • Change contact service with the Microsoft 365 Group object type selected

  • Change metadata service with the Microsoft 365 Group object type selected

  • Change ownership or membership service with the Microsoft 365 Group object type selected

Apart from the scope, click the add button to add any of the following settings to a Change Microsoft 365 Group profiles service based on your requirement, and then complete the configurations:

• Change contact election profile – Allow business users to change the group contact election profile via this service request.

  • Allow requesters to change the profile – You can choose whether to Limit the profiles that requesters can use. With this option enabled, select one or more profiles. You can also click Create to create a new group contact election profile.

  • Change to the following profile – Select a profile that you want to change to, and then configure how to show this field to business users:

    • Show this field as read-only to business users – You select the profile and it will be displayed to business users as read-only.

    • Hide this field from business users – You select the profile and it will not be displayed to business users.

  • Configure how to handle the groups that have ongoing contact election tasks.

• Change external sharing profile – Allow business users to change the group external sharing profile via this service request.

  • Allow requesters to change the profile – You can choose whether to Limit the profiles that requesters can use. With this option enabled, select one or more profiles. You can also click Create to create a new group external sharing profile.

  • Change to the following profile – Select a profile that you want to change to, and then configure how to show this field to business users:

    • Show this field as read-only to business users – You select the profile, and it will be displayed to business users as read-only.

    • Hide this field from business users – You select the profile and it will not be displayed to business users.

• Change renewal profile – Allow business users to change the group renewal profile via this service request.

  • Allow requesters to change the profile – You can choose whether to Limit the profiles that requesters can use. With this option enabled, select one or more profiles. You can also click Create to create a new group renewal profile.

  • Change to the following profile – Select a profile that you want to change to, and then configure how to show this field to business users:

    • Show this field as read-only to business users – You select the profile, and it will be displayed to business users as read-only.

    • Hide this field from business users – You select the profile, and it will not be displayed to business users.

  • Configure how to handle the groups that have ongoing renewal tasks.

• Change storage management profile – Allow business users to change the group storage management profile via this service request.

  • Allow requesters to change the profile – You can choose whether to Limit the profiles that requesters can use. With this option enabled, select one or more profiles. You can also click Create to create a new group storage management profile.

  • Change to the following profile – Select a profile that you want to change to, and then configure how to show this field to business users:

    • Show this field as read-only to business users – You select the profile, and it will be displayed to business users as read-only.

    • Hide this field from business users – You select the profile, and it will not be displayed to business users.

#Change Microsoft 365 Group Settings Service

A Change Microsoft 365 Group settings service allows you to define the Change Microsoft 365 Group settings service template for your business users. Business users can request to change the Exchange global address list setting, send as delegates, and send on behalf delegates via this service.

The Scope is the default setting of a Change Microsoft 365 Group settings service, and it is required to be configured. Choose to define the scope or inherit the scope from a previous service.

• Define scope – Define the service scope for Microsoft 365 Groups whose settings can be changed via requests for this service. The service scope can be a Microsoft tenant or specific containers.

  • Select a tenant as the scope – Business users can submit requests for this service to change the settings of Microsoft 365 Groups in the selected tenant.

  • Select containers as the scope – Business users can submit requests for this service to change the settings of Microsoft 365 Groups in specific containers. Click Add to open the Select scope from tree panel, select one or more containers from the data tree, and then click Add to add the selected containers to the table.

    In the panel, you can also enter the keyword of a container in the search box to search for a container.

  • Choose whether to Limit the groups whose settings can be changed. With the option enabled, select a people picker filter profile from the drop-down list to limit the Microsoft 365 Groups in the service request in the Cloud Governance Portal. The profile will determine what groups are available in the people picker fields when changing Microsoft 365 Group settings with requests for this service.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

• Inherit from the previous service – If you have already added any of the following services to the flow in the previous step, you can choose this option and select the service from the drop-down list to use the scope configured for the service as the service request scope.

  • Change contact service with the Microsoft 365 Group object type selected

  • Change metadata service with the Microsoft 365 Group object type selected

  • Change Microsoft 365 Group profiles service

  • Change ownership or membership service with the Microsoft 365 Group object type selected

Apart from the scope, you can click the add button to add any of the following settings to a Change Microsoft 365 Group settings service based on your requirement, and then complete the configurations:

• Change Exchange global address list setting – Allow business users to change whether to hide the group from the Exchange global address list via this service request.

• Change group classification – Allow business users to change the group classification via this service request.

  Select one or more group classifications that can be changed to. The classifications are retrieved from what has been created in your Microsoft 365 tenant.

  Choose whether to Require requesters to change the original value. With this option enabled, requesters are required to change the original value of the classifications.

• Change group description – Allow business users to change the group description via this service request.

  Choose whether to Require a group description. With this option enabled, the group description will be a required field on request forms.

• Change group name – Allow business users to change the group name via this service request.

  Choose whether to Do not allow duplicate group names.

  Choose whether to Apply a validation rule to the group name on the request page. With this option selected, select a group name validation rule from the drop-down list to determine what rule is applied to validate the group name on the request form.

  You can click View rule details to view the details of the selected validation rule. You can also click the create button to create a new rule. For more information about how to create a validation rule, refer to Configure Text Validation Rules.

  To retrieve the latest validation rules that are available, you can click the refresh button.

• Change group picture – Set the group picture or allow business users to change the group picture via the service request.

  • Allow requesters to change the group picture – Allow business users to change the group picture in the request form.

  • Change to the specific picture – Click the browse button, select a picture, and click Open. The picture is uploaded, and you can preview it. The specified picture will be set as the picture of Microsoft 365 Groups requested by this service.

  • Specify the group picture URL – Enter the SharePoint URL of the picture. Make sure that a Microsoft 365 (All permissions), Cloud Governance for Microsoft 365, or custom app profile has been created for the tenant that contains the picture’s parent site in AvePoint Online Services. The picture will be retrieved from the URL and set as the picture of Microsoft 365 Groups requested by this service.

  • Remove the custom group picture – Custom group pictures will be removed for Microsoft 365 Groups requested by this service.

• Change group privacy – Allow business users to change the group privacy via this service request.

• Change group sensitivity label – Allow business users to change the group sensitivity label. Select one or more sensitivity labels for the group that can be changed to via this service request.

  Choose whether to Require requesters to change the original value.

  NOTE

  Make sure that your tenant has already created and published the sensitivity labels in Microsoft 365. To allow Cloud Governance to retrieve external user access and external sharing settings of labels, configure the Cloud Governance for Exchange app and assign it the Compliance Administrator role. Without the configuration, an error task will be generated when configuration in the service requests conflict with the applied sensitivity label settings.

• Change member subscription settings – Allow business users to change whether to send copies of conversations, and events to group members’ inboxes via this service request.

• Change Outlook experience settings – Allow business users to change whether to hide the group from the Outlook client via this service request.

• Change outside sender settings – Allow business users to change whether to let people outside the organization email the group via this service request.

• Change send as – Change the delegates who will have the Send as permission to send emails from the group. From the recipient's perspective, the emails were sent by the group.

  • Allow requesters to change send as delegates – Business users can change send as delegates via this service request. With the option selected, select a people picker filter profile from the drop-down list to determine what users and groups can be specified as send as delegates via this service request.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

  • Allow requesters to remove send as delegates – Business users can remove send as delegates via this service request.

• Change send on behalf – Allow business users to change the delegates who will have the Send on behalf permission to send emails on behalf of the group via this service request.

  • Allow requesters to change sendon behalf delegates – Business users can change send on behalf delegates via this service request. With the option selected, select a people picker filter profile from the drop-down list to determine what users and groups can be specified as send on behalf delegates via this service request.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

  • Allow requesters to remove sendon behalf delegates – Business users can remove send on behalf delegates via this service request.

#Change Microsoft 365 User Settings Service

A Change Microsoft 365 user settings service allows you to define the Change Microsoft 365 user settings service template for your business users. Business users can request to change the Microsoft 365 user's display name and primary email address via this service.

The Scope is the default setting of a Change Microsoft 365 user settings service, and it is required to be configured. Choose to define the scope or inherit the scope from a previous service.

• Define scope – Define the service scope for Microsoft 365 users whose settings can be changed via requests for this service. The service scope can be a Microsoft tenant or specific containers.

  • Select a tenant as the scope – Business users can submit requests for this service to change the settings of users in the selected tenant.

  • Select containers as the scope – Business users can submit requests for this service to change the settings of users in specific containers. Click Add to open the Select scope from tree panel, select one or more containers from the data tree, and then click Add to add the selected containers to the table.

    In the panel, you can also enter the keyword of a container in the search box to search for a container.

  • Choose whether to Limit the users whose settings can be changed. With the option enabled, select a people picker filter profile from the drop-down list to limit the people picker fields in the service request in the Cloud Governance Portal. The profile will determine what users are available in the people picker fields when changing the settings of users with requests for this service.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

• Inherit from the previous service – If you have already added a Manage Microsoft 365 licenses service to the flow in the previous step, you can choose this option and select the service from the drop-down list to use the scope configured for the service as the service request scope.

Apart from the scope, click the add button to add any of the following settings to a Change Microsoft 365 user settings service based on your requirement, and then complete the configurations:

• Change display name – Allows business users to change the user’s display name via this service request.

• Change primary email address – Allows business users to change the user’s primary email address via this service request.

  You can define how requesters can change the user's primary email address by selecting one of the following options:

  • Allow requesters to change the domain of primary email address – With this option selected, you can select one or more domain names for requesters to change the user's primary email address.

  • Remove original primary email address from alias – With this option selected, the original primary email address will be removed from the alias of the user when the primary email address has been changed.

#Change Ownership or Membership Service

A Change ownership or membership service allows you to define the group, team, and community ownership or membership change request template for your business users. Business users can request to change the owners or members of a distribution group, security group, mail-enabled security group, Microsoft 365 Group, Microsoft Team, or Viva Engage community via this service.

The Scope is the default setting of a Change ownership or membership service, and it is required to be configured. Choose to define the scope or inherit the scope from a previous service.

• Define scope – Define the object types in a Microsoft 365 tenant or specific containers whose owners or members can be changed via requests for this service from business users.

  • Object type – Select the object types from the drop-down list. Business users can submit requests for this service to manage the object types in the defined scope.

    NOTE

    For Microsoft Teams, choose whether to Allow requests for archived teams. If you enable this option, archived teams in the defined scope can be requested for this service.

  • Scope – The scope can be a Microsoft 365 tenant or specific containers.

    • Select a tenant as the scope – Business users can submit requests for this service to manage the defined object types in the selected tenant.

    • Select containers as the scope – Business users can only manage the defined object types in specific containers. Click Add to open the Select scope from tree panel, select one or more containers from the data tree, and then click Add to add the selected containers to the table.

      In the panel, you can also enter the keyword of a container in the search box to search for a container.

      When you select the distribution group or mail-enabled security group as the object type, to ensure this setting takes effect, make sure an app profile for Cloud Governance for Exchange service app has been created in AvePoint Online Services. If your tenant uses the custom app, make sure you add the Exchange.ManageAsApp permission to the custom Azure app, assign the Exchange Administrator role to the app, and re-authorize the app.

  • Choose whether to Limit the groups or teams whose owners or members can be changed. With the option enabled, select a people picker filter profile from the drop-down list to limit the people picker fields in the service request in the Cloud Governance Portal. The profile will determine what groups and teams are available in the people picker fields when changing the ownership or membership with requests for this service.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

• Inherit from the previous service – If you have already added a Change metadata, Change team settings service, or a Change contact service to the flow in the previous step, you can choose this option and select the service from the drop-down list to use the scope configured for the service as the service request scope.

Apart from the scope, click the add button to add any of the following settings to a Change ownership or membership service based on your requirement, and then complete the configurations:

Change membership – Choose the available actions for business users to manage group, team, and community members via the service request.

• Allow requesters to change the membership assignment method – With the checkbox selected, business users can change how to manage the team or group membership, either manually or dynamically.

  With the checkbox selected, requesters are allowed to add or remove dynamic membership rules for the group or team.

  NOTE

  This setting is only available for Microsoft 365 Groups, Microsoft Teams, and Viva Engage community. If Microsoft 365 Groups, Microsoft Teams, or Viva Engage communities are not included in the scope defined above. This setting is hidden.

• Manually assigned membership – Choose the available actions for business users to manage groups, teams, or communities whose membership is assigned manually.

  • Allow requesters to add members – With the checkbox selected, business users can add members to the workspace.

    • People picker filter profile – Select a people picker filter profile from the drop-down list to determine what user is searchable and can be chosen in the end user request form. You can click View profile details to view details of your selected profile.

      You can click the create button or go to Management > Profiles & templates > People picker filter profiles to create a people picker filter profile. For more instructions, refer to Configure People Picker Filter Profiles. You can also click the refresh button to retrieve the latest available profiles.

    • Choose whether to Generate separate approval tasks for newly added members. With the option enabled, select a new user approval process from the drop-down list. Sub tasks for each user added via this service request will be generated and need approval.

      You can click View profile details to view details of your selected profile.

      You can click the create button or go to Management > Profiles & templates > Approval processes to create an approval process. For more instructions, refer to Configure New User Approval Processes. You can also click the refresh button to retrieve the latest available processes.

  • Allow requesters to remove members – With the checkbox selected, business users can remove members from the workspace.

• Dynamically assigned membership – Choose the available actions for business users to manage groups, teams, or communities whose membership is assigned dynamically.

  NOTE

  This setting is only available for Microsoft 365 Groups, Microsoft Teams, and Viva Engage community. If Microsoft 365 Groups, Microsoft Teams, or Viva Engage communities are not included in the scope defined above. This setting is hidden.

  • Choose whether to Allow requesters to edit existing dynamic membership rules.

  • Choose whether to Allow requesters to add dynamic membership rules. With the checkbox selected, you can continue to configure the following setting.

    NOTE

    If you Allow requesters to change the membership assignment method, this option is selected by default and cannot be edited.

    • Choose whether to Restrict and predefine the dynamic membership rules that requesters can add. With the checkbox selected, you can click Add and configure the following settings in the Define dynamic rules panel. Microsoft 365 users who meet the rules will automatically become group and team members.

      • Logic option – You can add multiple dynamic rules to the table. Choose an option to define the logic option for these rules.

      • Category – Select from Contact information, License, Organization, Extension attribute, or Custom Microsoft Entra property as the category for the dynamic membership rule.

      • Rule – Select a dynamic membership rule from the drop-down list.

      • Condition – Define the condition to Equals, Contains, or Is a certain value.

      • Value – Enter a value for the rule. Users whose properties conform to the value will be added to the group or team. You can choose whether to Allow requesters to define the rule value.

        After you configure a rule, click Add to list to add it to the list. If you want to remove all the rules in the list, click Clear.

        NOTE

        • The dynamic membership feature was built by Cloud Governance. Cloud Governance did not leverage the dynamic membership feature of Microsoft Entra. Therefore, after a group or team with dynamic membership is created via a Cloud Governance request, the membership type of the group or team shown in the Microsoft Entra and Microsoft 365 admin center is Assigned, rather than Dynamic.
        • For inactive users that meet the dynamic membership rules but have been blocked in Microsoft Entra, they can still be added as group or team members. For inactive users that meet the rules but have been deleted in Microsoft Entra, they will not be added to the group or team.

  • Choose whether to Allow requesters to remove dynamic membership rules.

  • People picker filter profile – Select a people picker filter profile from the drop-down list to determine what user can be added or removed from the group or team with the dynamic rules. You can click View profile details to view details of your selected profile.

    You can click the create button or go to Management > Profiles & templates > People picker filter profiles to create a people picker filter profile. For more instructions, refer to Configure People Picker Filter Profiles. You can also click the refresh button to retrieve the latest available profiles.

Change ownership – Choose the available actions for business users to manage group, team, or community owners via the service request.

• Allow requesters to add owners – With the checkbox selected, business users can add owners to the workspace.

  • People picker filter profile – Select a people picker filter profile from the drop-down list to determine what user is searchable and can be chosen in the end user request form. You can click View profile details to view details of your selected profile.

    You can click the create button or go to Management > Profiles & templates > People picker filter profiles to create a people picker filter profile. For more instructions, refer to Configure People Picker Filter Profiles. You can also click the refresh button to retrieve the latest available profiles.

  • Choose whether to Generate separate approval tasks for newly added owners. With the option enabled, select an approval process from the drop-down list. Sub tasks for each user added via this service request will be generated and need approval.

    You can click View profile details to view details of your selected profile.

    You can click the create button or go to Management > Profiles & templates > Approval processes to create an approval process. For more instructions, refer to Configure New User Approval Processes. You can also click the refresh button to retrieve the latest available processes.

• Allow requesters to remove owners – With the checkbox selected, business users can remove owners from the workspace.

Predefined owners and members – Add one or more users or groups or enter $ to select user roles to be the predefined owners or members. The predefined people will be added as owners or members automatically for groups/teams/communities whose ownership or membership are changed via this service request.

Note the following:

• The predefined owners and members will be hidden from the request form for business users.

• Predefined members are not available for groups, teams, and communities with dynamically assigned membership.

#Change Power BI Workspace Access

A Change Power BI workspace access service allows you to define the Change Power BI workspace access service template for your business users. Business users can request to change the workspace admins, contributors, members, and viewers via this service.

The Scope is the default setting of a Change Power BI workspace access service, and it is required to be configured. Choose to define the scope or inherit the scope from a previous service.

• Define scope – Define the service scope for Power BI workspaces whose access can be changed via requests for this service. The service scope can be a Microsoft tenant or specific containers.

  • Select a tenant as the scope – Business users can submit requests for this service to change the access to Power BI workspaces in the selected tenant.

  • Select containers as the scope – Business users can submit requests for this service to change the access to Power BI workspaces in specific containers. Click Add to open the Select scope from tree panel, select one or more containers from the data tree, and then click Add to add the selected containers to the table.

    In the panel, you can also enter the keyword of a container in the search box to search for a container.

• Inherit from the previous service – If you have already added any of the following services to the flow in the previous step, you can choose this option and select the service from the drop-down list to use the scope configured for the service as the service request scope.

  • Change contact service with the Power BI workspace object type selected

  • Change metadata service with the Power BI workspace object type selected

Apart from the scope, you can click the add button to add any of the following settings to a Change Power BI workspace access settings service based on your requirement, and then complete the configurations:

• Change admins/contributors/members/viewers – Allow business users to change workspace admins/contributors/members/viewers via requests for this service.

  • Allow requesters to add admins/contributors/members/viewers – Business users can add workspace admins/contributors/members/viewers via requests for this service. With the option selected, select a people picker filter profile from the drop-down list to determine what users and groups can be added as workspace admins/contributors/members/viewers via requests for this service.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

  • Allow requesters to remove admins/contributors/members/viewers – Business users can remove workspace admins/contributors/members/viewers via requests for this service.

#Change Private Channel Settings Service

A Change private channel settings service allows you to define the private channel settings change service template for your business users. Business users can request to change the private channel name, description, owners, members, and site storage via this service.

The following settings are the default settings of a Change private channel settings service, and they are required to be configured:

The Scope is the default setting of a Change private channel settings service, and it is required to be configured. Define the service scope for teams in which private channel settings can be changed via requests for this service. Choose a Microsoft tenant or specific containers as the scope or inherit the scope from a previous service.

• Select a tenant as the scope – Business users can submit requests for this service to change settings of private channels in teams of the selected tenant.

  Your Microsoft 365 tenant is displayed here when your tenant has a Microsoft Entra ID or Cloud Governance for Microsoft 365 app profile configured in AvePoint Online Services.

• Select containers as the scope – Business users can submit requests for this service to create private channels for teams in specific containers. Click Add to open the Select scope from tree panel, select one or more containers from the data tree, and then click Add to add the selected containers to the table.

  In the panel, you can also enter the keyword of a container in the search box to search for a container.

• Inherit from the previous service – If you have already added any of the following services to the flow in the previous step, you can choose this option and select the service from the drop-down list to use the scope configured for the service as the service request scope.

  • Change contact service

  • Change ownership or membership service with the Microsoft Team object type selected

  • Change team profiles service

  • Change team settings service

  • Change metadata service with the Microsoft Team object type selected

  • Create private channel service

Apart from the default settings, you can click the add button to add any of the following settings to a Change private channel settings service based on your requirement, and then complete the configurations:

• Change private channel description – Allows business users to change the private channel description via requests for this service. Choose whether to Require a private channel description. With this option enabled, the private channel description will be a required field on request forms.

• Change private channel members – Choose the available actions for business users to manage private channel members via the service request.

  • Allow requesters to add members – With the checkbox selected, business users can add members to the private channel.

  • Allow requesters to remove members – With the checkbox selected, business users can remove members from the private channel.

• Change private channel name– Allows business users to change the name of the private channel via requests for this service.

• Change private channel owners – Choose the available actions for business users to manage private channel owners via the service request.

  • Allow requesters to add owners – With the checkbox selected, business users can add owners to the private channel.

  • Allow requesters to remove owners – With the checkbox selected, business users can remove owners from the private channel.

• Change private channel site storage – Allow business users to change the private channel site storage via this service request. Business users can request for more storage.

  • Allow requesters to request for more storage only when – If you select this option, configure the condition for users to request for more storage.

  • Limit the maximum storage – If you select this option, configure maximum storage that business users can request for.

  • Limit the storage amount that can be increased in a single request – If you select this option, configure the storage amount that business users can request to increase in a single request. The value cannot be greater than the maximum storage.

#Change Resource Mailbox Permission Service

A Change resource mailbox permission service allows you to define the Change resource mailbox permission service template for your business users. Business users can request to change the read and manage (full access) delegates, send as delegates, and send on behalf delegates of resource mailboxes via this service.

The Scope is the default setting of a Change resource mailbox permission service, and it is required to be configured. Choose to define the scope or inherit the scope from a previous service.

• Define scope – Define the service scope for resource mailboxes whose permissions can be changed via requests for this service. The service scope can be a Microsoft tenant or specific containers.

  • Select a tenant as the scope – Business users can submit requests for this service to change the permissions of resource.

  • Select containers as the scope – Business users can submit requests for this service to change the permissions of resource mailboxes in specific containers. Click Add to open the Select scope from tree panel, select one or more containers from the data tree, and then click Add to add the selected containers to the table.

    In the panel, you can also enter the keyword of a container in the search box to search for a container.

Apart from the scope, click the add button to add any of the following settings to a Change resource mailbox permission service based on your requirement, and then complete the configurations:

• Change read and manage (full access) – Allow business users to change the delegates who will have the "Read and manage (Full Access)" permission to open this mailbox and behave as the mailbox owner, with full access to the mailbox.

  • Choose whether to Allow requesters to change read and manage (full access) delegates. With this option enabled, select a people picker filter profile from the drop-down list to limit the people picker fields in the service request in the Cloud Governance Portal. The profile will determine what members are available in the people picker fields when changing the delegates who will have the "Read and manage (Full Access)" permission of resource mailboxes with requests for this service.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

  • Choose whether to Allow requesters to remove read and manage (full access) delegates. With this option enabled, business users can remove the delegates who will have the "Read and manage (full access)" permission of resource mailboxes.

• Change send as – Allow business users to change the delegates who will have the "Send as" permission to send emails from the resource mailbox. From the recipient’s perspective, the emails were sent by the resource mailbox.

  • Choose whether to Allow requester to change send as delegates. With this option enabled, select a people picker filter profile from the drop-down list to limit the people picker fields in the service request in the Cloud Governance Portal. The profile will determine what members are available in the people picker fields when changing send as delegates of resource mailboxes with requests for this service.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

  • Choose whether to Allow requesters to remove send as delegates.

• Change send on behalf – Allows business users to change the delegates who will have the Send on behalf permission to send emails on behalf of the resource mailbox.

  • Choose whether to Allow requesters to change send on behalf delegates. With this option enabled, select a people picker filter profile from the drop-down list to limit the people picker fields in the service request in the Cloud Governance Portal. The profile will determine what members are available in the people picker fields when changing send on behalf delegates of resource mailboxes with requests for this service.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

  • Choose whether to Allow requesters to remove send on behalf delegates.

#Change Security Group Settings Service

A Change security group settings service allows you to define the Change security group service template for your business users. Business users can request to change the group name, group description, and group visibility via this service.

The Scope is the default setting of a Change security group settings service, and it is required to be configured. Choose to define the scope or inherit the scope from a previous service.

• Define scope – Define the service scope for security groups whose settings can be changed via requests for this service. The service scope can be a Microsoft tenant or specific containers.

  • Select a tenant as the scope – Business users can submit requests for this service to change the settings of security groups in the selected tenant.

  • Select containers as the scope – Business users can submit requests for this service to change the settings of security groups in specific containers. Click Add to open the Select scope from tree panel, select one or more containers from the data tree, and then click Add to add the selected containers to the table.

    In the panel, you can also enter the keyword of a container in the search box to search for a container.

  • Choose whether to Limit the groups whose settings can be changed. With the option enabled, select a people picker filter profile from the drop-down list to limit the security groups in the service request in the Cloud Governance Portal. The profile will determine what groups are available in the people picker fields when changing security group settings with requests for this service.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

• Inherit from the previous service – If you have already added any of the following services to the flow in the previous step, you can choose this option and select the service from the drop-down list to use the scope configured for the service as the service request scope.

  • Change contact service with the security group object type selected

  • Change metadata service with the security group object type selected

  • Change ownership or membership service with the security group object type selected

Apart from the scope, you can click the add button to add any of the following settings to a Change security group settings service based on your requirement, and then complete the configurations:

• Change group description – Allow business users to change the group description via requests for this service.

  Choose whether to Require a group description. With the option selected, the group description will be a required field on the request form.

• Change group name – Allow business users to change the group name with requests for this service. Choose whether to Do not allow duplicate group names.

  Choose whether to Apply a validation rule to the group name on the request page. With this option selected, select a group name validation rule from the drop-down list to determine what rule is applied to validate the group name on the request form.

  You can click View rule details to view the details of the selected validation rule. You can also click the create button to create a new rule. For more information about how to create a validation rule, refer to Configure Text Validation Rules.

  To retrieve the latest validation rules that are available, you can click the refresh button.

• Change group visibility – Define whether you allow requesters to change the security group visibility.

#Change Shared Channel Settings Service

A Change shared channel settings service allows you to define the shared channel settings change service template for your business users. Business users can request to change the shared channel name, description, owners, members, and site storage via this service.

The following settings are the default settings of a Change shared channel settings service, and they are required to be configured:

The Scope is the default setting of a Change shared channel settings service, and it is required to be configured. Define the service scope for teams in which shared channel settings can be changed via requests for this service. Choose a Microsoft tenant or specific containers as the scope or inherit the scope from a previous service.

• Select a tenant as the scope – Business users can submit requests for this service to change settings of shared channels in teams of the selected tenant.

  Your Microsoft 365 tenant is displayed here when your tenant has a Microsoft Entra ID or Cloud Governance for Microsoft 365 app profile configured in AvePoint Online Services.

• Select containers as the scope – Business users can submit requests for this service to create shared channels for teams in specific containers. Click Add to open the Select scope from tree panel, select one or more containers from the data tree, and then click Add to add the selected containers to the table.

  In the panel, you can also enter the keyword of a container in the search box to search for a container.

• Inherit from the previous service – If you have already added any of the following services to the flow in the previous step, you can choose this option and select the service from the drop-down list to use the scope configured for the service as the service request scope.

  • Change contact service

  • Change ownership or membership service with the Microsoft Team object type selected

  • Change team profiles service

  • Change team settings service

  • Convert Microsoft 365 Group to team service

  • Create shared channel service

Apart from the default settings, you can click the add button to add any of the following settings to a Change shared channel settings service based on your requirement, and then complete the configurations:

• Change shared channel description – Allows business users to change the shared channel description via requests for this service. Choose whether to Require a shared channel description. With this option enabled, the shared channel description will be a required field on request forms.

• Change shared channel members – Choose the available actions for business users to manage shared channel members via the service request.

  • Allow requesters to add members – With the checkbox selected, business users can add members to the shared channel.

    People picker filter profile – Select a people picker filter profile from the drop-down list to determine what user is searchable and can be chosen in the end user request form. You can click View profile details to view details of your selected profile.

    You can click the create button or go to Management > Profiles & templates > People picker filter profiles to create a people picker filter profile. For more instructions, refer to Configure People Picker Filter Profiles. You can also click the refresh button to retrieve the latest available profiles.

  • Allow requesters to remove members – With the checkbox selected, business users can remove members from the shared channel.

• Change shared channel name – Allows business users to change the name of the shared channel via requests for this service.

• Change shared channel owners – Choose the available actions for business users to manage shared channel owners via the service request.

  • Allow requesters to add owners – With the checkbox selected, business users can add owners to the shared channel.

    People picker filter profile – Select a people picker filter profile from the drop-down list to determine what user is searchable and can be chosen in the end user request form. You can click View profile details to view details of your selected profile.

    You can click the create button or go to Management > Profiles & templates > People picker filter profiles to create a people picker filter profile. For more instructions, refer to Configure People Picker Filter Profiles. You can also click the refresh button to retrieve the latest available profiles.

  • Allow requesters to remove owners – With the checkbox selected, business users can remove owners from the shared channel.

• Change shared channel site storage – Allow business users to change the share channel site storage via this service request. Business users can request for more storage.

  • Allow requesters to request for more storage only when – If you select this option, configure the condition for users to request for more storage.

  • Limit the maximum storage – If you select this option, configure maximum storage that business users can request.

  • Limit the storage amount that can be increased in a single request – If you select this option, configure the storage amount that business users can request to increase in a single request. The value cannot be greater than the maximum storage.

#Change Shared Mailbox Permission Service

A Change shared mailbox permission service allows you to define the shared mailbox permission change service request template for your business users. Business users can request to change the members, send as delegates, and send on behalf delegates of shared mailboxes via this service.

The Scope is the default setting of a Change shared mailbox permission service, and it is required to be configured. Choose to define the scope or inherit the scope from a previous service.

• Define scope – Define the service scope for shared mailboxes whose permissions can be changed via requests for this service. The service scope can be a Microsoft tenant or specific containers.

  • Select a tenant as the scope – Business users can submit requests for this service to change the permissions of shared mailboxes in the selected tenant.

  • Select containers as the scope – Business users can submit requests for this service to change the permissions of shared mailboxes in specific containers. Click Add to open the Select scope from tree panel, select one or more containers from the data tree, and then click Add to add the selected containers to the table.

    In the panel, you can also enter the keyword of a container in the search box to search for a container.

• Inherit from the previous service – If you have already added a Change contact or Change metadata service to the flow in the previous step and selected Shared mailbox in the defined object type, you can choose this option and select the service from the drop-down list to use the scope configured for the service as the service request scope.

Apart from the scope, click the add button to add any of the following settings to a Change shared mailbox permission service based on your requirement, and then complete the configurations:

• Change read and manage (full access) – Allows business users to add or remove shared mailbox users with full access permission to the mailboxes. The added members will also be granted the Send as permission.

  • Choose whether to Allow requesters to add read and manage (full access) delegates. With this option enabled, select a people picker filter profile from the drop-down list to limit the people picker fields in the service request in the Cloud Governance Portal. The profile will determine what users are available in the people picker fields when adding delegates with full access permission of shared mailboxes with requests for this service.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

  • Choose whether to Allow requesters to remove read and manage (full access) delegates.

• Change send as – Allows business users to change the delegates who will have the Send as permission to send emails from the shared mailbox. From the recipient’s perspective, the emails were sent by the shared mailbox.

  • Choose whether to Allow requester to change send as delegates. With this option enabled, select a people picker filter profile from the drop-down list to limit the people picker fields in the service request in the Cloud Governance Portal. The profile will determine what members are available in the people picker fields when changing send as delegates of shared mailboxes with requests for this service.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

  • Choose whether to Allow requesters to remove send as delegates.

• Change send on behalf – Allows business users to change the delegates who will have the Send on behalf permission to send emails on behalf of the shared mailbox.

  • Choose whether to Allow requesters to change send on behalf delegates. With this option enabled, select a people picker filter profile from the drop-down list to limit the people picker fields in the service request in the Cloud Governance Portal. The profile will determine what members are available in the people picker fields when changing send on behalf delegates of shared mailboxes with requests for this service.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

  • Choose whether to Allow requesters to remove send on behalf delegates.

• Change shared mailbox permissions – Allow business users to change the permission levels assigned to users for the shared mailbox.

  NOTE

  With this setting added to the service, the following settings will no longer be available: Read and manage (full access), Send as, and Send on behalf.

  • Choose whether to Allow requesters to change permissions. With this option enabled, select a people picker filter profile from the drop-down list to limit the people picker fields in the service request in the Cloud Governance Portal. The profile will determine what members are available in the people picker fields when changing send on behalf delegates of shared mailboxes with requests for this service.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

  • Choose whether to Allow requesters to remove permissions.

#Change Shared Mailbox Settings Service

A Change shared mailbox settings service allows you to define the shared mailbox settings service template for your business users. Business users can request to change the members, send as delegates, and send on behalf delegates of shared mailboxes via this service.

The Scope is the default setting of a Change shared mailbox settings service, and it is required to be configured. Choose to define the scope or inherit the scope from a previous service.

• Define scope – Define the service scope for shared mailboxes whose settings can be changed via requests for this service. The service scope can be a Microsoft tenant or specific containers.

  • Select a tenant as the scope – Business users can submit requests for this service to change the settings of shared mailboxes in the selected tenant.

  • Select containers as the scope – Business users can submit requests for this service to change the settings of shared mailboxes in specific containers. Click Add to open the Select scope from tree panel, select one or more containers from the data tree, and then click Add to add the selected containers to the table.

    In the panel, you can also enter the keyword of a container in the search box to search for a container.

• Inherit from the previous service – If you have already added any of the following services to the flow in the previous step, you can choose this option and select the service from the drop-down list to use the scope configured for the service as the service request scope.

  • Create shared mailbox service

  • Change shared mailbox permissions service

  • Change contact service with the shared mailbox object type selected

  • Change metadata service with the shared mailbox object type selected

Apart from the scope, click the add button to add any of the following settings to a Change shared mailbox settings service based on your requirement, and then complete the configurations:

• Change automapping – With this setting added to the service, business users can change the automapping setting value for a specific shared mailbox in Cloud Governance database via this service request.

• Change automatic replies – With this setting added to the service, business users can change automatic reply settings for the shared mailbox via this service request.

• Change email forwarding – With this setting added to the service, business users can change shared mailbox email forwarding settings via this service request. Note that this setting will not take effect on hybrid shared mailboxes.

• Change external global address list – With this setting added to the service, business users can change the shared mailbox global address list via this service request. Note that this setting will not take effect on hybrid shared mailboxes.

• Change shared mailbox alias – With this setting added to the service, business users can change shared mailbox alias via this service request. Note that this setting will not take effect on hybrid shared mailboxes.

• Change multi-geo location – Choose whether to allow business users to change the shared mailbox multi-geo location via this service request.

  To enable shared mailbox provisioning in multi-geo locations, choose one of the following options and configure the corresponding settings:

  • Select specific geo locations – If you allow shared mailbox data to be stored in different geo locations, select geo locations to set the scope, and your business users will choose geo locations from the scope.

    Click Add to open the Region panel, select one or more geo locations in the panel, and then click Add to add them to the table.

    If you add more than one geo location, select a default location from the Default geo location drop-down list.

    Choose one of the following options to determine how to set the geo locations:

    • Require business users to configure this field – Business users are required to select the geo location in the request form.

    • Show this field as read-only to business users – You select the geo location and it will be displayed to business users as read-only.

    • Hide this field from business users – You select the geo location and it will not be displayed to business users.

  • Use the preferred data location of the selected user role to determine the geo location – If you do not allow your business users to choose geo locations, you can choose to retrieve the preferred data location (PDL) of the requester or primary shared mailbox contact as the geo location. Select the $Requester or $Primary contact role from the drop-down list.

    NOTE

    If the requester or primary shared mailbox contact does not have the PDL property, the shared mailbox will be created in your tenant’s central location.

• Change online archiving setting – With this setting added to the service, business users can change the shared mailbox online archive setting to via this service request, deciding whether to enable the online archive for the shared mailbox.

• Change primary email address setting – Allow business users to change the shared mailbox primary email address via requests for this service. You can also limit the domains that business users can use. This setting will not take effect on hybrid shared mailboxes.

  You can define how requesters can change the user's primary email address by selecting one of the following options:

  • Allow requesters to change the local part of primary email address – Business users can change the local part (the part before @) of primary email addresses via this service request.

  • Allow requesters to change the domain – Business users can change the domain of primary email addresses via this service request. You can define how requesters can change the domain by selecting one of the following options:

    • Manually select domain list – Select the domain for the shared mailbox email address. Then, select a domain from the drop-down list as the Default domain.

    • Retrieve domain list from a Lookup metadata – With the option selected, select a Lookup metadata from the drop-down list to retrieve the domain.

• Change sent items – With this setting added to the service, business users can change shared mailbox send items via this service request.

• Change shared mailbox name - With this setting added to the service, business users can change the shared mailbox name via this service request. This setting will not take effect on hybrid shared mailboxes.

  Do not allow duplicate shared mailbox names – With the checkbox selected, business users who submit the request via this service will not be allowed to change a shared mailbox with a name that is already in use.

• Change shared mailbox policies – You can add shared mailbox policies that requesters can change via the service request by selecting one or more of the following options:

  • Allow requesters to change the sharing policy – With this option selected, specify the sharing policies that requesters are allowed to change.

    Click Add to open the Add sharing policy panel, select one or more policies in the panel, and then click Add to add them to the table.

  • Allow requesters to change the role assignment policy – With this option selected, specify the role assignment policies that requesters are allowed to change.

    Click Add to open the Add role assignment policy panel, select one or more policies in the panel, and then click Add to add them to the table.

  • Allow requesters to change the retention policy – With this option selected, specify the retention policies that requesters are allowed to change.

    Click Add to open the Add retention policy panel, select one or more policies in the panel, and then click Add to add them to the table.

  • Allow requesters to change the address book policy – With this option selected, specify the address book policies that requesters are allowed to change.

    Click Add to open the Add address book policy panel, select one or more policies in the panel, and then click Add to add them to the table.

• Change time zone – With this setting added to the service, business users can change the shared mailbox time zone via this service request.

#Change Site Collection Profiles Service

A Change site collection profiles service allows you to define the site collection profiles change service template for your business users. Business users can request to change the site collection contact election profile, external sharing profile, renewal profile, and storage management profile via this service.

The Scope is the default setting of a Change site collection profiles service, and it is required to be configured. Choose to define the scope or inherit the scope from a previous service.

• Define scope – Define the service scope for site collections whose profiles can be changed via requests for this service. The service scope can be a Microsoft tenant or specific containers.

  • Select a tenant as the scope – Business users can submit requests for this service to change the profiles of site collections in the selected tenant.

  • Select containers as the scope – Business users can submit requests for this service to change the profiles of site collections in specific containers. Click Add to open the Select scope from tree panel, select one or more containers from the data tree, and then click Add to add the selected containers to the table.

    In the panel, you can also enter the keyword of a container in the search box to search for a container.

• Inherit from the previous service – If you have already added any of the following services to the flow in the previous step, you can choose this option and select the service from the drop-down list to use the scope configured for the service as the service request scope.

  • Change site settings service

  • Change contact service with the site collection object type selected

  • Change metadata service with the site collection object type selected

Apart from the scope, click the add button to add any of the following settings to a Change site collection profiles service based on your requirement, and then complete the configurations:

• Change contact election profile – Allow business users to change the site collection contact election profile via this service request.

  • Allow requesters to change the profile – You can choose whether to Limit the profiles that requesters can use. With this option enabled, select one or more profiles. You can also click Create to create a new site collection contact election profile.

  • Change to the following profile – Select a profile that you want to change to, and then configure how to show this field to business users:

    • Show this field as read-only to business users – You select the profile and it will be displayed to business users as read-only.

    • Hide this field from business users – You select the profile and it will not be displayed to business users.

  • Configure how to handle the site collections that have ongoing contact election tasks.

• Change external sharing profile – Allow business users to change the site collection external sharing profile via this service request.

  • Allow requesters to change the profile – You can choose whether to Limit the profiles that requesters can use. With this option enabled, select one or more profiles. You can also click Create to create a new site collection external sharing profile.

  • Change to the following profile – Select a profile that you want to change to, and then configure how to show this field to business users:

    • Show this field as read-only to business users – You select the profile, and it will be displayed to business users as read-only.

    • Hide this field from business users – You select the profile and it will not be displayed to business users.

• Change renewal profile – Allow business users to change the site collection renewal profile via this service request.

  • Allow requesters to change the profile – You can choose whether to Limit the profiles that requesters can use. With this option enabled, select one or more profiles. You can also click Create to create a new site collection renewal profile.

  • Change to the following profile – Select a profile that you want to change to, and then configure how to show this field to business users:

    • Show this field as read-only to business users – You select the profile, and it will be displayed to business users as read-only.

    • Hide this field from business users – You select the profile, and it will not be displayed to business users.

  • Configure how to handle the site collections that have ongoing renewal tasks.

• Change storage management profile – Allow business users to change the site collection storage management profile via this service request.

  • Allow requesters to change the profile – You can choose whether to Limit the profiles that requesters can use. With this option enabled, select one or more profiles. You can also click Create to create a new site collection storage management profile.

  • Change to the following profile – Select a profile that you want to change to, and then configure how to show this field to business users:

    • Show this field as read-only to business users – You select the profile, and it will be displayed to business users as read-only.

    • Hide this field from business users – You select the profile, and it will not be displayed to business users.

#Change Site Settings Service

A Change site settings service allows you to define the SharePoint site settings change service template for your business users. Business users can request to change the title, description, address, classification, storage, sensitivity label, hub settings, site template, time zone, locale, and sharing settings for SharePoint site collections and group team sites via this service.

The Scope is the default setting of a Change site settings service, and it is required to be configured. Choose to define the scope or inherit the scope from a previous service.

• Define scope – Define the service scope for sites whose settings can be changed via requests for this service. The service scope can be a Microsoft tenant or specific containers.

  • Select a tenant as the scope – Business users can submit requests for this service to change the settings of SharePoint sites in the selected tenant.

  • Select containers as the scope – Business users can submit requests for this service to change the settings of SharePoint sites in specific containers. Click Add to open the Select scope from tree panel, select one or more containers from the data tree, and then click Add to add the selected containers to the table.

    In the panel, you can also enter the keyword of a container in the search box to search for a container.

• Inherit from the previous service – If you have already added any of the following services to the flow in the previous step, you can choose this option and select the service from the drop-down list to use the scope configured for the service as the service request scope.

  • Change contact service with the Microsoft 365 Group, Microsoft Team, site collection, or Viva Engage community object type selected

  • Change metadata service with the Microsoft Group, Microsoft Team, or site collection object type selected

  • Create site collection service

  • Create team service

  • Create Microsoft 365 Group service

  • Change Microsoft 365 Group settings service

  • Change team settings service

  • Change ownership or membership service with the Microsoft Group or Microsoft Team object type selected

  • Change team profile service

Apart from the scope, click the add button to add any of the following settings to a Change site settings service based on your requirement, and then complete the configurations:

• Change site locale – Allow business users to change the site locale via this service request.

• Change time zone – Allow business users to change the site time zone via this service request.

• Change hub settings – Allow business users to change the hub settings of the site via this service request. Choose one or more of the following options to configure how to change hub settings:

  • Allow requesters to register the site as a hub site – With this option selected, specify users or groups who can associate sites with the hub.

    Choose one of the following options to determine how to set people who can associate sites with the hub:

    • Allow business uses to configure this field – Business users can select users or groups in the request form.

    • Require business users to configure this field – Business users are required to select users or groups in the request form.

    • Show this field as read-only to business users – You select users or groups, and they will be displayed to business users as read-only.

    • Hide this field from business users – You select users or groups, and they will not be displayed to business users.

  • Allow requesters to associate the site with a hub or change the hub association – With this option selected, you can define a scope of hub sites that are available for association.

    • All existing hub sites are available for association

    • Defined set of existing hub sites – You define a scope of hub sites that are available for association. Click Add to open the Add hub site panel, select a tenant to retrieve hub sites, select one or more hub sites in the panel, and then click Add to add them to the table.

      After you have added the hub sites, you can also click the delete button to remove the hub site.

    • Choose whether to Only display hub sites that the requester has permission.

  • Allow requesters to remove the hub association – With this option selected, requesters can remove the hub association.

  • Allow requesters to change hub site setting – With this option selected, you can choose whether to allow requesters to change the hub site name and people who can associate sites with the hub.

  • Allow requesters to unregister the site as a hub site – With this option selected, requesters can unregister the site as a hub site.

• Change site address – Allow business users to change the site address via this service request.

• Change site classification – Allow business users to change the site classification via this service request.

  • Select one or more site classifications that can be changed to. The classifications are retrieved from what has been created in their Microsoft 365 tenants.

  • Choose whether to Require requesters to change the original value. With this option enabled, requesters are required to change the original value of the classifications.

• Change site description – Allow business users to change the site description via this service request. You can choose whether to Require a site description. With this option enabled, the site description will be a required field on request forms.

• Change site template – Allow business users to change the site template via this service request. You can choose to Allow requesters to change site templates or Apply multiple site templates.

  • Allow requesters to change site templates – You can define whether to Limit the templates that can be used. With this option enabled, you need to click Add to add site templates to be applied to the site.

    • Site template type – Select a site template type to retrieve.

    • Select a tenant to retrieve site templates – Select a tenant to retrieve site templates and click Retrieve.

    • Select one or more retrieved site templates that you want to add to the setting and click Add.

  • Apply multiple site templates – You can add multiple site templates to be applied to the site and define the order for applying the site templates. Click Add to add site templates to be applied to the site.

    • Site template type – Select a site template type to retrieve.

    • Select a tenant to retrieve site templates – Select a tenant to retrieve site templates and click Retrieve.

    • Select one or more retrieved site templates that you want to add to the setting and click Add.

    After you have added the site templates, you can change the display order for each site template. You can also click the delete button to remove the site template.

• Change site picture – Set the site picture or allow business users to change the site picture via the service request.

  • Allow requesters to change the site picture – Allow business users to change the site picture in the request form.

  • Change to the specific picture – Click the browse button, select a picture, and click Open. The picture is uploaded, and you can preview it. The specified picture will be set as the picture of sites requested by this service.

  • Specify the site picture URL – Enter the SharePoint URL of the picture. Make sure that a Microsoft 365 (All permissions), Cloud Governance for Microsoft 365, or custom app profile has been created for the tenant that contains the picture’s parent site in AvePoint Online Services. The picture will be retrieved from the URL and set as the picture of sites requested by this service.

  • Remove the custom site picture – Custom site pictures will be removed for sites requested by this service.

• Change site sensitivity label – Allows business users to change the site sensitivity label. Select one or more sensitivity labels for the site that can be changed to via this service request.

  Choose whether to Require requesters to change the original value.

  NOTE

  Make sure that your tenant has already created and published the sensitivity labels in Microsoft 365. To allow Cloud Governance to retrieve external sharing settings of labels, configure the Cloud Governance for Exchange app and assign it the Compliance Administrator role. Without the configurations, an error task will be generated when configurations in the service requests conflict with the applied sensitivity label settings.

• Change site sharing settings – Allow business users to change the site sharing settings via this service request. Choose one or more of the following options to configure how to change site sharing settings:

  • Allow requesters to change external sharing settings

  • Allow requesters to change the domain settings for external sharing – If you select this option, business users can change the domain settings for external sharing in the service requests. You can configure the following settings:

    • Limit domains in requests – Limit the domains that business users can specify in the request form:

      • Allow only specific domains – With the option selected, enter each allowed domain on a new line. Business users can only set an allowlist which is a subset of the specified domains in the request form.

        NOTE

        If an allowlist for domains at organization level has been set with SharePoint, only this option is available, and you can specify a domain set which is a subset of your organization’s allowlist.

      • Block specific domains – With the option selected, enter each domain you want to block on a new line. Business users can set an allowlist excluding the specified domains or set more domains to be blocked additionally in the request form.

    • Only allow requesters to edit the domain list – With the option selected, business users can only edit the domain list if there is an existing allowlist or blocklist for the site. Business users can change the domain scope of the list.

  • Allow requesters to change the expiration of guest access

  • Allow requesters to change the default sharing link type

  • Allow requesters to change the default link permission

  • Allow requesters to change the expiration of Anyone links

• Limit external sharing by domain – This setting is only available when this Change site settings service scope is inherited from a previous site collection, team, Microsoft 365 Group, or Viva Engage commnity provisioning service.

  With this setting selected, configure the external sharing domain list by selecting one of the following restriction modes:

  • Allow only specific domains – With the option selected, enter each allowed domain on a new line. Business users can only set an allowlist which is a subset of the specified domains in the request form.

    NOTE

    If an allowlist for domains at organization level has been set with SharePoint, only this option is available, and you can specify a domain set which is a subset of your organization’s allowlist.

    Then, choose how to set this setting:

    NOTE

    This may be hidden based on your organization level external sharing settings.

    • Require business users to configure this field – Business users are required to configure the allowlist in the request form.

    • Show this field as read-only to business users – You configure the allowlist, and it will be displayed to business users as read-only.

    • Hide this field from business users – You configure the allowlist, and it will not be displayed to business users.

  • Block specific domains – With the option selected, enter each domain you want to block on a new line. Business users can set an allowlist excluding the specified domains or set more domains to be blocked additionally in the request form.

    Then, choose how to set this setting:

    NOTE

    This may be hidden based on your organization level external sharing settings.

    • Require business users to configure this field – Business users are required to configure the blocklist in the request form.

    • Show this field as read-only to business users – You configure the blocklist, and it will be displayed to business users as read-only.

    • Hide this field from business users – You configure the blocklist, and it will not be displayed to business users.

  Then, you can choose how you want to set this setting:

  • Allow business users to configure the domain restriction mode – Business users can choose whether to configure an allowlist or blocklist in the request form.

  • Do not allow business users to change the domain restriction mode – Business users cannot change the restriction mode in the request form.

• Change site storage – Allow business users to change the site storage via this service request. Business users can request to increase or decrease the site storage.

  • Allow requesters to change the site storage only when – If you select this option, configure in which scenario business users can request to increase or decrease the site storage.

  • Limit the maximum storage – If you select this option, configure maximum storage that business users can request for.

• Allow requesters to decrease the storage limit – Business users can decrease the storage limit via this service request.

  • Limit the storage amount that can be changed in a single request – If you select this option, configure one of the following storage amount restriction settings:

    • No more than [number] GB – The storage amount that can be changed in a single request cannot exceed the specified value.

    • Increase or decrease [number] GB each time – The storage limit can only be increased or decreased by the specified value in a single request.

• Change site title – Allow business users to change the site title via this service request.

#Change Team Profiles Service

A Change team profiles service allows you to define the team profiles change service template for your business users. Business users can request to change the team contact election profile, external sharing profile, renewal profile, and storage management profile via this service request.

The Scope is the default setting of a Change team profiles service, and it is required to be configured. Choose to define the scope or inherit the scope from a previous service.

• Define scope – Define the service scope for teams whose profiles can be changed via requests for this service. The service scope can be a Microsoft tenant or specific containers.

  • Select a tenant as the scope – Business users can submit requests for this service to change the profiles of teams in the selected tenant.

  • Select containers as the scope – Business users can submit requests for this service to change the profiles of teams in specific containers. Click Add to open the Select scope from tree panel, select one or more containers from the data tree, and then click Add to add the selected containers to the table.

    In the panel, you can also enter the keyword of a container in the search box to search for a container.

  • Choose whether to Limit the teams whose settings can be changed. With the option enabled, select a people picker filter profile from the drop-down list to limit the teams in the service request in the Cloud Governance Portal. The profile will determine what teams are available in the people picker fields when changing the profile of teams with requests for this service.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

• Inherit from the previous service – If you have already added any of the following services to the flow in the previous step, you can choose this option and select the service from the drop-down list to use the scope configured for the service as the service request scope.

  • Change contact service with the Microsoft Team object type selected

  • Change metadata service with the Microsoft Team object type selected

  • Change ownership or membership service with the Microsoft Team object type selected

  • Change team settings service

  • Convert Microsoft 365 Group to team service

Apart from the scope, click the add button to add any of the following settings to a Change team profiles service based on your requirement, and then complete the configurations:

• Change contact election profile – Allow business users to change the team contact election profile via this service request.

  • Allow requesters to change the profile – You can choose whether to Limit the profiles that requesters can use. With this option enabled, select one or more profiles. You can also click Create to create a new team contact election profile.

    • Change to the following profile – Select a profile that you want to change to, and then configure how to show this field to business users:

      • Show this field as read-only to business users – You select the profile and it will be displayed to business users as read-only.

      • Hide this field from business users – You select the profile and it will not be displayed to business users.

    • Configure how to handle the teams that have ongoing contact election tasks.

  • Change external sharing profile – Allow business users to change the team external sharing profile via this service request.

    • Allow requesters to change the profile – You can choose whether to Limit the profiles that requesters can use. With this option enabled, select one or more profiles. You can also click Create to create a new team external sharing profile.

    • Change to the following profile – Select a profile that you want to change to, and then configure how to show this field to business users:

      • Show this field as read-only to business users – You select the profile, and it will be displayed to business users as read-only.

      • Hide this field from business users – You select the profile and it will not be displayed to business users.

  • Change renewal profile – Allow business users to change the team renewal profile via this service request.

    • Allow requesters to change the profile – You can choose whether to Limit the profiles that requesters can use. With this option enabled, select one or more profiles. You can also click Create to create a new team renewal profile.

    • Change to the following profile – Select a profile that you want to change to, and then configure how to show this field to business users:

      • Show this field as read-only to business users – You select the profile, and it will be displayed to business users as read-only.

      • Hide this field from business users – You select the profile, and it will not be displayed to business users.

    • Configure how to handle the teams that have ongoing renewal tasks.

  • Change storage management profile – Allow business users to change the team storage management profile via this service request.

    • Allow requesters to change the profile – You can choose whether to Limit the profiles that requesters can use. With this option enabled, select one or more profiles. You can also click Create to create a new team storage management profile.

    • Change to the following profile – Select a profile that you want to change to, and then configure how to show this field to business users:

      • Show this field as read-only to business users – You select the profile, and it will be displayed to business users as read-only.

      • Hide this field from business users – You select the profile, and it will not be displayed to business users.

#Change Team Settings Service

A Change team settings service allows you to define the team settings change service template for your business users. Business users can request to change the team name, description, privacy, classification, guest permissions, member permissions, sensitivity label, fun stuff, Exchange global address list, @Mentions, and Outlook experience settings via this service.

The Scope is the default settings of a Change team settings service, and it is required to be configured. Choose to define the scope or inherit the scope from a previous service.

• Define scope – Define the service scope for teams whose settings can be changed via requests for this service. The service scope can be a Microsoft tenant or specific containers.

  • Select a tenant as the scope – Business users can submit requests for this service to change the settings of Microsoft Teams in the selected tenant.

  • Select containers as the scope – Business users can submit requests for this service to change the settings of Microsoft Teams in specific containers. Click Add to open the Select scope from tree panel, select one or more containers from the data tree, and then click Add to add the selected containers to the table.

    In the panel, you can also enter the keyword of a container in the search box to search for a container.

  • Choose whether to Limit the teams whose settings can be changed. With the option enabled, select a people picker filter profile from the drop-down list to limit the teams in the service request in the Cloud Governance Portal. The profile will determine what teams are available in the people picker fields when changing team settings with requests for this service.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

  • Choose whether to Allow requests for archived teams. With this option enabled, business users are allowed to submit requests to change settings of archived teams via requests for this service.

• Inherit from the previous service – If you have already added any of the following services to the flow in the previous step, you can choose this option and select the service from the drop-down list to use the scope configured for the service as the service request scope.

  • Change contact service with the Microsoft Team object type selected

  • Change metadata service with the Microsoft Team object type selected

  • Change ownership or membership service with the Microsoft Team object type selected

  • Convert Microsoft 365 Group to team service

Apart from the scope, you can click the add button to add any of the following settings to a Change team settings service based on your requirement, and then complete the configurations:

• Change @Mentions settings – Allows business users to change @Mentions settings for the team via requests for this service.

• Change Exchange global address list setting – Allows business users to change whether to hide the team from the Exchange global address list via requests for this service.

• Change fun stuff settings – Allows business users to change fun stuff settings for the team via requests for this service.

  • Choose whether to Allow requesters to change Giphy settings.

  • Choose whether to Allow requesters to change stickers and memes settings.

• Change Outlook experience settings – Allows business users to change Outlook experience settings for the team.

• Change team classification – Allows business users to change the team classification. Select one or more team classifications that can be changed to via requests for this service. The classifications are retrieved from what has been created in the Microsoft 365 tenant.

  Choose whether to Require requesters to change the original value.

• Change team description – Allows business users to change the team description via requests for this service. Choose whether to Require a team description. With this option enabled, the team description will be a required field on request forms.

• Change team guest permissions – Allow business users to change guest permissions for the team via requests for this service.

• Change team member permissions – Allows business users to change team member permissions for the team via requests for this service.

• Change team name – Allows business users to change the team name via requests for this service. Choose whether to Do not Allow duplicate team names.

• Change team picture – Set the team picture or allow business users to change the team picture via the service request.

  • Allow requesters to change the team picture – Allow business users to change the team picture in the request form.

  • Change to the specific picture – Click the browse button, select a picture, and click Open. The picture is uploaded, and you can preview it. The specified picture will be set as the picture of teams requested by this service.

  • Specify the team picture URL – Enter the SharePoint URL of the picture. Make sure that a Microsoft 365 (All permissions), Cloud Governance for Microsoft 365, or custom app profile has been created for the tenant that contains the picture’s parent site in AvePoint Online Services. The picture will be retrieved from the URL and set as the picture of teams requested by this service.

  • Remove the custom team picture – Custom team pictures will be removed for teams requested by this service.

• Change team privacy – Allows business users to change the team privacy via requests for this service.

• Change team sensitivity label – Allows business users to change the team sensitivity label. Select one or more sensitivity labels for the team that can be changed to via requests for this service.

  Choose whether to Require requesters to change the original value.

  NOTE

  Make sure that your tenant has already created and published the sensitivity labels in Microsoft 365. To allow Cloud Governance to retrieve external user access and external sharing settings of labels, configure the Cloud Governance for Exchange app and assign it the Compliance Administrator role. Without the configuration, an error task will be generated when configurations in the service requests conflict with the applied sensitivity label settings.

#Change Viva Engage Community Profiles Service

A Change Viva Engage community profiles service allows you to define the Viva Engage community profiles change service template for your business users. Business users can request to change the Viva Engage community contact election profile, external sharing profile, renewal profile, and storage management profile via this service request.

The Scope is the default setting of a Change Viva Engage community profiles service, and it is required to be configured. Choose to define the scope or inherit the scope from a previous service.

• Define scope – Define the service scope for Viva Engage communities whose profiles can be changed via requests for this service. The service scope can be a Microsoft tenant or specific containers.

  • Select a tenant as the scope – Business users can submit requests for this service to change the profiles of communities in the selected tenant.

  • Select containers as the scope – Business users can submit requests for this service to change the profiles of communities in specific containers. Click Add to open the Select scope from tree panel, select one or more containers from the data tree, and then click Add to add the selected containers to the table.

    In the panel, you can also enter the keyword of a container in the search box to search for a container.

  • Choose whether to Limit the Viva Engage community whose profiles can be changed. With the option enabled, select a people picker filter profile from the drop-down list to limit the communities in the service request in the Cloud Governance Portal. The profile will determine what communities are available in the people picker fields when changing the profile of communities with requests for this service.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

• Inherit from the previous service – If you have already added any of the following services to the flow in the previous step, you can choose this option and select the service from the drop-down list to use the scope configured for the service as the service request scope.

  • Change contact service with the Viva Engage community object type selected

  • Change metadata service with the Viva Engage community object type selected

  • Change ownership or membership service with the Viva Engage community object type selected

  • Change Viva Engage community settings

Apart from the scope, click the add button to add any of the following settings to a Change Viva Engage community profiles service based on your requirement, and then complete the configurations:

• Change contact election profile – Allow business users to change the community contact election profile via this service request.

  • Allow requesters to change the profile – You can choose whether to Limit the profiles that requesters can use. With this option enabled, select one or more profiles. You can also click Create to create a new community contact election profile.

  • Change to the following profile – Select a profile that you want to change to, and then configure how to show this field to business users:

    • Show this field as read-only to business users – You select the profile and it will be displayed to business users as read-only.

    • Hide this field from business users – You select the profile and it will not be displayed to business users.

  • Configure how to handle the communities that have ongoing contact election tasks.

• Change external sharing profile – Allow business users to change the community external sharing profile via this service request.

  • Allow requesters to change the profile – You can choose whether to Limit the profiles that requesters can use. With this option enabled, select one or more profiles. You can also click Create to create a new community external sharing profile.

  • Change to the following profile – Select a profile that you want to change to, and then configure how to show this field to business users:

    • Show this field as read-only to business users – You select the profile, and it will be displayed to business users as read-only.

    • Hide this field from business users – You select the profile and it will not be displayed to business users.

• Change renewal profile – Allow business users to change the community renewal profile via this service request.

  • Allow requesters to change the profile – You can choose whether to Limit the profiles that requesters can use. With this option enabled, select one or more profiles. You can also click Create to create a new community renewal profile.

  • Change to the following profile – Select a profile that you want to change to, and then configure how to show this field to business users:

    • Show this field as read-only to business users – You select the profile, and it will be displayed to business users as read-only.

    • Hide this field from business users – You select the profile, and it will not be displayed to business users.

  • Configure how to handle the communities that have ongoing renewal tasks.

• Change storage management profile – Allow business users to change the community storage management profile via this service request.

  • Allow requesters to change the profile – You can choose whether to Limit the profiles that requesters can use. With this option enabled, select one or more profiles. You can also click Create to create a new community storage management profile.

  • Change to the following profile – Select a profile that you want to change to, and then configure how to show this field to business users:

    • Show this field as read-only to business users – You select the profile, and it will be displayed to business users as read-only.

    • Hide this field from business users – You select the profile, and it will not be displayed to business users.

#Change Viva Engage Community Settings Service

A Change Viva Engage community settings service allows you to define the Change Viva Engage community settings service template for your business users. Business users can request to change the community name, description, privacy, classification, sensitivity label, Exchange global address list, and Outlook experience settings via this service.

The Scope is the default setting of a Change Viva Engage community settings service, and it is required to be configured. Choose to define the scope or inherit the scope from a previous service.

• Define scope – Define the service scope for Viva Engage communities whose settings can be changed via requests for this service. The service scope can be a Microsoft tenant or specific containers.

  • Select a tenant as the scope – Business users can submit requests for this service to change the settings of Viva Engage communities in the selected tenant.

  • Select containers as the scope – Business users can submit requests for this service to change the settings of Viva Engage communities in specific containers. Click Add to open the Select scope from tree panel, select one or more containers from the data tree, and then click Add to add the selected containers to the table.

    In the panel, you can also enter the keyword of a container in the search box to search for a container.

  • Choose whether to Limit the Viva Engage community whose settings can be changed. With the option enabled, select a people picker filter profile from the drop-down list to limit the Viva Engage communities in the service request in the Cloud Governance Portal. The profile will determine what communities are available in the people picker fields when changing Viva Engage community settings with requests for this service.

    You can click View profile details to view the details of the selected people picker filter profile. You can also click the create button to create a new profile. For more information about how to create a people picker filter profile, refer to Configure People Picker Filter Profiles.

    To retrieve the latest people picker filter profiles that are available, you can click the refresh button.

• Inherit from the previous service – If you have already added any of the following services to the flow in the previous step, you can choose this option and select the service from the drop-down list to use the scope configured for the service as the service request scope.

  • Change contact service with the Viva Engage community object type selected

  • Change metadata service with the Viva Engage community object type selected

  • Change Viva Engage community profiles service

  • Change ownership or membership service with the Viva Engage community object type selected

Apart from the scope, you can click the add button to add any of the following settings to a Change Viva Engage community settings service based on your requirement, and then complete the configurations:

• Change community classification – Allow business users to change the community classification via this service request.

  Select one or more community classifications that can be changed to. The classifications are retrieved from what has been created in your Microsoft 365 tenant.

  Choose whether to Require requesters to change the original value. With this option enabled, requesters are required to change the original value of the classifications.

• Change community description – Allow business users to change the community description via this service request.

  Choose whether to Require a community description. With this option enabled, the community description will be a required field on request forms.

• Change community name – Allow business users to change the community name via this service request.

  Choose whether to Apply a validation rule to the community name on the request page. With this option selected, select a community name validation rule from the drop-down list to determine what rule is applied to validate the community name on the request form.

  You can click View rule details to view the details of the selected validation rule. You can also click the create button to create a new rule. For more information about how to create a validation rule, refer to Configure Text Validation Rules.

  To retrieve the latest validation rules that are available, you can click the refresh button.

• Change community privacy – Allow business users to change the community privacy via this service request.

• Change community sensitivity label – Allow business users to change the community sensitivity label. Select one or more sensitivity labels for the community that can be changed to via this service request.

  Choose whether to Require requesters to change the original value.

  NOTE

  Make sure that your tenant has already created and published the sensitivity labels in Microsoft 365. To allow Cloud Governance to retrieve external user access and external sharing settings of labels, configure the Cloud Governance for Exchange app and assign it the Compliance Administrator role. Without the configuration, an error task will be generated when configuration in the service requests conflict with the applied sensitivity label settings.

• Change Exchange global address list setting – Allow business users to change whether to hide the community from the Exchange global address list via this service request.

• Change Outlook experience settings – Allow business users to change whether to hide the community from the Outlook client via this service request.

#Manage Microsoft 365 Licenses Service

A Manage Microsoft 365 licenses service allows you to configure the manage Microsoft 365 licenses service template for your business users. Business users can request to change Microsoft 365 licenses and apps or assign a defined set of Microsoft 365 licenses and apps to users via this service.

The following settings are the default settings of a Manage Microsoft 365 licenses service, and they are required to be configured:

• Scope – Define the scope for users whose Microsoft 365 licenses can be managed via requests for this service. Select a Microsoft 365 tenant and then define the request scope and mode.

  • Microsoft 365 tenant – Select the Microsoft 365 tenant in which Microsoft 365 licenses of users can be managed via this service request.

  • Service request scope – Define containers of the Microsoft 365 tenant in which Microsoft 365 licenses of users can be managed via this service request.

    • All containers – Business users can submit requests for this service to change Microsoft 365 licenses of users in all containers.

    • Specific containers – Business users can submit requests for this service to change Microsoft 365 licenses of users in specific containers. With this option selected, click Add to open the Select scope from tree panel, select one or more containers from the data tree, and then click Add to add the selected containers to the table.

      In the panel, you can also enter the keyword of a container in the search box to search for a container.

  • Mode – Define the mode of this service request.

    • Allow requesters to manage licenses and apps for a single user – Business users can submit requests for this service to change Microsoft 365 licenses and apps of a single user.

    • Allow requesters to manage licenses and apps for multiple users – Business users can submit requests for this service to change Microsoft 365 licenses and apps of multiple users.

    • Choose whether to Limit the users whose licenses and apps can be managed. With this option enabled, select a people picker filter profile from the drop-down list to limit the users in the service request in the Cloud Governance Portal. The profile will determine what users are available in the people picker fields when changing Microsoft 365 licenses with requests for this service.

      You can click View profile details to view details of your selected profile. You can click the create button or go to Management > Profiles & templates > People picker filter profiles to create a people picker filter profile. For more instructions, refer to Configure People Picker Filter Profiles.

      To retrieve the latest people picker filter profiles that are available, you can also click the refresh button.

• Manage licenses and apps – Define whether you allow requesters to change licenses and apps or assign a defined set of licenses and apps, and configure the corresponding settings.

  • Allow requesters to change licenses and apps – Business users can submit requests for this service to change Microsoft 365 licenses and apps of users.

    Choose whether to Limit the licenses and apps that can be changed. With this option selected, click Add to open the Add license and app panel, select a license from the drop-down list, and then select one or more apps. Click Add to add the selected license and apps to the table.

    In the panel, you can also enter the keyword of an app in the search box to search for an app.

  • Allow requesters to assign a defined set of licenses and apps – Business users can submit requests for this service to assign a defined set of Microsoft 365 licenses and apps to users.

    • Change to the following licenses and apps – Business users can submit requests for this service to change licenses and apps of users to a defined set. With the option selected, click Add to open the Add license and app panel, select a license from the drop-down list, and then select one or more apps. Click Add to add the selected license and apps to the table.

      In the panel, you can also enter the keyword of an app in the search box to search for an app.

    • Append the following licenses and apps – Business users can submit requests for this service to append a defined set of licenses and apps to users. With the option selected, click Add to open the Add license and app panel, select a license from the drop-down list, and then select one or more apps. Click Add to add the selected license and apps to the table.

      In the panel, you can also enter the keyword of an app in the search box to search for an app.

  • Choose whether to Assign the following location to users without locations. With this option enabled, select a location from the drop-list and users in this service requests without locations will be assigned with the selected location.

#Manage Permissions Service

A manage permissions service allows you to define the manage permissions service request template for your business users. Business users can request to grant permissions, manage existing permissions, manage SharePoint groups, and manage sharing links of SharePoint objects via this service.

The Scope is the default setting of a manage permissions service, and it is required to be configured. Choose to define the scope or define a URL as the scope.

• Define Scope – Define the service scope for SharePoint objects whose permissions can be managed via requests for this service. The service scope can be a Microsoft tenant or specific containers.

  • Object type – Define the object types from the drop-down list. Business users can submit requests for this service to manage permissions of the object types in the defined scope.

  • Scope – The scope can be a Microsoft 365 tenant or specific containers.

    • Select a tenant as the scope – Business users can submit requests for this service to manage permissions of SharePoint objects in the selected tenant.

    • Select containers as the scope – Business users can submit requests for this service to manage permissions of SharePoint objects in specific containers. Click Add to open the Select scope from tree panel, select one or more containers from the data tree, and then click Add to add the selected containers to the table.

      In the panel, you can also enter the keyword of a container in the search box to search for a container.

      Choose whether to Allow requesters to select an object from the scope. With this checkbox selected, business users can select the target object from the scope on the request page.

  • Do not automatically truncate home page URLs and allow requesters to manage home page permissions – Define whether home page permissions can be managed via this service request. With this option enabled, home page URLs of site collections and subsites will not be automatically truncated, which allows business users to manage the home page permissions.

• Define a URL as the scope – Enter the URL of a specific SharePoint object whose permissions can be managed via requests for this service. The object can be a SharePoint site, library, list, folder, document, and item.

• Inherit from the previous service – If you have already added any of the following services to the flow in the previous step, you can choose this option and select the service from the drop-down list to use the scope configured for the service as the service request scope.

  • Create Microsoft 365 Group service

  • Create library

  • Create team service

  • Create Viva Engage community service

  • Change contact service with site collection, Microsoft Team, Microsoft 365 Group, or Viva Engage community object type selected

  • Change library settings service

  • Change metadata service with site collection, Microsoft Team, Microsoft 365 Group, or Viva Engage community object type selected

  • Change Microsoft 365 Group profiles service

  • Change Microsoft 365 Group settings service

  • Change ownership or membership service with site collection, Microsoft Team, or Microsoft 365 Group object type selected

  • Change site collection profiles service

  • Change site settings service

  • Change team profiles service

  • Change team settings service

  • Convert Microsoft 365 Group to team service

Apart from the scope, you can click the add button to add any of the following settings to a manage permissions service based on your requirement, and then complete the configurations:

#Grant permissions

Allows business users to grant permanent and temporary permissions to requested SharePoint objects.

• Allow requesters to grant permanent permissions – Business users can submit requests for this service to grant permanent permissions.

  With this checkbox selected, you can select a people picker filter profile from the drop-down list to determine the users and Microsoft Entra groups to which business users can grant permanent permissions in the request form. You can click View profile details to view details of your selected profile.

  You can click the create button or go to Management > Profiles & templates > People picker filter profiles to create a people picker filter profile. For more instructions, refer to Configure People Picker Filter Profiles. You can also click the refresh button to retrieve the latest available profiles.

  Do not allow requesters to grant permanent permissions to specific object levels – With this checkbox selected, select object levels from Top-level site, Subsite, List and library, Folder, and Document and item, and business users are not allowed to grant permanent permissions to objects of the selected levels.

  Grant permission method – Define how business users can grant object permissions.

  • Allow requester to grant permissions directly – Business users can grant permanent permissions on the requested object to users and Microsoft Entra groups directly. With the checkbox selected, configure the following settings:

    • Permission levels – Choose how permission levels are granted to objects.

      • Allow requesters to select permission levels – Business users can select the permission levels to be granted to users and Microsoft Entra groups.

      • Allow requesters to grant a defined set of permission levels – Business users assign the defined set of permission levels to users and Microsoft Entra groups. With this option selected, select the permission levels to be granted.

    • Define how to handle objects with inherited permissions – Choose how permissions are granted for objects with inherited permissions.

      • Automatically stop inheriting permissions and copy permissions from parent, and requesters can then grant new permissions

      • Do not allow requesters to grant permissions

  • Allow requesters to add members to SharePoint groups – Business users can add users and Microsoft Entra groups to SharePoint groups to inherit permissions to the requested object from the group. The new group members will also inherit permissions to all objects that the group has permissions.

    • SharePoint groups – Define SharePoint groups to which new members can be added.

      • Allow requesters to select SharePoint groups – Business users can select the SharePoint group to add members.

        With this option selected, you can choose to Exclude specific SharePoint groups from the request page and enter each SharePoint group name in a separate line. You can also enter $SiteName to automatically add the site title as the group name prefix, or enter $AssociatedOwnerGroup, $AssociatedMemberGroup, or $AssociatedVisitorGroup to add the corresponding SharePoint group name. The defined SharePoint groups are excluded from the request page. Business users cannot add members to the groups via this service request.

      • Specify the SharePoint group to add members – With this option selected, enter the SharePoint group name. Business users can only add members to the defined group via this service request.

    • Define how to handle objects with inherited permissions – Define the SharePoint groups to which business users are allowed to add members for objects with inherited permissions.

      • Do not load any SharePoint groups

      • Load SharePoint groups from parent with unique permissions

• Allow requesters to grant temporary permissions – Business users can submit requests for this service to grant temporary permissions.

  NOTE

  Each time temporary permissions are granted, a corresponding temporary permission group is created. Cloud Governance suggests not to change the temporary permission groups in SharePoint or anywhere. The temporary permission groups will be automatically deleted from SharePoint when the temporary permissions expire.

  With this checkbox selected, you can select a people picker filter profile from the drop-down list to determine the users and Microsoft Entra groups to which business users can grant temporary permissions in the request form. You can click View profile details to view details of your selected profile.

  You can click the create button or go to Management > Profiles & templates > People picker filter profiles to create a people picker filter profile. For more instructions, refer to Configure People Picker Filter Profiles. You can also click the button to retrieve the latest available profiles.

  Do not allow requesters to grant temporary permissions to specific object levels – With this checkbox selected, select object levels from Top-level site, Subsite, List and library, Folder, and Document and item, and business users are not allowed to grant temporary permissions to objects of the selected levels.

  • Permission levels – Choose how permission levels are granted to objects.

    • Allow requesters to select permission levels – Business users can select the permission levels to be granted to users and Microsoft Entra groups.

    • Allow requesters to grant a defined set of permission levels – Business users assign the defined set of permission levels to users and Microsoft Entra groups. With this option selected, select the permission levels to be granted.

  • Define how to handle objects with inherited permissions – Choose how permissions are granted for objects with inherited permissions.

    • Automatically stop inheriting permissions and copy permissions from parent, and requesters can then grant new permissions

    • Do not allow requesters to grant permissions

  • Permission expiration settings – Define the permission duration settings for the temporary permissions.

    • Allow requesters to define the duration – Business users can define the permission duration when granting temporary permissions.

      With this option selected, you can define the default duration. Enter a number in the text box and select Days, Weeks, Months, or Years as the unit of time.

      You can also define a maximum permission duration within which business users can define the permission duration. Choose The permission duration cannot be longer than checkbox, and then enter a number in the text box and select Days, Weeks, Months, or Years as the unit of time.

    • Use the predefined duration – With this option selected, enter a number in the text box and select Days, Weeks, Months, or Years as the unit of time. The defined duration is used as the temporary permission duration.

    Choose whether to Remind users who are granted permissions about the permission expiration. With the checkbox selected, enter a number in the text box and select Days, Weeks, Months, or Years as the unit of time in the In advance by field. Then, select an email template from the drop-down list.

• In Advanced setting, choose whether to Display existing permissions as read-only if requesters can only grant permissions. Enable this setting to display existing permissions as read-only if requesters are only allowed to grant permissions to objects. Otherwise, existing permissions will be hidden.

#Grant predefined permissions

With this setting, IT administrators can predefine a set of permissions and the permissions will be granted to objects requested by this service.

To add predefined permissions, click Add and the Add predefined permissions panel appears. Complete the following information in the panel:

1. Users or Microsoft Entra groups – Enter the name or email address of a user or Microsoft Entra group, or enter $ to select from supported user roles to whom you want to grant permission to objects. You can add multiple users, Microsoft Entra groups, and user roles to grant them the same permission in batch.

   NOTE

   The following user roles are supported: $Requester, $Manager of requester, $Primary contact, $Secondary contact.

2. Grant permission method – Choose how permissions will be granted to the specified users and groups.

   • Grant permission directly – Select one or more permission levels. If the selected permission levels do not exist in the SharePoint site associated with the object, they’ll be created based on the corresponding permission level profiles configured in Cloud Governance.

   • Add to SharePoint group – Enter the SharePoint group name to which you want to add the specified users and group and let them inherit permissions to the object. You can also enter the $SiteName to automatically add the site title as the group name prefix, or enter $AssociatedOwnerGroup, $AssociatedMemberGroup, or $AssociatedVisitorGroup to add the corresponding SharePoint group name. With this role specified, the corresponding site title will be automatically set as the group name prefix.

   • Add as site admin – The specified users and groups will be added as site admins.

     NOTE

     This setting only takes effect when the requested object is a top-level site.

3. Click Add to list. The permissions will be added to the Permissions table.

4. For existing permissions on the Permissions table, the following actions are available:

   • Click the edit button to edit the permission and click Add to list when you finish.

   • Click the delete button to delete an existing permission.

#Manage existing permissions

Allow business users to manage existing permissions of users and Microsoft Entra groups on the requested object.

• Allow requester to manage temporary permissions – Choose how temporary permissions are displayed and managed by business users.

  NOTE

  Each time temporary permissions are granted, a corresponding temporary permission group is created. Cloud Governance suggests not to change the temporary permission groups in SharePoint or anywhere. The temporary permission groups will be automatically deleted from SharePoint when the temporary permissions expire.

  • Individual user/Microsoft Entra group – Choose to display all users and Microsoft Entra groups to business users to manage their temporary permissions individually on the requested object.

  • Temporary permission group – Choose to display all temporary permission groups to business users to manage temporary permissions on the requested object by group. Business users can add members to temporary permission groups to inherit temporary permissions on the requested object or remove members to remove temporary permissions inherited from the groups.

• Allow requesters to edit permissions – Business users can edit existing permissions on the requested object via this service request.

  • Edit temporary permission settings – If the Allow requesters to manage temporary permissions checkbox is selected, you can define how you allow temporary permissions to be edited.

    • Allow requesters to edit permission levels of temporary permissions – Business users can edit the permission levels of temporary permissions via this service request.

    • Allow requesters to edit the end date of temporary permissions – Business users can edit the end date of temporary permissions via this service request.

      With the checkbox selected, you can define the maximum duration within which the temporary permissions can be extended. Choose The end date cannot be extended longer than checkbox, and then enter a number in the text box and select Days, Weeks, Months, or Years as the unit of time.

  • Manage permission inheritance – Defined how permission inheritance is managed.

    • Allow requesters to break permission inheritance from parent object – Business users can break permission inheritance from the parent object via this service request. With this option selected, select one of the following to define the breaking permission inheritance method.

    • Stop inheriting permissions and copy the existing permissions from parent

    • Stop inheriting permissions and remove the inherited permissions

    • Allow requesters to copy or remove the inherited permission – Business users can choose to copy or remove the inherited permissions when the permission inheritance is broken.

    • Allow requesters to delete unique permissions – Business users can delete unique permissions on objects via this service request.

• Allow requesters to remove permissions – Business users can remove existing permissions on the requested object via this service request.

  Choose whether to Allow requesters to remove users and Microsoft Entra groups from SharePoint sites. With this checkbox selected, business users can remove users and Microsoft Entra groups from SharePoint site and the users’ and groups’ permissions to all objects in the SharePoint site will be removed together.

#Manage permission levels

Manage the permissions levels to be displayed on request pages.

• Choose whether to Exclude specific permission levels. With this checkbox selected, you can select the permission levels to be excluded. These permission levels are hidden when business users grant permissions to objects.

  • Do you want to hide objects with the excluded permissions – Choose whether to hide objects with the excluded permissions from the request page. If No is selected, choose how you want to manage the excluded permissions.

    • Allow requesters to remove excluded permissions – Business users can remove the excluded permissions in the request form.

    • Display excluded permissions as read-only – The excluded permissions will be read-only and not editable in the request form.

  • Permission levels – Select the permission levels to be excluded.

• Choose whether to Hide SharePoint groups without permissions for site collections. With this checkbox selected, SharePoint groups without permissions will be hidden when business users manage permissions of site collections.

• Choose whether to Allow requesters to use custom permission levels predefined in Cloud Governance. With this checkbox selected, select the custom permission levels to be used in this service request.

  NOTE

  The permission levels displayed are retrieved from Profiles & templates > Permission level profiles. If you have custom permission levels, refer to Configure Permission Level Profiles to add the permission levels first.

#Manage SharePoint groups

Allow business users to manage SharePoint groups that have permissions to the requested object.

• Allow requesters to create SharePoint groups – Business users can create SharePoint groups via this service request.

  • Group name – Allow business users to configure the group name.

  • Description – Enter the group description.

    Choose one of the following options to determine how to set the group description:

    • Allow business users to configure this field – Business users can enter the group description in the request form.

    • Require business users to configure this field – Business users are required to enter the group description in the request form.

    • Show this field as read-only to business users – You enter the group description, and it will be displayed to business users as read-only.

    • Hide this field from business users – You enter the group description, and it will not be displayed to business users.

  • SharePoint group owner – Choose to assign a Microsoft 365 user or SharePoint group as the SharePoint group owner.

    • Microsoft 365 user – Enter a username or enter $ to select from the following roles: $Requester, $Manager of requester, $Primary contact, $Secondary contact, or $Primary site collection administrator.

      NOTE

      If the $Primary site collection administrator role is selected and it is held by a group, a user from the group will be randomly selected and assigned as the owner of new SharePoint groups created via the service requests.

      With this option selected, select a people picker filter profile from the drop-down list to determine the Microsoft 365 users that business users can specify as the group owner in the request form. You can click View profile details to view details of your selected profile.

      You can click the create button or go to Management > Profiles & templates > People picker filter profiles to create a people picker filter profile. For more instructions, refer to Configure People Picker Filter Profiles. You can also click the refresh button to retrieve the latest available profiles.

    • SharePoint group – Enter the group name. You can also enter $SiteName to automatically add the site title as the group name prefix, or enter $AssociatedOwnerGroup, $AssociatedMemberGroup, or $AssociatedVisitorGroup to add the corresponding SharePoint group name.

    Choose one of the following options to determine how to set the group owner:

    • Require business users to configure this field – Business users are required to specify the group owner in the request form.

    • Show this field as read-only to business users – You specify the group owner, and the owner will be displayed to business users as read-only.

    • Hide this field from business users – You specify the group owner, and the owner will not be displayed to business users.

  • SharePoint group members – Specify the group members.

    With this option selected, select a people picker filter profile from the drop-down list to determine the users and Microsoft Entra groups that business users can specify as the group members in the request form. You can click View profile details to view details of your selected profile.

    You can click the create button or go to Management > Profiles & templates > People picker filter profiles to create a people picker filter profile. For more instructions, refer to Configure People Picker Filter Profiles. You can also click the refresh button to retrieve the latest available profiles.

    To add group members, click Add group members, and then enter usernames, enter $ to select user roles, or enter Microsoft Entra group names to add one or more users and groups as SharePoint group members in the Add group members window. When you finish adding members, click OK to add them to the table.

    For each user, user role, or group added to the table, you can enforce permissions by selecting the checkbox under the Enforce permission column in the table. With the checkbox selected, business users cannot remove the user or group, or change the user’s or group’s permissions. Then, you can choose to hide the enforced user or group from the request page by selecting the checkbox under the Hide column in the table.

    Choose one of the following options to determine how to set the group members:

    • Allow business users to configure this field – Business users can specify the group members in the request form.

    • Require business users to configure this field – Business users are required specify the group members in the request form.

    • Show this field as read-only to business users – You specify the group members and they will be displayed to business users as read-only.

    • Hide this field from business users – You specify the group members and they will not be displayed to business users.

  • Who can view the membership of the group – Choose Group members or Everyone to be allowed to view the membership of the group.

    Choose one of the following options to determine how to set the group setting:

    • Require business users to configure this field – Business users are required to select an option for this group setting in the request form.

    • Show this field as read-only to business users – You select an option for this group setting and it will be displayed to business users as read-only.

    • Hide this field from business users – You select an option for this group setting and it will not be displayed to business users.

  • Who can edit the membership of the group – Choose Group owner or Group members to be allowed to edit the membership of the group.

    Choose one of the following options to determine how to set the group setting:

    • Require business users to configure this field – Business users are required to select an option for this group setting in the request form.

    • Show this field as read-only to business users – You select an option for this group setting and it will be displayed to business users as read-only.

    • Hide this field from business users – You select an option for this group setting and it will not be displayed to business users.

  • Membership requests – Define the following membership request settings.

    • Allow requests to join or leave the group – Choose Yes or No to define whether requests to join or leave the group within SharePoint are allowed.

    • Automatically accept requests – If requests to join or leave the group are allowed, choose Yes or No to define whether these requests are automatically accepted.

    • Send membership requests to the following email address – If the requests are not automatically accepted, enter an email address to receive membership requests in the text box.

    Choose one of the following options to determine how to set the membership requests:

    • Require business users to configure this field – Business users are required configure the membership request settings in the request form.

    • Show this field as read-only to business users – You configure the membership request settings and they will be displayed to business users as read-only.

    • Hide this field from business users – You configure the membership request settings and they will not be displayed to business users.

  • Group permissions – Define how permissions are granted to SharePoint groups.

    • Allow requesters to select group permissions – Business users can select permissions for the group in the request form.

    • Assign a defined set of group permissions – Business users can only assign the set of predefined permissions to the group in the request form. With this option selected, select the permissions to be granted.

• Allow requesters to change SharePoint group settings – Business users can change SharePoint group settings via this service request.

  • Allow requesters to change the group name – Business users can change the group name via this service request.

  • Allow requesters to change the group description – Business users can change the group description via this service request.

  • Allow requesters to change group owners- Business users can change group owners via this service request.

    With this checkbox selected, select a people picker filter profile from the drop-down list to determine the users and SharePoint groups that business users can specify as group owners in the request form. You can click View profile details to view details of your selected profile.

    You can click the create button or go to Management > Profiles & templates > People picker filter profiles to create a people picker filter profile. For more instructions, refer to Configure People Picker Filter Profiles. You can also click the refresh button to retrieve the latest available profiles.

  • Allow requesters to change who can view the membership of the group – Business users can change who can view the membership of the group via this service request.

  • Allow requesters to change who can edit the membership of the group – Business users can change who can edit the membership of the group via this service request.

  • Allow requesters to change membership requests settings – Business users can change membership requests settings via this service request.

• Allow requesters to manage SharePoint group members – Business users can add and remove members from SharePoint groups via this service request.

  • Allow requesters to add new members – Business users can add new members to SharePoint groups via this service request.

  With this checkbox selected, select a people picker filter profile from the drop-down list to determine the users and Microsoft Entra groups that business users can add as group member in the request form. You can click View profile details to view details of your selected profile.

  You can click the create button or go to Management > Profiles & templates > People picker filter profiles to create a people picker filter profile. For more instructions, refer to Configure People Picker Filter Profiles. You can also click the refresh button to retrieve the latest available profiles.

  • Allow requesters to remove members from groups – Business users can remove members from SharePoint groups via this service request.

• Allow requesters to manage SharePoint group permissions to the requested object – Business users can grant, edit, and remove group permissions to the requested object via this service request.

  • Allow requesters to grant permissions to existing groups – Business users can grant permissions to existing SharePoint groups via this service request.

  • Allow requesters to edit group permissions – Business users can edit existing permissions of SharePoint groups via this service request.

  • Allow requesters to remove group permissions – Business users can remove existing permissions from SharePoint groups via this service request.

• Allow requesters to delete SharePoint groups – Business users can delete SharePoint groups via this service request.

• Exclude specific SharePoint groups from the request page – Enter the SharePoint group names. You can also enter the $SiteName role, or enter $AssociatedOwnerGroup, $AssociatedMemberGroup, or $AssociatedVisitorGroup to add the corresponding SharePoint group name. With this role specified, the corresponding site title will be automatically set as the group name prefix. The defined SharePoint groups are excluded from the request page and cannot be managed via this service request.

#Manage sharing links

Define whether you allow business users to view sharing links only or manage sharing links of SharePoint objects.

Allow requesters to:

• View sharing links only – Business users can only view sharing links of the requested object on request pages. The sharing links are read-only and not editable.

• Manage sharing links – Business users to manage sharing links of the requested object on request pages. With this option selected, select the actions that business users are allowed to perform:

  • Allow requesters to edit the permission of “People you choose” sharing links – Business users can edit the permission shared via “People you choose” sharing links via this service request.

  • Allow requesters to edit members of “People you choose” sharing links– Business users can edit the specified users and groups for “People you choose” sharing links via this service request.

    • Allow requesters to specify users and Microsoft Entra groups for sharing links – Business users can specify users and Microsoft Entra groups for sharing links via this service request.

      With this checkbox selected, select a people picker filter profile from the drop-down list to determine the users and Microsoft Entra groups that business users can specify for sharing links in the request form. You can click View profile details to view details of your selected profile.

      You can click the create button or go to Management > Profiles & templates > People picker filter profiles to create a people picker filter profile. For more instructions, refer to Configure People Picker Filter Profiles. You can also click the refresh button to retrieve the latest available profiles.

    • Allow requesters to remove the users’ or Microsoft Entra groups’ access from sharing links – Business users can remove specified users and Microsoft Entra groups to remove their access from sharing links via this service request.

  • Allow requesters to remove sharing links – Business users can remove sharing links via this service request. Once removed, sharing links will not work for anyone.

#Manage site admins

Allows business users to manage site admins or exclude specific users and groups from being added or managed as site admins. Business users can only manage site admins via requests for the service when the requested object is a top-level site.

• Allow requesters to add site admins – Business users can submit request for this service to add site admins.

  • Allow requesters to add permanent site admins – Allow business users to add permanent site admins.

    With this checkbox selected, you can select a people picker filter profile from the drop-down list to determine the users and Microsoft Entra groups who can be added as permanent site admins in the request form. You can click View profile details to view details of your selected profile.

    You can click the create button or go to Management > Profiles & templates > People picker filter profiles to create a people picker filter profile. For more instructions, refer to Configure People Picker Filter Profiles. You can also click the refresh button to retrieve the latest available profiles.

    Choose whether to Notify new site admins. With this checkbox selected, select an email template from the drop-down list.

  • Allow requesters to add temporary site admins – Allow business users to add temporary site admins. An assignment duration will be configured for the temporary site admins and the role will expire when the duration ends.

    With this checkbox selected, you can select a people picker filter profile from the drop-down list to determine the users and Microsoft Entra groups who can be added as temporary site admins in the request form. You can click View profile details to view details of your selected profile.

    You can click the create button or go to Management > Profiles & templates > People picker filter profiles to create a people picker filter profile. For more instructions, refer to Configure People Picker Filter Profiles. You can also click the refresh button to retrieve the latest available profiles.

    Temporary site admin expiration settings – Define the temporary site admin duration that control when will the added temporary site admin role expire or allow business users to configure this in the request form.

    • Allow requesters to define the duration – Business users can define the temporary site admin duration when adding the temporary site admins.

      With this option selected, you can define the default duration. Enter a number in the text box and select Days, Weeks, Months, or Years as the unit of time.

      You can also define a maximum assignment duration within which business users can define the temporary site admin duration. Choose The assignment duration cannot be longer than checkbox, and then enter a number in the text box and select Days, Weeks, Months, or Years as the unit of time.

    • Use the predefined duration – With this option selected, enter a number in the text box and select Days, Weeks, Months, or Years as the unit of time. The define duration is used as the temporary site admin duration.

    Choose whether to Remind temporary site admins about the role expiration. With the checkbox selected, enter a number in the text box and select Days, Weeks, Months, or Years as the unit of time in the In advance by field. Then, select an email template from the drop-down list.

• Allow requesters to remove site admins – Business users can submit request for this service to remove site admins.

• Allow requester to change the primary site admin – Business users can submit request for this service to change the primary site admin. The original primary site admin will be demoted to an additional site admin once changed.

• Exclude specific users and groups from the request page – Prevent specific users and groups from being added or managed as site admins by excluding them from the request page. With this option selected, specify the user or group (Microsoft 365 Group, security group, mail-enabled security group).

  Choose whether to Exclude the owners group for group team site. With this option selected, the owners group for the group, team, or community associated with the site will be excluded from the request form.

#Show Microsoft Entra group members

With this setting selected, business users can click the Microsoft Entra group name links on the permission table to view the group members.

#Welcome email

Define whether to send a welcome email to users and Microsoft Entra groups with newly granted permissions. The welcome email is not available for users and groups whose permissions are granted via sharing links.

• Send a welcome email to new users and groups – Choose Yes or No to define whether to send a welcome email to new users and Microsoft Entra groups.

  Choose one of the following options to determine how to set the welcome email:

  • Require business users to configure this field – Business users are required to select whether to send a welcome email to new users and groups in the request form.

  • Show this field as read-only to business users – You select whether to send a welcome email to new users and groups and the selection will be displayed to business users as read-only.

  • Hide this field from business users – You select whether to send a welcome email to new users and groups and the selection will not be displayed to business users.

• Select an email template – Select an email template from the drop-down list which will be used to send welcome emails.