Important The SiteGroupsPsws object contains tenant-wide endpoint restriction settings. Test the script in a non-production tenant first, export the original configuration, and use change control. Microsoft documents Get-PolicyConfig and Set-PolicyConfig for viewing and modifying endpoint restrictions, but the internal shape of individual hashtable entries can evolve.

Permissions

Use an account assigned the required Microsoft Purview permissions for the configuration being changed. Microsoft states that Get-PolicyConfig and Set-PolicyConfig require permissions in Security & Compliance PowerShell.

PowerShell module

Install or update the ExchangeOnlineManagement module. Security & Compliance PowerShell uses this module for connectivity.

Connection

Connect to Security & Compliance PowerShell by using Connect-IPPSSession before running the policy configuration cmdlets.

Existing group

The target Sensitive Service Domain Group must already exist. This script updates a group named Claude; it does not create the group.

Change controls

Run the discovery and backup commands first, use -WhatIf before commit, and retain the exported JSON for rollback analysis.

Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser
Import-Module ExchangeOnlineManagement
Connect-IPPSSession

Get-PolicyConfig | Format-List

(Get-PolicyConfig).SiteGroupsPsws |
    Where-Object { $_.ContainsKey(“Name”) } |
    ForEach-Object { $_.Name }

$BackupPath = “.\SiteGroupsPsws-backup-{0}.json” -f (Get-Date -Format “yyyyMMdd-HHmmss”)
(Get-PolicyConfig).SiteGroupsPsws |
    ConvertTo-Json -Depth 20 |
    Set-Content -Path $BackupPath -Encoding UTF8

Write-Host “Backup written to $BackupPath” -ForegroundColor Cyan

$GroupName = “Claude”
$NewUrls = @(
    “claude1.com”,
    “chatgpt2.com”,
    “claude3.com”
)

$PolicyConfig = Get-PolicyConfig
$Groups = $PolicyConfig.SiteGroupsPsws
$TargetGroup = $Groups | Where-Object { $_[“Name”] -eq $GroupName }

if (-not $TargetGroup) {
    $AvailableGroups = $Groups |
        Where-Object { $_.ContainsKey(“Name”) } |
        ForEach-Object { $_.Name }

    throw “Sensitive Service Domain Group ‘$GroupName’ was not found. Available groups: $($AvailableGroups -join ‘, ‘)”
}

# Target Sensitive Service Domain Group

$GroupName = “Claude”

# URLs to add

$NewUrls = @(

    “claude1.com”,

    “chatgpt2.com”,

    “claude3.com”

)

$PolicyConfig = Get-PolicyConfig

$Groups = $PolicyConfig.SiteGroupsPsws

$TargetGroup = $Groups | Where-Object { $_[“Name”] -eq $GroupName }

$Addresses = $TargetGroup[“Addresses”] | ConvertFrom-Json

foreach ($Url in $NewUrls)

{

    if ($Addresses.Url -notcontains $Url)

    {

        $Addresses += [pscustomobject]@{

            Url       = $Url

            MatchType = “UrlMatch”

        }

    }

}

$TargetGroup[“Addresses”] = $Addresses | ConvertTo-Json -Compress

# Validate

Set-PolicyConfig -SiteGroupsPsws $Groups -WhatIf

# Commit

Set-PolicyConfig -SiteGroupsPsws $Groups

$VerifiedGroups = (Get-PolicyConfig).SiteGroupsPsws
$VerifiedTarget = $VerifiedGroups | Where-Object { $_[“Name”] -eq $GroupName }
$VerifiedAddresses = @($VerifiedTarget[“Addresses”] | ConvertFrom-Json)

$Verification = foreach ($Url in $NormalizedNewUrls) {
    [pscustomobject]@{
        Group   = $GroupName
        Url     = $Url
        Present = ($VerifiedAddresses.Url -contains $Url)
    }
}

$Verification | Format-Table -AutoSize

if ($Verification.Present -contains $false) {
    throw “Verification failed: one or more URLs were not found after the update.”
}

Write-Host “Verification passed for all requested URLs.” -ForegroundColor Green

# Writable PowerShell representation
(Get-PolicyConfig).SiteGroupsPsws | ConvertTo-Json -Depth 20

# Service view
(Get-PolicyConfig).SiteGroups

Get-PolicyConfig or Set-PolicyConfig is not recognized

Confirm that the ExchangeOnlineManagement module is installed and that the session was connected with Connect-IPPSSession.

Access denied or authorization error

Verify the administrator account has the required Purview role-group permissions, then reconnect after role propagation.

Target group not found

Run the discovery command and use the exact group name returned by SiteGroupsPsws.

Addresses cannot be parsed

Inspect the raw Addresses property before changing anything. Restore from the exported JSON if the object shape is unexpected.

-WhatIf succeeds but verification fails

Retrieve Get-PolicyConfig again, check for service-side errors, and confirm no competing administrator update overwrote the configuration.