This chapter provides a comprehensive examination of SharePoint Hub Sites and Governance, a critical topic for the MS-102 exam. Hub sites enable content aggregation, shared navigation, and search across sites, and their governance is essential for maintaining control over large-scale SharePoint deployments. Approximately 5-10% of exam questions touch on hub site configuration, permissions, and governance policies, making this a focused but high-yield area. You will learn the internal mechanisms, step-by-step configuration, real-world deployment scenarios, and exam-specific traps to avoid.
Jump to a section
Think of SharePoint hub sites as community centers in a city, with each community center serving as a central point for a specific neighborhood. The city planner (tenant admin) designates certain buildings as community centers (hub sites). Each building in the neighborhood (regular site) can choose to associate with one community center. Once associated, the community center provides a shared navigation bar at the top of every building's entrance (hub navigation), displays news from the community center on each building's bulletin board (news rollup), and allows search to find content across all buildings in the neighborhood (search across sites). The community center does not own the buildings; each building retains its own permissions and content. However, the community center can enforce a shared theme (branding) and manage the neighborhood's security group membership (hub site permissions). If a building wants to leave the neighborhood, it can disassociate, and all shared features disappear. The city planner can also set policies: for example, only certain buildings can become community centers (hub site creation permissions), and each community center can have a maximum number of associated buildings (site limits). This analogy mirrors how hub sites aggregate content, navigation, and search across associated sites without merging ownership or permissions.
What Are SharePoint Hub Sites and Why Do They Exist?
SharePoint Hub Sites are a feature that allows organizations to organize sites into logical groups, known as hubs, to facilitate content discovery, consistent navigation, and search across associated sites. Unlike a classic site collection hierarchy (site collection -> subsites), hub sites create a flat structure where any site can be associated with a hub, regardless of its location in the site hierarchy. This is particularly useful for large enterprises with thousands of sites, where traditional navigation and search become fragmented.
How Hub Sites Work Internally
At the technical level, a hub site is a regular SharePoint site that has been designated as a hub. When a site is registered as a hub, SharePoint stores the hub site's ID in the tenant's configuration. When another site associates with that hub, the association creates a link in the site's metadata, pointing back to the hub. This link triggers several behaviors:
Hub Navigation: The hub site's navigation is injected into the associated site's top navigation bar. This is achieved via a custom action that overrides the site's navigation rendering.
News Rollup: The hub site's news posts can be surfaced on associated sites using the News web part, which queries the hub's content using the SharePoint Search API.
Search: When a user searches from an associated site, the search scope automatically includes all sites associated with the same hub. This is configured via a search vertical that filters results to the hub's content.
Permissions: Hub site permissions are separate from site permissions. A user can be granted access to the hub site (e.g., to edit navigation) without having access to all associated sites.
Key Components, Values, Defaults, and Timers
Hub Site ID: A globally unique identifier (GUID) assigned to each hub site. This ID is used to associate sites and is stored in the site's property bag.
Hub Site Creation Permissions: By default, only site collection administrators can create hub sites. This can be delegated to a security group via the SharePoint Admin Center or PowerShell.
Maximum Associated Sites: The default limit is 2,000 sites per hub. This can be increased to a maximum of 100,000 by contacting Microsoft support, though performance may degrade beyond 2,000.
Hub Navigation: The navigation is inherited from the hub site. Changes to the hub site's navigation are automatically propagated to associated sites within minutes (typically 5-15 minutes).
News Rollup: The News web part defaults to showing news from the current site and the hub site. To show only hub news, the web part must be configured accordingly.
Search: Search results from an associated site include content from all sites in the same hub. This is controlled by the search schema and managed property 'HubSiteId'.
Configuration and Verification Commands
To create a hub site using PowerShell:
Connect-SPOService -Url https://<tenant>-admin.sharepoint.com
Register-SPOHubSite -Site https://<tenant>.sharepoint.com/sites/hubsiteTo associate a site with a hub:
Add-SPOHubSiteAssociation -Site https://<tenant>.sharepoint.com/sites/associatedsite -HubSite https://<tenant>.sharepoint.com/sites/hubsiteTo verify hub site settings:
Get-SPOHubSite -Identity https://<tenant>.sharepoint.com/sites/hubsiteTo view all sites associated with a hub:
Get-SPOHubSiteChildSites -Identity https://<tenant>.sharepoint.com/sites/hubsiteTo remove a hub site association:
Remove-SPOHubSiteAssociation -Site https://<tenant>.sharepoint.com/sites/associatedsite -HubSite https://<tenant>.sharepoint.com/sites/hubsiteTo unregister a hub site:
Unregister-SPOHubSite -Identity https://<tenant>.sharepoint.com/sites/hubsiteInteraction with Related Technologies
SharePoint Admin Center: Hub sites are managed under the 'Active sites' page. You can register, associate, and unregister hub sites from the UI.
Microsoft 365 Groups: Hub sites can be associated with Microsoft 365 Groups, but the group's membership does not automatically grant access to the hub site.
Power Automate: Flows can trigger on hub site events, such as when a new site is associated.
Search: Hub site search uses the same search index as regular sites. The 'HubSiteId' managed property is used to filter results.
Permissions: Hub site permissions are managed separately from site permissions. The hub site can have its own unique permissions, but by default, it inherits from its parent site collection.
Governance Considerations
Hub Site Limits: Plan for the 2,000 site limit per hub. If you exceed this, performance may degrade and you may need to create additional hubs.
Hub Site Permissions: Control who can create hub sites by limiting permissions to a specific security group. Use the Set-SPOHubSite cmdlet to set the 'HubSitePermissions' parameter.
Navigation Consistency: Hub navigation is inherited, so changes to the hub site's navigation affect all associated sites. Plan navigation structure carefully.
Content Migration: When migrating sites to a hub, ensure that the hub site's navigation and news rollup are configured before association.
Auditing: Use the Microsoft 365 compliance center to audit hub site activities, such as site association or navigation changes.
Plan Hub Site Architecture
Before creating any hub sites, plan your hub architecture. Determine the number of hubs needed based on organizational structure (e.g., by department, geography, or project). Consider the 2,000 site limit per hub. Identify which sites will be hubs and which will be associates. Document the navigation structure for each hub. Decide who will have permissions to create hubs—typically a small group of site admins. This planning phase prevents future rework and ensures governance.
Create Hub Sites
Select a site to become a hub. This can be an existing team site, communication site, or a new site. In the SharePoint Admin Center, navigate to 'Active sites', select the site, and click 'Register as hub site'. Alternatively, use PowerShell: `Register-SPOHubSite -Site <url>`. The site must have at least Full Control permissions for the user. Once registered, the site's navigation and news become available to associated sites. The hub site ID (GUID) is generated and stored.
Associate Sites to Hub
Associate existing or new sites to the hub. In the site settings, under 'Hub site', click 'Join a hub site' and select the hub. Or use PowerShell: `Add-SPOHubSiteAssociation -Site <url> -HubSite <url>`. The association triggers the injection of hub navigation and enables news rollup and cross-site search. The association can be removed at any time. Note that a site can only be associated with one hub at a time.
Configure Hub Navigation
Edit the hub site's navigation to include links that should appear on all associated sites. Go to the hub site's settings, click 'Navigation', and add links. The navigation is hierarchical and can include headings. Changes propagate to all associated sites within minutes. For consistency, avoid adding site-specific links to the hub navigation. Use the hub navigation as a global navigation bar.
Set Hub Site Permissions
By default, any site collection admin can register a hub. To restrict this, assign the 'Hub Site Creation' permission to a specific security group. In the SharePoint Admin Center, go to 'Settings' > 'Hub site creation' and select the group. Alternatively, use PowerShell: `Set-SPOTenant -HubSiteCreationPermissionsGroup <group>`. Also, manage who can edit hub navigation by setting unique permissions on the hub site.
Monitor and Govern Hub Sites
Regularly review hub site usage and associations. Use the SharePoint Admin Center to see how many sites are associated with each hub. Use PowerShell to generate reports: `Get-SPOHubSite | ForEach-Object { $_.SiteUrl; Get-SPOHubSiteChildSites -Identity $_.SiteUrl }`. Ensure that hub site limits are not exceeded. Remove orphaned associations if a hub site is deleted. Audit changes using the compliance center.
Enterprise Scenario 1: Global Corporation with Regional Hubs
A multinational company with offices in North America, Europe, and Asia needs to organize its SharePoint sites by region. They create three hub sites: 'NA Hub', 'EU Hub', and 'APAC Hub'. Each regional hub has its own navigation with links to regional resources, HR policies, and news. Regional team sites are associated with their respective hub. This allows employees in each region to see relevant news and navigation, while global corporate communications are posted on a separate 'Corporate Hub' that all sites can follow. The challenge is managing navigation updates across multiple hubs; the company uses a governance committee to approve changes. They also set the hub site creation permission to a global IT security group to prevent unauthorized hub creation.
Enterprise Scenario 2: Project-Based Organization
A consulting firm uses SharePoint for project sites. Each project site is associated with a 'Projects Hub' that provides a unified navigation to project templates, time tracking, and resource libraries. The hub site also aggregates news about project milestones. With over 1,500 project sites, the firm monitors the hub's site count and plans to split into multiple hubs (e.g., 'Active Projects Hub' and 'Completed Projects Hub') when approaching the 2,000 limit. They use PowerShell scripts to periodically check the number of associated sites and send alerts when it reaches 1,800. Misconfiguration occurs when a project site is associated with the wrong hub due to user error; they mitigate this by training users and using a self-service approval flow for association requests.
Performance Considerations
When a hub exceeds 2,000 associated sites, navigation propagation and search indexing may slow down. The hub site's page load time can increase due to the navigation data size. Microsoft recommends keeping associations under 2,000 for optimal performance. For very large deployments, consider using multiple hubs and a central portal that links to all hubs. Additionally, if a hub site is deleted, all associations become orphaned; sites lose hub features but remain accessible. To recover, you must re-associate sites to a new hub. Always back up hub site navigation structure before deletion.
MS-102 Exam Focus on Hub Sites and Governance
The MS-102 exam tests your ability to plan, configure, and govern SharePoint hub sites. Key objective codes include: Manage SharePoint site creation (1.5.1), Manage hub sites (1.5.2), and Implement governance for SharePoint (1.5.3). Expect 2-3 questions specifically on hub sites.
Common Wrong Answers and Why Candidates Choose Them
Wrong: 'Hub sites require the same permissions for all associated sites.' Candidates assume that because navigation is shared, permissions are also shared. Reality: Hub sites and associated sites have independent permissions. The hub site's permissions only control access to the hub itself (e.g., editing navigation).
Wrong: 'A site can be associated with multiple hub sites.' Candidates think of hubs as tags. Reality: A site can only be associated with one hub at a time. To change hubs, you must disassociate first.
Wrong: 'Hub sites can only be created from communication sites.' Candidates confuse hub sites with communication site features. Reality: Any site (team site, communication site) can be a hub site.
Wrong: 'Hub site navigation is automatically inherited by all sites in the tenant.' Candidates misunderstand the scope. Reality: Only sites explicitly associated with the hub inherit its navigation.
Specific Numbers and Values
Maximum sites per hub: 2,000 (default), can be increased to 100,000 with support.
Hub navigation propagation time: 5-15 minutes.
Hub site creation permissions: delegated to a security group via PowerShell (Set-SPOTenant -HubSiteCreationPermissionsGroup).
PowerShell cmdlets: Register-SPOHubSite, Add-SPOHubSiteAssociation, Get-SPOHubSite, Remove-SPOHubSiteAssociation, Unregister-SPOHubSite.
Edge Cases and Exceptions
If a hub site is deleted, associated sites lose hub features but remain functional. They can be reassociated to another hub.
Hub sites cannot be created on private channel sites or on sites that are part of a Microsoft 365 Group with a private channel.
The hub site must be a site collection; it cannot be a subsite.
When using SharePoint Server (on-premises), hub sites are not available; they are a SharePoint Online feature.
How to Eliminate Wrong Answers
Focus on the core mechanism: hub sites are about aggregation of navigation, news, and search, not about merging permissions or content. Any answer suggesting that permissions are shared or that content is copied is likely wrong. Remember the 2,000 site limit and the single association rule. If a question mentions 'multiple hubs per site', it's incorrect.
Hub sites aggregate navigation, news, and search across associated sites without merging permissions.
A site can only be associated with one hub at a time.
Default limit of 2,000 associated sites per hub; can be increased to 100,000 with support.
Hub site creation can be restricted to a security group using PowerShell.
Navigation changes propagate within 5-15 minutes.
Hub sites are only available in SharePoint Online, not on-premises.
Use PowerShell cmdlets: Register-SPOHubSite, Add-SPOHubSiteAssociation, Get-SPOHubSite, etc.
If a hub site is deleted, associated sites lose hub features but remain accessible.
These come up on the exam all the time. Here's how to tell them apart.
Hub Sites
Flat structure: any site can associate with a hub regardless of hierarchy
Shared navigation, news rollup, and cross-site search across associated sites
Independent permissions per site
Maximum 2,000 associated sites per hub (default)
Hub site can be any site type (team or communication)
Site Collections with Subsites
Hierarchical structure: subsites are nested under a parent site collection
Navigation is inherited from parent to subsites, but search is limited to the site collection
Permissions can be inherited or unique per subsite
No hard limit on subsites, but performance degrades with many
Parent site collection must be a specific type (generally team site)
Mistake
Hub sites can only be created from communication sites.
Correct
Hub sites can be created from any site, including team sites (Microsoft 365 group-connected or not) and communication sites.
Mistake
A site can be associated with multiple hub sites simultaneously.
Correct
A site can only be associated with one hub at a time. To change hubs, you must first disassociate from the current hub.
Mistake
Hub sites automatically grant access to all associated site content.
Correct
Hub sites do not grant access to associated sites. Permissions are independent. Users must have explicit permissions on each site to access its content.
Mistake
Hub site navigation is updated in real-time across all associated sites.
Correct
Navigation changes on the hub site propagate to associated sites within 5-15 minutes, not instantly.
Mistake
Hub sites are available in SharePoint Server on-premises.
Correct
Hub sites are a SharePoint Online feature only. They are not available in SharePoint Server (on-premises) versions.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
The default maximum is 2,000 sites per hub. This can be increased up to 100,000 by contacting Microsoft support, but performance may degrade. For optimal performance, keep associations under 2,000.
No, a site can only be associated with one hub at a time. To change hubs, you must first disassociate from the current hub using the SharePoint Admin Center or PowerShell.
No. Hub sites do not grant access to associated sites. Users must have explicit permissions on each site to view its content. Hub sites only aggregate navigation, news, and search.
Use the SharePoint Admin Center under 'Settings' > 'Hub site creation' to select a security group. Or use PowerShell: Set-SPOTenant -HubSiteCreationPermissionsGroup <group name>.
The associated sites lose hub features (navigation, news rollup, cross-site search) but remain accessible. They can be reassociated to another hub site. The hub site should be unregistered before deletion to avoid orphaned associations.
No, hub sites are a SharePoint Online feature and are not available in SharePoint Server (on-premises) versions.
Navigation changes typically propagate to all associated sites within 5-15 minutes. There is no option to force an immediate update.
You've just covered SharePoint Hub Sites and Governance — now see how well it sticks with free MS-102 practice questions. Full explanations included, no account needed.
Done with this chapter?