# Install and connect to SharePoint Online
Install-Module Microsoft.Online.SharePoint.PowerShell -Force
Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

# Export full site collection inventory
Get-SPOSite -Limit All |
  Select-Object Url,Title,Template,StorageUsageCurrent,StorageQuota,SharingCapability,HubSiteId,IsHubSite,Owner |
  Export-Csv -Path "AllSiteCollections.csv" -NoTypeInformation

# Create a new Team site (no M365 Group)
New-SPOSite -Url "https://contoso.sharepoint.com/sites/ITDept" `
  -Owner "admin@contoso.com" `
  -StorageQuota 5120 `
  -Template "STS#3" `
  -Title "IT Department"

# Create a Communication site
New-SPOSite -Url "https://contoso.sharepoint.com/sites/CompanyIntranet" `
  -Owner "admin@contoso.com" `
  -StorageQuota 10240 `
  -Template "SITEPAGEPUBLISHING#0" `
  -Title "Company Intranet"

# Register a site as a Hub site
Register-SPOHubSite -Site "https://contoso.sharepoint.com/sites/CorporateHub"

# Associate a child site to a Hub
Add-SPOHubSiteAssociation `
  -Site "https://contoso.sharepoint.com/sites/ITDept" `
  -HubSite "https://contoso.sharepoint.com/sites/CorporateHub"

# Get all Hub sites in the tenant
Get-SPOHubSite | Select-Object SiteUrl,Title,SiteId | Format-Table -AutoSize

# Update storage quota on a site
Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/ITDept" -StorageQuota 10240 -StorageQuotaWarningLevel 9216

# Find sites approaching storage limit (above 90%)
Get-SPOSite -Limit All |
  Where-Object {$_.StorageQuota -gt 0 -and ($_.StorageUsageCurrent / $_.StorageQuota) -gt 0.9} |
  Select-Object Url,Title,StorageUsageCurrent,StorageQuota |
  Format-Table -AutoSize

Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

# List all sites in the deleted site recycle bin
Get-SPODeletedSite -Limit All |
  Select-Object Url,Title,DaysRemaining,StorageUsageCurrent |
  Sort-Object DaysRemaining |
  Format-Table -AutoSize

# Restore a deleted site collection (within 93 days)
Restore-SPODeletedSite -Identity "https://contoso.sharepoint.com/sites/ProjectBeta"
Write-Host "Site restored successfully."

# Permanently delete a specific site from recycle bin
Remove-SPODeletedSite -Identity "https://contoso.sharepoint.com/sites/OldProject2023"

# Delete an active site (moves to deleted sites recycle bin)
Remove-SPOSite -Identity "https://contoso.sharepoint.com/sites/ObsoleteTeam"

# Find deleted sites expiring within 7 days — urgent restore window
Get-SPODeletedSite -Limit All |
  Where-Object {$_.DaysRemaining -le 7} |
  Select-Object Url,Title,DaysRemaining |
  Format-Table -AutoSize

Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

# Check current tenant-wide sharing settings
Get-SPOTenant | Select-Object SharingCapability,DefaultSharingLinkType,RequireAnonymousLinksExpireInDays,FileAnonymousLinkType,FolderAnonymousLinkType,SharingAllowedDomainList,SharingBlockedDomainList

# Set tenant sharing level
# Options: Disabled | ExistingExternalUserSharingOnly | ExternalUserSharingOnly | ExternalUserAndGuestSharing
Set-SPOTenant -SharingCapability ExternalUserSharingOnly

# Require anonymous links to expire after 14 days
Set-SPOTenant -RequireAnonymousLinksExpireInDays 14

# Block anonymous file links (allow for folder-level only)
Set-SPOTenant -FileAnonymousLinkType View

# Set default sharing link to Specific people (Direct)
Set-SPOTenant -DefaultSharingLinkType Direct

# Restrict external sharing to approved domains only (allow list)
Set-SPOTenant -SharingDomainRestrictionMode AllowList -SharingAllowedDomainList "partner.com fabrikam.com"

# Allow external sharing on a specific collaboration site
Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/ExtCollab" -SharingCapability ExternalUserAndGuestSharing

# Lock down Finance site to internal users only
Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/Finance" -SharingCapability Disabled

# Export all external (guest) users across the tenant
Get-SPOExternalUser -Limit All |
  Select-Object DisplayName,Email,AcceptedAs,WhenCreated,InvitedBy,UniqueId |
  Export-Csv -Path "TenantExternalUsers.csv" -NoTypeInformation
Write-Host "External user report exported."

Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

# Get current access control settings
Get-SPOTenant | Select-Object ConditionalAccessPolicy,IPAddressEnforcement,IPAddressAllowList,EmailAttestationRequired

# Set tenant-wide unmanaged device policy
# Options: AllowFullAccess | AllowLimitedAccess | BlockAccess
Set-SPOTenant -ConditionalAccessPolicy AllowLimitedAccess

# Override to block access on a sensitive site (Finance)
Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/Finance" -ConditionalAccessPolicy BlockAccess

# Allow full access on a specific site regardless of tenant policy
Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/PublicIntranet" -ConditionalAccessPolicy AllowFullAccess

# Restrict access to specific IP ranges (network location policy)
Set-SPOTenant -IPAddressEnforcement $true `
  -IPAddressAllowList "203.0.113.0/24,192.168.10.0/24,10.0.0.0/8"

# Enable idle session sign-out
Set-SPOTenant -SignOutWhenCredentialsExpire $true

# Require email verification for guests on unmanaged devices every 30 days
Set-SPOTenant -EmailAttestationRequired $true -EmailAttestationReAuthDays 30

Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

# Get current sync client restriction settings
Get-SPOTenantSyncClientRestriction

# Allow sync only on devices joined to specific AD domains
# Get domain GUIDs: Get-ADDomain | Select-Object ObjectGUID (run on a DC)
Set-SPOTenantSyncClientRestriction -Enable `
  -DomainGuids @("your-domain-guid-1", "your-domain-guid-2")

# Block OneDrive sync on Mac devices
Set-SPOTenant -BlockMacSync $true

# Block specific file extensions from being synced to SharePoint
Set-SPOTenant -ExcludedFileExtensionsForSyncClient @(".tmp", ".vhd", ".iso", ".bak", ".log")

# Verify the sync restriction status
Get-SPOTenantSyncClientRestriction | Select-Object TenantRestrictionEnabled,AllowedDomainList

# Disable sync restrictions (revert to open sync)
Set-SPOTenantSyncClientRestriction -Disable

# Install PnP PowerShell (if not already installed)
Install-Module PnP.PowerShell -Force

# Connect to SharePoint Online
Connect-PnPOnline -Url "https://contoso.sharepoint.com" -Interactive

# Get all term groups in the term store
Get-PnPTermGroup | Select-Object Name,Id,Description | Format-Table -AutoSize

# Get all term sets within a specific group
Get-PnPTermSet -TermGroup "Company Taxonomy" |
  Select-Object Name,Id,IsAvailableForTagging,Contact |
  Format-Table -AutoSize

# Get all terms in a term set
Get-PnPTerm -TermSet "Departments" -TermGroup "Company Taxonomy" |
  Select-Object Name,Id,IsAvailableForTagging |
  Format-Table -AutoSize

# Create a new term group, term set, and terms
New-PnPTermGroup -Name "Finance Taxonomy"
New-PnPTermSet -Name "Cost Centres" -TermGroup "Finance Taxonomy" -Lcid 1033

$TermsToCreate = @("CC-100 Operations", "CC-200 Sales", "CC-300 Marketing", "CC-400 IT")
foreach ($TermName in $TermsToCreate) {
  New-PnPTerm -Name $TermName -TermSet "Cost Centres" -TermGroup "Finance Taxonomy" -Lcid 1033
  Write-Host "Created term: $TermName"
}

# Export full taxonomy to CSV
$Export = @()
Get-PnPTermGroup | ForEach-Object {
  $Group = $_
  Get-PnPTermSet -TermGroup $Group.Name | ForEach-Object {
    $Set = $_
    Get-PnPTerm -TermSet $Set.Name -TermGroup $Group.Name | ForEach-Object {
      $Export += [PSCustomObject]@{ Group=$Group.Name; TermSet=$Set.Name; Term=$_.Name; Id=$_.Id }
    }
  }
}
$Export | Export-Csv -Path "TaxonomyExport.csv" -NoTypeInformation

# Connect to the Content Type Hub site
Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/ContentTypeHub" -Interactive

# Get all content types in the hub
Get-PnPContentType | Select-Object Name,Id,Group,Description | Sort-Object Group,Name | Format-Table -AutoSize

# Get all custom site columns in the hub
Get-PnPField | Where-Object {$_.Group -eq "Contoso Columns"} |
  Select-Object InternalName,Title,TypeAsString,Required |
  Format-Table -AutoSize

# Create a new site column (Choice type) at the hub
Add-PnPField -DisplayName "Retention Category" `
  -InternalName "RetentionCategory" `
  -Type Choice `
  -Group "Contoso Columns" `
  -Choices @("7 Years","3 Years","1 Year","Permanent")

# Create a content type inheriting from Document (0x0101)
Add-PnPContentType -Name "Corporate Contract" `
  -Description "Content type for corporate contracts and legal agreements" `
  -Group "Contoso Content Types" `
  -ParentContentType (Get-PnPContentType -Identity "0x0101")

# Add columns to the content type
Add-PnPFieldToContentType -Field "RetentionCategory" -ContentType "Corporate Contract"

# Get the content type ID for publishing
$CTId = (Get-PnPContentType -Identity "Corporate Contract").Id.StringValue
Write-Host "Content Type ID to publish: $CTId"

# Install the SPMT PowerShell module
Install-Module Microsoft.SharePoint.MigrationTool -Force

# Connect SharePoint Online credentials for migration
$SPOCredential = Get-Credential   # Enter admin@contoso.com credentials

# Register SPMT session
Register-SPMTMigration -SPOCredential $SPOCredential

# Add task: File share → SharePoint Online
Add-SPMTTask -FileShareSource "\\fileserver01\IT-Department" `
  -TargetSiteUrl "https://contoso.sharepoint.com/sites/ITDept" `
  -TargetList "Documents"

# Add task: SharePoint Server site → SharePoint Online
Add-SPMTTask -SharePointSourceSiteUrl "http://sp2019.contoso.local/sites/HR" `
  -SharePointSourceCredential (Get-Credential) `
  -TargetSiteUrl "https://contoso.sharepoint.com/sites/HR"

# Start the migration
Start-SPMTMigration

# Monitor migration status in real time
Show-SPMTMigration

# Stop migration if needed
Stop-SPMTMigration

Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

# View all tenant-level settings
Get-SPOTenant | Format-List

# Disable self-service site creation (only admins can create sites)
Set-SPOTenant -SelfServiceSiteCreationDisabled $true

# Set default storage quota for new sites (in MB)
Set-SPOTenant -StorageQuota 10240   # 10 GB default per new site

# Report tenant storage usage vs total allocation
$Tenant = Get-SPOTenant
Write-Host "Total Storage Allocated: $([math]::Round($Tenant.StorageQuotaAllocated/1024,1)) GB"
Write-Host "Total Storage Used: $([math]::Round((Get-SPOSite -Limit All | Measure-Object StorageUsageCurrent -Sum).Sum/1024,1)) GB"

# Enable the Public CDN for static site assets
Set-SPOTenantCdnEnabled -CdnType Public -Enable $true

# Add a CDN origin library
Add-SPOTenantCdnOrigin -CdnType Public -OriginUrl "/sites/CompanyIntranet/SiteAssets"

# List all CDN origins
Get-SPOTenantCdnOrigins -CdnType Public

# Set the organisational Home site (root intranet)
Set-SPOHomeSite -HomeSiteUrl "https://contoso.sharepoint.com/sites/Intranet"

# Get the current home site
Get-SPOHomeSite

Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

# Get all site collection administrators across all sites
$Sites = Get-SPOSite -Limit All -IncludePersonalSite $false
$AdminReport = @()

foreach ($Site in $Sites) {
  $Admins = Get-SPOUser -Site $Site.Url -Limit All | Where-Object {$_.IsSiteAdmin}
  if ($Admins) {
    foreach ($Admin in $Admins) {
      $AdminReport += [PSCustomObject]@{
        SiteUrl   = $Site.Url
        SiteTitle = $Site.Title
        Admin     = $Admin.LoginName
        AdminName = $Admin.DisplayName
      }
    }
  } else {
    $AdminReport += [PSCustomObject]@{
      SiteUrl   = $Site.Url
      SiteTitle = $Site.Title
      Admin     = "NO ADMIN"
      AdminName = "NO ADMIN"
    }
  }
}
$AdminReport | Export-Csv -Path "SiteAdminReport.csv" -NoTypeInformation

# Flag sites with no site collection admin (governance gap)
$AdminReport | Where-Object {$_.Admin -eq "NO ADMIN"} | Format-Table SiteUrl,SiteTitle

# Get all guest users on a specific site (login name contains #ext#)
Get-SPOUser -Site "https://contoso.sharepoint.com/sites/ExtCollab" -Limit All |
  Where-Object {$_.LoginName -like "*#ext#*"} |
  Select-Object DisplayName,LoginName,IsSiteAdmin |
  Format-Table -AutoSize