Browse Category


PowerShell for SharePoint Site Designs & Site Scripts

SharePoint site designs and site scripts allow you to provision sites and apply your own configurations at that time. This solution allows you to drive consistency for sites being created in SharePoint Online. The management of these is currently all done by PowerShell. I have been working with these and building presentations on them and have put together a collection of PowerShell scripts that I found useful. This includes a lot of the base functionality for working with them but is absolutely not all inclusive.

This is not intended to be ran as 1 full script but use pieces of these together and run sections that you need at a point in time. A few things this script includes:

  • Creating site scripts and site designs
  • Add and remove site scripts from an existing site design
  • Setting site design view rights
  • Getting site scripts from a list
  • Viewing status and information about previous ran or running site designs

PowerShell scripts

Here is the link to the repository on Github for the site design and site script PowerShell file.

Please help update as well!

Key links

SharePoint site designs and site scripts overview from Microsoft docs customization/site-design-overview

Multiple provisioning blog posts from Beau Cameron

PnP Remote Provisioning

Amazing info from Laura Kokkarinen

Sharing a File in SharePoint Online or OneDrive with PowerShell

I have been diving into doing larger scale operations in SharePoint Online using the Client Side Object Model (CSOM) utilizing PowerShell and ran into a scenario that I couldn’t easily find documented anywhere. What I wanted to do was technically “share” a file with a specific user and have that user receive an email just like if it was done through the GUI. What I didn’t want to see is just the breaking of permissions. What I found was the Web.ShareObject method and this great blog post from Vesa Juvonen in 2015

Once I found this I started working on putting this into a useful PowerShell format. To get started with CSOM & PowerShell with SharePoint Online here is a good blog post from Chris O’Brien. You can get the latest version of SharePoint Online CSOM here. If you download the nuget file you can change the file extension to .zip and extract the .dlls.

Here is link to the GitHub rep and I will break it down below along with the script. Here are some key things to note:

  • The Web.ShareObject method has been updated since the Vesa blog post with a parameter called useSimplifiedRoles that can be used for utilizing modern sharing
  • SharePoint PnP has extended the sharing APIs and built a sample that can be used
  • This script is built to share a file based on filename within a site to a single user
  • This works on SharePoint Online and OneDrive for Business
  • It will share as the user who runs the script
  • This script could be updated to share a site or to multiple people
  • You can share with Edit or View permission based on the roleValue
  • It doesn’t replicate the modern sharing UI in capabilities exactly (more of what occurs details below)

To utilize the script make sure you fill out the appropriate variables and more information about what this will do is below the script. 

# Use this script to share a file via CSOM and PowerShell
# ShareObject
# External sharing blog


#path to the SP CSOM files 
$csomPath = "C:\...." 

#Email of person running the script
$adminEmail = ""

#Site collection to be connected to
$siteUrl = ""

#Library title where the file exists
$libraryTitle = "Documents" 

#Filename including file type
$fileName = "Test Document 1.docx"

#Email of who the document is being shared to
$emailSharedTo = ""

#UNVALIDATED_EMAIL_ADDRESS if they are in AD or GUEST_USER if they are not

#role:1073741826 = View, role:1073741827 = Edit
$roleValue = "role:1073741827"

#A flag to determine if permissions should be pushed to items with unique permissions.
$propageAcl = $true

#Flag to determine if an e-mail notification should to sent, if e-mail is configured.
$sendEmail = $true  

#If an e-mail is being sent, this determines if an anonymous link should be added to the message.
$includedAnonymousLinkInEmail = $false  

#The ID of the group to be added to. Use zero if not adding to a permissions group. Not actually used by the code even when user is added to existing group. 
$groupId = 0

#Doesn't matter as it isn't sent in current email format
$emailSubject = ""

#Text for the body of the e-mail.
$emailBody = "Check out my email body"  

#Use modern sharing links instead of directly granting access
$useSimplifiedRoles = $true

# Get CSOM files
Add-type -Path "$csomPath\Microsoft.SharePoint.Client.dll"
Add-type -Path "$csomPath\Microsoft.SharePoint.Client.Runtime.dll"

# Connnect to site
$ss = Read-Host -Prompt "Enter admin password" -AsSecureString
$ctx = New-Object Microsoft.SharePoint.Client.ClientContext($siteUrl)
$creds = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($adminEmail, $ss)
$ctx.Credentials = $creds
if(!$ctx.ServerObjectIsNull.Value) { 
    Write-Host "Connected to site:" $siteUrl -ForegroundColor Green 
# Get web
$web = $ctx.Web

# Connect to library
$list = $web.Lists.GetByTitle($libraryTitle)

# Get doc
$query = New-Object Microsoft.SharePoint.Client.CamlQuery
$caml ="<View Scope='RecursiveAll'><Query><Where><Eq><FieldRef Name='FileLeafRef'/><Value Type='File'>" + $fileName + "</Value></Eq></Where></Query></View>"
$query.ViewXml = $caml
$item = $list.GetItems($query)
if (!$item) {
    Write-Host "Could not find the file:" $fileName -ForegroundColor Yellow 
} else {
    Write-Host "Sharing the the file:" $item.FieldValues.FileLeafRef -ForegroundColor Green 

# Get doc url
$itemUrl = $item.FieldValues.FileRef
$split = $web.Url -split '/'
$itemUrl = "https://" + $split[2] + $itemUrl

# Build user object to be shared to
$jsonPerson = "[{`"Key`":`"$emailSharedTo`",

# Initiate share
$result = [Microsoft.SharePoint.Client.Web]::ShareObject($web.Context,$itemUrl,$jsonPerson,$roleValue,$groupid,$propageAcl,$sendEmail,$includedAnonymousLinkInEmail,$emailSubject,$emailBody,$useSimplifiedRoles)

Write-Host "Status of the share:" $result.StatusCode -ForegroundColor Green

Starting from a non shared file this is what you will see based on different configurations:

Sharing with useSimplifiedRoles set to $true and sendEmail set to $true

  • The file does not have inheritance broken

  • After initiating the ShareObject, inheritance is broken but you don’t see any changes

  • The person being shared to receives an email that the person who ran the script wants to share a file with you and you will see the email subject is preset but the email body is included

  • Once the person being shared to clicks on the link you can see a new ‘Managed Links’ section in the item permissions

  • If you follow that link you will see the item is now shared with that individual

Sharing with useSimplifiedRoles set to $true and sendEmail set to $false

  • The file does not have inheritance broken
  • After initiating the ShareObject, inheritance is broken but you don’t see any changes if the user tries to access the file through the document library
  • There is a new link viewable in the modern manage access section showing a new sharing link and that someone can access via that link

  • If the user accesses the file via that link you can see a new ‘Managed Links’ section in the item permissions and you can see that user in the Shared with section


Sharing with useSimplifiedRoles set to $false and sendEmail set to $false

  • The file does not have inheritance broken
  • After initiating the ShareObject, inheritance is broken but you don’t see any changes even after a user accesses the file, that means this does nothing but break inheritance

Sharing with useSimplifiedRoles set to $false and sendEmail set to $true

  • The file does not have inheritance broken
  • After initiating the ShareObject, inheritance is broken but you don’t see any changes
  • Once a user accesses the file via the link in the email they are granted permissions directly to the file (contribute instead of edit)


After putting this together I realized I don’t really have a great use case to actually use this. Either way it was a good learning experience for me as I am just getting started into this kind of CSOM & PowerShell work and maybe it will come in handy for someone else in the future. 

Hide Sync for Sites via PowerShell in SharePoint Online – Offline Client Availablity

Offline Client Availability is built within SharePoint to “Prevent users from downloading content from a site” via MS support.   There is not a way that I am aware of to fully stop existing syncs, but what is capable is to hide the Sync option from the views within the document library.  This setting can be done at the site and the library level.  

When working at the site level, this setting actually exists at the “Web” level within SharePoint.  This means its not a site collection level and needs to be set per site, including all subsites. 

What it looks like when done

This is what you will see with this setting set to NO:

Modern experience (no sync option)

Classic experience (sync option greyed out)

This is what you see with this setting set to YES:

Modern experience

Classic experience

Setting via Browser

The Offline Client Availability option can be set by single site under…

  1. On the site, click Settings > Site Settings.
  2. Under Search, click Search and offline availability.
  3. In the Offline Client Availability section, select No.


Setting via PowerShell powershell2

There was a good discussion going on within the MS Tech Community site around the ability to restrict sync via scripting and I tried to put together what I could to support it.  Obviously it would be tedious to try to set that for all sites and subsites across your tenant.  This was my first published attempt for CSOM so I used some great references to get me through it and this is probably rough around the edges.  All feedback is helpful!

Setting this CSOM web property (ExcludeFromOfflineClient) to true does not disable synchronization. Instead, it represents a recommendation to the client not to attempt synchronization via technet.

Ensure that you update the <script path> section near the header with the path to your CSOM files. Ensure you have at least the August 2016 version of CSOM.  Link to latest Nuget for download.

Link to download most recent version of powershell script from TechNet gallery


# Substitute your path to CSOM files (i.e. c:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\ISAPI\Microsoft.SharePoint.Client.Runtime.dll")
Add-Type -Path "<insert path>\Microsoft.SharePoint.Client.dll"
Add-Type -Path "<insert path>\Microsoft.SharePoint.Client.runtime.dll"

# Variables with prompts
$siteUrl = Read-Host -Prompt "Enter Site Collection URL"
$username = Read-Host -Prompt “Enter username”
$password = Read-Host -Prompt “Enter password” -AsSecureString
$subwebcheck = Read-Host -Prompt "Do you want to process subsites? (enter 'Y' if yes)"

# Generate ClientContext(ctx) function so we can reuse
function GetClientContext($siteurl, $username, $password) {
 $ctx = New-Object Microsoft.SharePoint.Client.ClientContext($siteurl) 
 $credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($username, $password) 
 $ctx.Credentials = $credentials
 return $ctx

$ctx = GetClientContext $siteurl $username $password

# Verify connection
if ($ctx.ServerObjectIsNull.Value) { 
 Write-Host "Unable to connect to: '$siteUrl'" -ForegroundColor Red
} else {
 Write-Host "Connected to: '$($siteUrl)'" -ForegroundColor Green 

 $rootWeb = $ctx.Web

 # Update root site
 Write-Host $rootWeb.Url "is being updated to exclude from offline clients"
 Write-Host "ExcludeFromOfflineClient is now" $rootWeb.ExcludeFromOfflineClient "for the site:" $rootWeb.Url -ForegroundColor Green
 if ($subwebcheck -eq "Y") {
 # Work with all subsites
 Write-Host "Processing subsites..." -ForegroundColor Yellow
 $childWebs = $rootWeb.Webs
 foreach ($childWeb in $childWebs)
 processsubsites $childWeb.url

 # Function to loop through subsites and setting values
 function processsubsites ($siteurl){
 $ctx = GetClientContext $siteurl $username $password
 $rootWeb = $ctx.Web
 $childWebs = $rootWeb.Webs

 # Perform update for all template types except APPs to exclude from offline clients
 if($rootWeb.WebTemplate -ne "APP"){
 Write-Host $rootWeb.Url "is being updated to exclude from offline clients"
 Write-Host "ExcludeFromOfflineClient is now" $rootWeb.ExcludeFromOfflineClient "for the site:" $rootWeb.Url -ForegroundColor Green

 # Loop subsites of subsites of subsites...etc
 foreach ($childWeb in $childWebs)
 processsubsites $childWeb.url

Used helpful references 

So much good info already out there that helped me get started; Thank you!

Locking a SharePoint Online Site Collection

Within SharePoint Online you have the ability to completely lock down a site collection so no one can get access to it.  This is set via PowerShell and the SharePoint Online Management Shell.  Here are instructions on how to get started using connecting to SharePoint Online via PowerShell.  This lock can also be set on a user’s OneDrive for Business site collection.

Along with the ability to lock a site collection you can also set a redirect URL for the tenant for any locked sites that are accessed.  That means that when a user tries to access that locked site they will be redirected to the URL that you provided at the tenant level.  This could be helpful to provide instructions or further info for anyone letting them know that the site they were trying to access has been locked.  If no redirect URL is set they will receive a 403 error. 

NOTE: As of writing this post you are not able to set a lock state of a site provisioned with an Office 365 Group even though the PS cmdlets say it should be possible.  I will demo the actions later in this post but I have contacted Microsoft on this error and they state it is currently as designed and the error received is incorrect. 

The PowerShell cmdlets that are used to set this up are:

Steps to lock or unlock a site collection

1 – Connect to SharePoint Online


2 – Locking – Set the -LockState of the site collection to “NoAccess” while replacing the domain and sitecollection info to lock the site

  • This can also be a OneDrive for Business site collection (i.e.
Set-SPOSite -Identity -LockState "NoAccess"


2(a) – Unlocking – Set the -LockState of the site collection to “Unlock” while replacing the domain and sitecollection info to unlock the site

Set-SPOSite -Identity -LockState "Unlock"

3 – Navigate to the URL to confirm and use PowerShell to confirm locked state

Get-SPOSite -Identity | select Title,URL,LockState

Steps to set a tenant redirect URL

1 – Connect to SharePoint Online


2 – Set the NoAccessRedirectURL of the tenant to a URL while replacing the domain and sitecollection info

Set-SPOTenant -NoAccessRedirectUrl ""

3 – Navigate to the URL to confirm the redirect.  This may take a few minutes

To remove the NoAccessRedirectURL you can pass in an empty string

Set-SPOTenant -NoAccessRedirectUrl ""

Trying to lock an Office 365 Group site

Here is the error you receive when trying to lock a group site:


Set-SPOSite : is a OneDrive for Business site collection. The only valid parameters for this type of site collection are ‘-Identity’, ‘-StorageQuota’, ‘-StorageWarningLevel’, ‘-LockState’ and ‘-SharingCapability’.
At line:1 char:1
+ Set-SPOSite -Identity …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Set-SPOSite], ServerException
+ FullyQualifiedErrorId : Microsoft.SharePoint.Client.ServerException,Microsoft.Online.SharePoint.PowerShell.SetSite

The error declares it as a OneDrive for Business site collection and says that -LockState is a valid parameter yet still doesn’t work.  I opened a support ticket with Microsoft and this was their resolution:

“It is by design Issue. We can lock a site collection however we cannot lock a unified group site.”

If this is something that you need I would recommend adding to to Uservoice.  If you need to “lock” an Office 365 Group site the best way as it exists when I am writing this is to remove permissions within the group.

Getting status of all locked site collections in a tenant

Get-SPOSite | Where-Object {$_.LockState -eq "NoAccess"}

At this point Get-SPOSite will not return any OneDrive for Business or Group sites.  There is new parameter called “-IncludePersonalSite” which at some point should return OneDrive sites via this cmdlet.  If you run this now you get the error:

WARNING: SharePoint Online does not support these new features yet.

Get-SPOSite -IncludePersonalSite $true | Where-Object {$_.LockState -eq "NoAccess"}


Ignite 2016 Info and Thoughts on Announcements for SharePoint – OneDrive – Office 365


I put together a Microsoft Sway through my Concurrency tenant that wraps up all of the announcements and my thoughts from the collaboration space at Ignite 2016.  This includes info on everything I was able to attend and intake while here in Atlanta.  I used Microsoft Sway so I could continuously update the Sway throughout the conference and after the conference for future review.  My changes are made in real-time and it’s super easy to update.

Link to Sway