30-second answer
Get-SPOTenantCdnEnabled -CdnType Public
Get-SPOOrgAssetsLibraryEnabling the brand center requires Public CDN. Restricting the brand center site establishes who can administer the assets. For fonts it does not establish who can reach them: Microsoft documents that published font files and the generated font catalog are stored publicly and are reachable by anyone who obtains the URL.
What this proves
That there is one brand center for the organization, created by a Global Administrator, storing through Organization Asset Libraries on one designated site. Site permissions on that site govern who can open the brand center app and manage what it holds, and Microsoft says so directly: after setup you control access to the app by customizing the site permissions of the brand center site.
It also proves a distribution decision was made, because enabling the brand center requires consent to Public CDN in the tenant. That consent is a documented step of the setup, not a side effect.
What it does not prove
- That restricting the site restricts the fonts. Microsoft's warning is explicit: published font files and the font catalog created alongside them are stored publicly in the cloud, do not respect site classification guidelines where the Organization Asset Library sits in a Restricted SharePoint Site, and are accessible to anyone, including people outside the organization, who can obtain the URLs.
- That every asset class shares one boundary. An organization asset library created without specifying a CDN type gets a private CDN by default. The brand center as a whole requires the public one. The asset class, not the site, decides.
- That a private CDN choice survives. A tenant already using organization assets with Private CDN is instructed, as a setup step, to activate Public CDN in order to enable the brand center.
- That the font catalog is only about fonts. It contains font names and related metadata, which is an inventory of an organization's typography that becomes publicly reachable with the files.
PowerShell
# Is public distribution on in this tenant?
Get-SPOTenantCdnEnabled -CdnType Public
# Which libraries are organization assets, on which site, and of which type.
Get-SPOOrgAssetsLibrary
# How one is created, and where the boundary is chosen.
# Omitting -CdnType selects the private CDN.
Add-SPOOrgAssetsLibrary -LibraryUrl "https://contoso.sharepoint.com/sites/BrandGuide/BrandAssets" -OrgAssetType ImageDocumentLibrary -CdnType Private
# What the public CDN currently serves from.
Get-SPOTenantCdnOrigins -CdnType PublicExample output
Enabled : True
LibraryUrl ListId OrgAssetType
---------- ------ ------------
https://contoso.sharepoint.com/sites/BrandGuide/BrandAssets <guid> ImageDocumentLibrary
https://contoso.sharepoint.com/sites/BrandGuide/BrandFonts <guid> OfficeFontLibraryRead the first line as this tenant distributes some assets publicly, which is required for the brand center to exist at all, and the rows as these are the libraries that authority publishes from.
Explanation
Two boundaries are easy to read as one.
| Boundary | What it governs |
|---|---|
| Administration | Who can open the brand center app, upload, and publish |
| Distribution | Who can retrieve the published asset, and by what route |
Administration is site permissions on the brand center site, and it behaves the way SharePoint permissions always behave. Distribution is a CDN, and a CDN does not read a site's permissions or its classification. For images and templates the default is the private CDN and the two boundaries stay close together. For fonts they do not, and Microsoft documents the gap rather than leaving it to be found.
The consequence worth stating plainly: a brand center site can be restricted, and correctly restricted, while the fonts published through it are retrievable by anyone holding the URL. Both facts are true at once, and only one of them is visible in the site's permissions.
Production considerations
Before publishing a font, read its licence. Microsoft's own guidance is not to use the feature where fonts carry proprietary information or licence restrictions such as restrictions on cloud hosting. This is the rare case where the licensing question and the security question have the same answer, and the licensing one is likely to arrive first, from the foundry.
Enabling the brand center changes tenant distribution state. Where a tenant
had chosen Private CDN for organization assets, enabling the brand center means
activating the public one. Establish the state before and after with
Get-SPOTenantCdnEnabled -CdnType Public, and record it as a decision rather
than discovering it later.
Multi-geo does not give each geography its own authority. A single brand center app is created in the primary geo. Custom fonts in another geography require an organization asset library in a site using the Public CDN there, which repeats the distribution decision rather than avoiding it.
What is not established here. Whether clearing the Visible property or
deleting an asset stops the URL answering, and how quickly, is not stated by the
documentation read for this article. A distribution system that keeps serving a
withdrawn asset is a different object from a library that stops listing it, and
that difference is worth measuring before it matters.
Related governance rules
None yet. What organization-wide brand assets are published, through which distribution boundary, and under whose authority is a good governance question and it is not a published rule until the boundary has been observed as well as read.
References
- SharePoint Brand Center (Microsoft Learn)
- Brand font licensing (Microsoft Learn)
- Brand fonts (Microsoft Learn)
- Create an organization assets library (Microsoft Learn)
- Use SharePoint brand center fonts in SharePoint Framework solutions (Microsoft Learn)
- Add-SPOOrgAssetsLibrary (Microsoft Learn)
Found something wrong? Suggest a correction. The article source is not public; the engine it cites is.