What it observes
The organisation asset libraries a brand centre is built on, and the boundary its assets are published across.
| Fact | What it carries |
|---|---|
organization_asset_libraries | How many libraries the tenant declares |
organization_asset_library_urls | Where they are |
public_cdn_enabled · private_cdn_enabled | Whether each CDN is on |
public_cdn_origins · private_cdn_origins | What is published through each |
public_cdn_include_file_extensions | What may be served at all |
public_cdn_exclude_restricted_site_classifications | Which classifications never reach the CDN |
public_cdn_exclude_if_no_script_disabled | Whether the CDN honours the site-level NoScript attribute |
The administration boundary and the distribution boundary are not the same
A brand centre stores its assets in a SharePoint organisation asset library, on a site with permissions like any other site. Microsoft states that the brand centre requires Public CDN, and about a public origin it says: "Content in public origins within the Microsoft 365 CDN is accessible anonymously, and can be accessed by anyone who has URLs to hosted assets."
So the site's permissions govern who can change the assets. They do not govern who can fetch them. A reader who has checked the site and concluded that the assets are internal has answered a different question, and no screen in the admin centre puts the two beside each other.
Removing an asset does not remove it
Microsoft documents both halves of the timing: "If you remove an asset from a public origin, the asset might continue to be available for up to 30 days from the cache; however, we invalidate links to the asset in the CDN within 15 minutes."
Fifteen minutes for the links, thirty days for the cache. That is how a mistake becomes a month, and it is carried as a fact rather than left to be remembered.
One policy joins this to custom script
ExcludeIfNoScriptDisabled excludes content from the CDN based on the
site-level NoScript attribute -- which is the same DenyAddAndCustomizePages
that SPO-SCRIPT-001
reads. With it off, a site's custom script setting has no effect on what the CDN
serves from that site: two decisions a reader would reasonably expect to be one.
No rule reads any of this, and that is a decision
Microsoft publishes no conclusion about whether an organisation should publish its brand assets anonymously, and there is none to invent. A logo on a public CDN is the intended design; something else there is a decision only the organisation can make.
What has no answer is not the same as what has no consequence, which is why
this collects. brand centre configured is never brand centre secure, for
the same reason custom script disabled was never nothing executable can run.
What it does not read
- Which site hosts the brand centre app. That is set in the Microsoft 365 admin centre and is not on the SharePoint administration surface this reads. The libraries above are what a brand centre is built on; a tenant may use them without having enabled one.
- Who the brand managers are. They are the site owners of the brand centre site, which is a site-scoped reading against a site this collection was not pointed at.
- What is in the published libraries. The boundary is read here; the assets that crossed it are not.
Sources
- SharePoint brand center (Microsoft Learn)
- Content Delivery Networks (CDNs) (Microsoft Learn)
- Use the Microsoft 365 CDN with SharePoint (Microsoft Learn)
What the Engine publishes
Generated from the Engine's capability manifest at 1.0.0b8@c2aecc628b21. No value on this panel is maintained by this site.
- Answers
- the organisation asset libraries a brand centre is built on, and the boundary its assets are published across
- Collector
- PnP PowerShell · mode
BrandCenter - Reads
Get-PnPOrgAssetsLibraryGet-PnPTenantCdnEnabled -CdnType Public|PrivateGet-PnPTenantCdnOrigin -CdnType Public|PrivateGet-PnPTenantCdnPolicies -CdnType Public
- Least privilege
Sites.FullControl.All
- Produces
sharepoint·tenant- Proven against a tenant
- not live-validated
Rules that decide from it
No rule reads this evidence, and that is a recorded decision rather than a gap: the brand distribution surface in a report, and any viewer is what consumes it. A threshold invented for a surface Microsoft publishes no position on would make a pass mean nothing.
Contracts it produces
Every collection writes evidence and an account of itself. The manifest publishes no narrower per-capability list, so this states what it does establish rather than guessing at more.