Introduction As part of Microsoft 365 Copilot readiness, you may want to find where “Everyone and “Everyone except external users” claims are granted permissions which is a cause of oversharing. This blog post will guide you through using PowerShell to manage and audit the “Everyone” and “Everyone except external users” claims within your SharePoint site collection. For more insights on why the “Everyone except external users” group is riskier than “People in your organization,” refer to Copilot for Microsoft 365 Data Ready – Where “Everyone except external users” group is more risky than “People in your organization” links!

Introduction Understanding the sensitivity and retention labels applied to files in your SharePoint Online sites is essential for maintaining data security and compliance. These labels enable you to manage and protect your data by defining retention periods and handling sensitive information appropriately. This is particularly important for initiatives like the Microsoft 365 Copilot rollout, ensuring that the correct files are stored within the appropriate SharePoint sites. For example, if a SharePoint site is a public Team site, files labeled as confidential should be moved to a private Team site or existing Team site updated from public to private.

As part of the multi tenant app registration for PnP PowerShell deprecated on the 9th September 2024, we need to have our own app registration and grant the required permissions. Read more from Changes in PnP Management Shell registration in Microsoft 365 For the cmdlet Get-PnPFlow it requires permissions Azure: management.azure.com which is Azure Service Management Simply adding the permission as it does not require admin consent and executing the cmdlet below yields no results

Ensuring the security and compliance of your SharePoint environment is crucial, especially when dealing with service principals, Entra ID apps, or federated identities. These entities often have elevated permissions that, if mismanaged, can lead to unauthorized access and potential data breaches. Regularly auditing these permissions is a best practice for maintaining a secure and compliant SharePoint environment. Application only or granular access to individual site instead of whole tenant, scope called “Sites.

Updating the expiration time and role for sharing links is still limited. Although it seems possible through the Graph API Update permission, I have been unable to pass the roles as body parameters. Graph Explorer Attempts Using the following script: Invoke-PnPGraphMethod -Url "v1.0/drives/$driveId/items/$driveItemId/permissions/$($ShareLink.Id)" -Method Patch -Content @{ roles = @("read") } threw the error message “Invalid input: No Information provided to update the specifed permission” From the UI Anyone link can’t be edited Organisation link can’t be edited Specific people links can be edited Using the network tab from the browser developer tools enables identifying the endpoint to update specific people links only.

Microsoft has introduced Enhanced Version Controls, previously known as Intelligent Versioning, as part of its public preview in May 2024. This feature, detailed in the Microsoft 365 Roadmap 145802, aims to help administrators manage file versions more effectively, reducing storage costs by removing unnecessary versions. Extract from the Roadmap We are introducing new version controls that help tenant and site admins or document library owners reduce the storage footprint driven by low value file versions.

Managing sharing settings for SharePoint sites is crucial for maintaining a secure and well-governed environment. With the help of PowerShell, administrators can efficiently retrieve and manage these settings across their SharePoint Online tenant. This ensures that sensitive information is not overshared and that your organisation’s data remains secure. Importance of Reviewing Sharing Settings Reviewing sharing settings is essential to prevent oversharing, which can lead to data breaches and unauthorized access to sensitive information.

Sharing lies at the heart of collaboration within SharePoint, facilitating seamless communication and teamwork. However, effective management of sharing settings is crucial to maintain data security and prevent unintended exposure. This is particularly important in light of tools like Copilot for M365. An extract from Announcing SharePoint advanced management innovations for the AI and Copilot era “With Copilot and AI, security has become a concern. Not because Copilot allows people to access anything more than they could previously; it just allows them to find information they have access to faster.

The script checks the ‘SharePoint Online Web Client Extensibility’ Principal within Entra ID for the actual assigned permissions as the SPFx solutions requests are all be added to that single shared permission group. As hilghlighted by “Wes Hackett”: I’ve personally seen plenty of tenants with Mailbox permissions with no corresponding solutions live in the app catalogs. Early SPFx doc examples encouraged the use of MS Graph into Mailbox permissions in one of the how to learn samples, older tenants sometimes have this breadcrumb left behind.

Have you ever needed to gather detailed information about SPFx solutions installed in your SharePoint environment, such as API permissions, for auditing, inventory, or compliance purposes? The PowerShell script below helps you retrieve these details from both the tenant-level and site collection app catalogs for auditing with the aim to improve security posture by removing unneeded apps and access rights. To execute this script, you must have Global Administrator or SharePoint Administrator roles.

When working with large SharePoint sites, checking for unique permissions can be a time-consuming task. This blog post explores methods to optimize PowerShell scripts for fetching property HasUniqueRoleAssignments to determine unique permissions, including using PnP PowerShell and the SharePoint REST API. We compare their performance and highlight the advantages and limitations of each approach. Using PnP PowerShell PnP PowerShell provides an efficient way to interact with SharePoint Online and retrieve list items to check for unique permissions.

If you have built Power Platform solutions using SharePoint as a datasource, you may want to export the list structure along with its data from the source environment (e.g., DEV) and deploy it across different environments such as Test, UAT, and PROD. Fortunately, the PnP Provisioning from PnP PowerShell provides this capability. Power Platform solutions can be deployed using pipelines after the SharePoint structure is deployed. Export Structure and Data from SharePoint Lists PnP PowerShell makes this process straightforward with Get-PnPSiteTemplate:

If a M365 group connected Team site is deleted from SharePoint Admin Centre, from the UI it is not possible to delete the site from the deleted sites to be able to resuse the URL or name of the deleted site. The end user is presented with the following prompt This site belongs to a Microsoft 365 group. Deleting the site will delete the group and all its resources, including the Outlook mailbox and calendar, and any Teams channels.

Have you ever wondered how to default the default sharing link in Teams chats to ‘People currently in this chat’? By default, if “Anyone” is disabled within the tenant, the sharing link is set to “People in my organization”. This can be a challenge when you want to limit access to only those in the current chat. All files uploaded to a Teams Chat are stored in the uploader’s OneDrive for Business.

Effective oversight of sharing links and sharing information are paramount to ensuring data security, compliance, and optimal collaboration experiences. As organisations migrate to M365 environments, they inherit powerful collaboration tools that facilitate seamless sharing of documents and resources. However, without proper governance, these capabilities can lead to unintended consequences such as data breaches, compliance violations, and loss of intellectual property. Sharing is a powerful feature for collaboration. However depending on how items, files or folders are shared, a sharing link might be created or unique permissions on these items are created.

As part of the Copilot for M365 rollout , questions were raised on the /portals/Community and /portals/hub as both ‘Everyone Except External Users’ was granted access raising concerns on the content on the site. These are legacy sites and are currently inaccessible. Historically, these sites were accessible via the legacy SharePoint admin centre, however, they are not available through the modern SharePoint admin centre interface. Thanks to Gregory Zelfond’s blog post What are all these site collections in SharePoint?

There is limited space allocated to the tenant. To ensure business continuity and smooth ongoing operation, it is imperative to keep an eye on its usage and take relevant actions suited to the circumstances. By default a SharePoint site is allocated 25 TB by default and OneDrive for Business site is allocated 1 TB by default. These settings can be amended manually to a different quota to control SharePoint site. The script will help to proactively monitor percent used against quota for each SharePoint site.

Maintaining up-to-date list items, especially when dealing with choice fields, can be a daunting task sepcially after choice field values are updated. We need a way to update these old values to the correct new ones. The Challenge SharePoint lists use choice fields to categorise items. Over time, the need to update these choice values can arise, whether due to changes in terminology, business processes, or error correction. Manually updating these values across numerous list items is not only time-consuming but also prone to human error.

Overcoming SharePoint’s List View Threshold with CAML Queries in PowerShell Encountering the list view threshold error in SharePoint when dealing with lists exceeding 5,000 items is a common challenge. Using CAML queries within PowerShell scripts offers a server-side solution to efficiently filter and retrieve data, yet is prone to the list view threshold error. Sample script This is the sample PowerShell script querying the specified SharePoint list using CAML query.

Find orphaned choice values in SharePoint list/libraries using PowerShell One common issue is orphaned choice values in SharePoint lists which may affect subsequent update to the list item. This can occur when list items contain values that are no longer valid according to the list’s choice field values. This post covers a PowerShell script to identify these orphaned choice values in SharePoint lists to either update them or add them back to the list of choice field values.

Update SharePoint Site Logo and Thumbnail with PowerShell In SharePoint Online sites, the distinction between the Site Logo and Site Thumbnail is crucial. The site logo appears in the site header, while the site thumbnail is used in search results, site cards, file copying/moving, and other areas. Both site logo and thumbnail are part of SharePoint branding. This post covers how to update the site logo and thumbnail across multiple SharePoint sites within a hub using PowerShell.

Update Content Type of List Items in SharePoint List A content type in SharePoint is a reusable collection of metadata (columns) allowing to organise, manage and handle content in a consistent way. If the content type of files and items need to be updated because of required changes how particular content have to be managed, it can be a daunting laborious task if done manually. PowerShell can help automating the update of content types and corresponding metadata (columns).

Teamifying an Existing M365 Group with PowerShell Within M365 , SharePoint and Teams together provides a rich collaboaration platform. When a team site is created from SharePoint admin centre, it is not associated with a Teams despite a M365 group is created in the background. To extend SharePoint collaboration features , there is a need to “teamify” an existing Microsoft 365 Group, essentially attaching a new Teams instance to it to allow use of channels and other apps.

Get Total Count of SharePoint Files, Folders, and Items with PnP PowerShell This PowerShell script powered by PnP PowerShell can help to get total count of files, folders, and list items across SharePoint tenant. This script is invaluable for administrators looking to perform audits, verify data migrations, or simply keep tabs on the content sprawl within their environments. The use case of this script was to get a total number of items that would be ingested into a third party application Records365 (provided by RecordPoint) to ensure the number tally for compliance purposes and identify any gaps.

When working with CSV files in PowerShell with special characters you might encounter an issue where special characters (e.g., em dashes —) are incorrectly represented as a question mark inside a diamond �. This common issue arises due to PowerShell’s default encoding not matching the encoding used in the CSV file. Problem Statement The root of this problem lies in the encoding mismatch. Encoding is a method of converting characters into a format that can be easily stored or transmitted.

Find SharePoint Framework (SPFx) Packages with PowerShell in Tenant and Site Collection App Catalogs This post covers a PowerShell script to generate an inventory of SPFx installations within your SharePoint Online environment which will help you maintain oversight of your SPFx solutions, ensuring they are up-to-date and compliant. The script was particularly useful in pinpointing sites within the tenant where third-party applications, specifically an analytics SPFx component, were deployed. This was crucial for ensuring that data collection was confined to designated sites, such as the intranet in my case study.

Empowering Secure Collaboration: Configuring OneDrive Tenant Settings with PowerShell OneDrive makes it easy to collaborate by sharing files and folders with others. OneDrive is the storage space for personal productivity and not meant for collaboration. Data stored within OneDrive are Files shared to chats within Teams Files shared with end user by other OneDrive users. OneNote Personal lists and Document storage Shortcuts to SharePoint sites/libraries Favourites Loops within chats Streams In this article, we’ll explore into how PowerShell can empower SharePoint administrators to configure OneDrive sharing settings proactively at the tenant level, addressing oversharing concerns for the Copilot for M365 rollout.

Deletion of sharing links with PowerShell As organisations look to deploy Copilot for Microsoft 365, ensuring the security and proper governance of shared content is important. The rollout of Copilot introduces advanced AI capabilities across Microsoft 365 apps using content from SharePoint/OneDrive, making it even more essential to manage sharing links judiciously to tackle the issue of oversharing. Sharing is a powerful feature for collaboration. However depending on how items, files or folders are shared, a sharing link might be created or unique permissions on these items are created.

Manage SharePoint Premium - SharePoint Advanced Management Settings Using PowerShell to protect data in Copilot for M365 Rollout SharePoint Premium - SharePoint Advanced Management offers features to help prevent data oversharing and accidental leaks, which is crucial for a successful rollout of Copilot for M365. This guide will show you how to manage these settings using PowerShell. For an overview, read the Microsoft SharePoint Premium - SharePoint Advanced Management overview.

Excluding certain SharePoint sites from search would mean the contents from the excluded sites won’t be available to M365 tenant search and Copilot for M365 using Restricted SharePoint Search feature. The downsides using this feature are: Limited Findability: By excluding certain SharePoint sites from search, you limit the findability of data. Users would need to know the specific sites where the data resides in order to search for it. This can hinder efficient data retrieval and records management.

Empowering Secure Collaboration: Configuring Microsoft Loop Sharing SharePoint Tenant and Site Settings with PowerShell Guest users can be invited to collaborate within Microsoft Loop in the tenant. Refer How to work with guest users using Microsoft Loop how sharing within Loop works. This post focuses on using PowerShell to control the Microsoft Loop sharing settings to help securing data especially with Copilot for M365 which can expose data not previously accessible by other means.

Sharing Options Updates - Send Email button greyed out Starting from March 2024, there has been a notable change in SharePoint’s sharing options. If a user is not allowed to share on a SharePoint site (for instance, when a user is a member and only owners have sharing privileges), the Send Email button appears greyed out. Additionally, a warning message is displayed: Sharing is limited on this item. You can only copy links for people who have existing access, and you can’t invite anyone new.

Query Unique Permissions in SharePoint using CSOM and PnP PowerShell Managing permissions in SharePoint is a critical aspect of maintaining data security and compliance within organisations. However, as SharePoint environments grow in complexity, manually auditing and managing permissions becomes increasingly challenging. To address this challenge, PowerShell scripts can be leveraged to automate the auditing process, providing administrators with valuable insights into permission structures across SharePoint sites and libraries. What do SharePoint permissions have to do with Copilot for Microsoft 365?

Working with PowerShell Script Module Files:psm1 Have you ever utilized a psm1 file to create reusable functions across multiple ps1 files? If so, you might have encountered the frustration of edits not reflecting immediately due to module caching. I recently faced this issue when updating a psm1 file; despite making changes, the updates didn’t take effect immediately. The issue stemmed from module caching. The only solution I found to load the updated psm1 file was to terminate the PowerShell session and start a new one.

How to Redirect PowerShell Terminal Output to a File The PowerShell console buffer, while useful, has its limitations. When dealing with thousands of lines of output, you may encounter performance issues or even lose older output due to truncation. However, there’s a straightforward solution to ensure all output is retained for later review: redirect the output to a file. You can accomplish this by using the redirection operator > operator, followed by the name of the file where you want the output to be stored.

Managing Service Principal Permission Requests using PowerShell Permission to the “SharePoint Online Client” service principal can be granted either in declarative method within SPFx solutions or directly. This post explores how to handle both declarative and direct permission grants using SPO PowerShell , ClI for M365 and PnP PowerShell. PnP PowerShell Get all service principal permission grants Gets the collection of permission grants for the “SharePoint Online Client” service principal using the cmdlet Get-PnPTenantServicePrincipalPermissionGrants

Get Folder Item properties using PnP PowerShell : Get-PnPFolderItem versus Get-PnPListItem Introduction In this blog post, we will explore an alternative approach to retrieving folder item properties using PnP PowerShell. We will discuss the limitations of the Get-PnPFolderItem cmdlet and demonstrate how to use Get-PnPListItem to overcome those limitations. The Limitations of Get-PnPFolderItem The Get-PnPFolderItem cmdlet is not suitable for working with large libraries. When attempting to retrieve items from a large library, you may encounter the following error message:

Custom document library template using PnP PowerShell Creating custom list templates is now possible to create both custom document libraries and lists. This article explores the option how to use a combination of list design and PowerShell script to provision multiple instances of document libraries using a CSV file and how to create a document library from a custom list template from UI. First we can create a list design for our library based on an existing configured document library with custom content types, fields and views.

Retracting SPFx Solutions from Hub Site and associated sites using PnP PowerShell SharePoint Framework (SPFx) solutions are a powerful tool for extending and customizing SharePoint sites. However, managing these solutions across multiple sites in a SharePoint tenant can be a daunting task. Fortunately, PnP PowerShell provides automation capabilities that can streamline these operations and ensure consistency across the tenant. The blog post Deploying SharePoint Framework (SPFx) Packages from Tenant App Catalog to Hub Site and Associated Sites covers how to deploy SPFx solutions across a hub site and associated sites.

Deploying SharePoint Framework (SPFx) Packages from Tenant App Catalog to Hub Site and Associated Sites There is the blog post how Deploying and Installing SharePoint Framework (SPFx) solutions using PnP PowerShell to Hub Site and Associated Sites using site collection app catalog. This post covers how to perform same objective but using the tenant level app catalog if the SPFx packages have not been added to all sites globally during deployment in the tenant level app catalog and instead need targeted deployment or upgrades on specific sites.

Automating Site Reindexing with PowerShell Introduction Keeping your SharePoint environment up-to-date is crucial, especially after making schema changes. One important aspect of maintaining accurate and relevant search results is to regularly reindex sites, libraries, or lists. In this blog post, we will explore a streamlined approach using PnP PowerShell to automate the reindexing process. By leveraging this script, you can ensure that your search results reflect the latest changes in your SharePoint environment.

For many organizations, maintaining a consistent brand identity across SharePoint sites is crucial. The distinction between “Site Logo” and “Site Logo Thumbnail” is essential, as they serve different purposes across SharePoint and the Microsoft 365 ecosystem. The site logo appears in the site header, while the site logo thumbnail is used in search results, site cards, when copying/moving files, and other critical areas. It plays a vital role in helping end users differentiate between various SharePoint Online (SPO) sites and Teams.

Unveiling Audit Logs with PnP PowerShell for the last 7 days Understanding and tracking activities within your M365 environment is crucial for maintaining security and compliance. Audit Logs offer a wealth of information, and in this post, we’ll delve into the methods to retrieve and analyze them. Specifically, we’ll focus on leveraging the Office 365 Management Activity API reference through the Get-PnPUnifiedAuditLog PnP PowerShell cmdlet. It is a great alternative if you are only a SharePoint Administrator with no global admin or Purview Audit logs access.

Recreating Deleted Owners Group for M365-Connected SharePoint Sites If out-of-the-box (OOB) groups such as owners, members, or visitors have been deleted accidentally from your SharePoint site, this article may assist you in recovering those vanished groups specifically for M365 linked Team site. I recently encountered a distress call from an end user facing data access issues on a SharePoint Team site. To my dismay, I discovered that the SharePoint Owners group had been accidentally deleted, prompting me to seek and implement a solution to restore access.

A Guide to Contributing to PnP PowerShell Contributing to PnP PowerShell is a rewarding journey. Whether you’re a seasoned contributor or a beginner, this guide aims to simplify the process and keep it handy for your next contribution. Prerequisites To set up the development to start hacking on PnP PowerShell, install the following Install Git Install PowerShell 7 Install Visual Code or Visual Studio Code Install .NET SDK 6 (https://dotnet.microsoft.com/download/dotnet/6.0) Forking and cloning First things first, make a copy of the repository to start working on your changes.

Discovering All Checked Out Files including those with no checked in versions There are scenarios when files uploaded won’t have “checked-in version” which will make the files visible only to their uploader. Two possible scenarios that can lead to the situation: Mandatory Metadata Requirements: When there are mandatory fields configured on the libraries and end users use Onedrive as a medium to upload the files to SharePoint via a shortcut to OneDrive.

How to Hide the “See All” Button in the Highlighted Content Web Part using PnP PowerShell Recently, I encountered an issue with the “Show Title and Commands” toggle in the out-of-the-box Highlighted Content web part. It stopped working on both my development and customer tenant. I’ve raised the issue on the Microsoft Forum and also opened a case with Microsoft to investigate the backend. While awaiting a resolution from Microsoft, I decided to find a workaround.

Ensure Taxonomy Feature In SharePoint site connected to a Private/Shared Channel Sites Taxonomy feature is not activated by default in SharePoint sites linked to a private or shared Teams Channels. When attempting to add content types with managed metadata columns, you may encounter an error message stating “Taxonomy disabled”. To resolve this issue, you can enable the taxonomy feature with the ID 73ef14b1-13a9-416b-a9b5-ececa2b0604c using the PowerShell cmdlet Enable-PnPFeature before adding the content types to the sites with the template TEAMCHANNEL#1.

Ensure Owners Are Members M365Group Microsoft 365 (M365) Groups serve as a central hub for collaboration across various M365 applications like Teams, Planner, SharePoint, and more. While M365 roles include Owners, Members, and Guests, it’s crucial to understand that being an owner doesn’t always inherit member privileges. In this article, we’ll explore why it’s imperative to have M365 Group owners also serve as active members for seamless group management and productivity.

Github does not provide an easy way to export all your pull requests for review or sharing with anyone. Below is a great post to show how to do it using BASH. GitHub: Get a CSV containing my pull requests (PRs) If you are using windows machine, PowerShell is your friend. Install GitHub CLI via command line winget install --id GitHub.cli Enter Y to the question Do you agree to all the source agreements terms?

Troubleshooting SharePoint Storage Reports with PowerShell As the amount of data stored in SharePoint grows, it becomes important to monitor and manage storage usage. In this blog post, we will explore how to generate storage reports for SharePoint sites using PowerShell. These reports will provide insights into the storage usage of sites and individual files, including file versions and the size of the recycle bin. However the reports can only give a glimpse of at least 60-90% of storage.