SharePoint Online with PowerShell 7: Sharing Audits and Site Lifecycle

I have worked in IT for about 20 years. A lot of that was MSP operations. Today I work as an M365 cloud admin.

I kept writing the same scripts. So I cleaned them up and shared them on GitHub. This toolkit is for SharePoint Online admins. It uses PnP.PowerShell for site work and Microsoft.Online.SharePoint.PowerShell for tenant work.

Repo: sharepoint-online-powershell-toolkit

The problem it solves

SharePoint grows fast. Sites get created and forgotten. Guests get added and never removed. Storage fills up.

Most tenants have no clear view of what is shared outside. And nobody knows which sites are still used.

These scripts give you that view. Then they help you act on it in a safe way.

Highlight scripts

Get-SPOExternalSharingAudit.ps1

Shows each site's sharing level and the guest accounts on it. Run it for all sites or one site.

./Get-SPOExternalSharingAudit.ps1
./Get-SPOExternalSharingAudit.ps1 -SiteUrl https://contoso.sharepoint.com/sites/Projects

Get-SPOInactiveSites.ps1

Finds sites with no content changes for a number of days. These are your review candidates.

./Get-SPOInactiveSites.ps1 -DaysInactive 365

Set-SPOSiteLockState.ps1

Sets sites to ReadOnly, NoAccess or Unlock. It can take the CSV from the inactive sites report. That makes archiving a two-step job.

./Set-SPOSiteLockState.ps1 -CsvPath ./output/SPOInactiveSites-20260101-0900.csv -LockState ReadOnly -WhatIf

Other scripts cover site inventory, permission reports, storage, site creation from CSV, tenant sharing settings and a sharing baseline.

How the scripts are built

• PowerShell 7.4 or later.
• Comment-based help on every script. Run Get-Help ./script.ps1 -Full.
• Reports export to CSV.
• Change scripts support -WhatIf and -Confirm.
• Certificate (app-only) or interactive sign-in.
• No secrets in the repo. Examples use contoso.com and placeholder GUIDs.

Please test in a dev or test tenant first. Read each script before you run it.

My usual workflow

I start with the reports. They are read-only and safe. I open the CSV in Excel and look for anything odd.

Then I pick one fix. I run the change script with -WhatIf and read the output. If it looks right, I run it again for real.

For jobs I repeat, I use a certificate and schedule the script. That way nobody has to remember to run it.

Getting started

Clone the repo:

git clone https://github.com/anthonybuhnerkemper/sharepoint-online-powershell-toolkit.git
cd sharepoint-online-powershell-toolkit

Every toolkit ships the same Connect-M365Admin script. Dot-source it, then connect.

# Interactive sign-in
. ./scripts/Connect/Connect-M365Admin.ps1
Connect-M365Admin -Service SharePoint, PnP -Interactive -ClientId 00000000-0000-0000-0000-000000000000

# Or app-only with a certificate
$env:M365_TENANT_ID       = '00000000-0000-0000-0000-000000000000'
$env:M365_CLIENT_ID       = '00000000-0000-0000-0000-000000000000'
$env:M365_CERT_THUMBPRINT = '0000000000000000000000000000000000000000'
Connect-M365Admin -Service SharePoint, PnP

Run a report, check the CSV, then call Disconnect-M365Admin when you are done. The README lists the modules and roles each script needs.

More toolkits

I have nine more free toolkits that use the same pattern: graph-powershell7-admin-toolkit, entra-id-powershell-toolkit, exchange-online-powershell-toolkit, onedrive-powershell-toolkit, teams-powershell-toolkit, intune-powershell-toolkit, defender-xdr-powershell-toolkit, sentinel-kql-toolkit, purview-compliance-toolkit.

You can find them all on my GitHub profile.

Feedback welcome

Issues, ideas and pull requests are welcome. What would you add? Tell me in the comments.