How to Provision SharePoint Site Collections at Scale (with Governance)

Microsoft 365 enables users to collaborate seamlessly by allowing self-service site and Microsoft 365 Group creation by default. While this empowers end-users, it often leads to a massive headache for IT administrators: Site Sprawl.

Table of Contents

Why Site Sprawl Happens in SharePoint Online

Without a structured provisioning process, organizations often end up with duplicated site names, inconsistent URLs, unmanaged storage quotas, and compliance risks.

Many enterprises choose to restrict or govern self-service site creation through approval workflows, naming policies, and sensitivity labels rather than allowing unrestricted site creation. Implementing a centralized, automated provisioning engine using PnP PowerShell ensures every site adheres to your corporate standards from day one.

Governance Requirements Before Provisioning

Before writing any automation scripts, you must define your governance blueprint. A robust site provisioning strategy should address:

Naming Conventions: Enforce prefixes for site titles and URLs (e.g., PRJ- for Projects, DEPT- for Departments) to ensure the directory remains readable and avoids naming collisions.
Storage Models: Decide between Automatic Storage Management (recommended by Microsoft for most) and Manual Storage Quotas (for chargeback models or highly regulated environments).
External Sharing and Sensitivity: Define whether external sharing is allowed by default, and map out Sensitivity Labels to protect confidential data.
Lifecycle Management: Plan for site expiration, retention, and archiving.

Creating SharePoint Sites with PnP PowerShell

Once your governance model is defined, IT can accept site requests (via a Microsoft Form, ServiceNow, or a SharePoint List) and use PnP PowerShell to fulfill them.

The following script provisions both Team Sites (which include a Microsoft 365 Group) and Communication Sites (which do not), while enforcing a clean naming convention for the URL alias.


# Setup connection to the Tenant Admin Center
$AdminCenterUrl = "https://contoso-admin.sharepoint.com"
[System.Environment]::SetEnvironmentVariable('ENTRAID_CLIENT_ID', 'Your-client-id', 'User')

Connect-PnPOnline -Url $AdminCenterUrl -Interactive

# Example dataset (usually imported via Import-Csv)
$SiteRequests = @(
    @{ Type="TeamSite"; Category="Project"; Name="Apollo Team"; Owner="admin@contoso.com" },
    @{ Type="CommunicationSite"; Category="Department"; Name="Finance Portal"; Owner="finance.lead@contoso.com" }
)

foreach ($Request in $SiteRequests) {
    try {
        # 1. Enforce Naming Conventions
        $Prefix = if ($Request.Category -eq "Project") { "PRJ-" } else { "DEPT-" }
        $SiteTitle = "$Prefix$($Request.Name)"
        
        # Clean the alias for the URL (e.g. "PRJ-Apollo Team" -> "PRJ-Apollo-Team")
        $CleanAlias = $SiteTitle -replace '[^a-zA-Z0-9-]', '-' -replace '-+', '-'
        $SiteUrl = "https://contoso.sharepoint.com/sites/$CleanAlias"
        
        Write-Host "Provisioning Site: $SiteTitle at $SiteUrl..." -ForegroundColor Cyan
        
        # 2. Create the Site based on Template Type
        if ($Request.Type -eq "TeamSite") {
            New-PnPSite `
                -Type TeamSite `
                -Title $SiteTitle `
                -Alias $CleanAlias `
                -Owners $Request.Owner `
                -Wait | Out-Null
        } else {
            # Note: Communication Sites do not create an M365 Group. 
            # Ownership is managed purely through SharePoint site permissions.
            New-PnPSite `
                -Type CommunicationSite `
                -Title $SiteTitle `
                -Url $SiteUrl `
                -Owner $Request.Owner `
                -Wait | Out-Null
        }
            
        Write-Host "Successfully created $SiteTitle" -ForegroundColor Green
    }
    catch {
        Write-Warning "Failed to create site $($Request.Name): $($_.Exception.Message)"
    }
}

Applying Governance Automatically

Creating the site is only the first step. Immediately after creation, you must apply your governance settings, templates, and hub associations.

Managing Storage Quotas

Advanced Governance Scenario: While Microsoft recommends Automatic Storage Management, some highly regulated environments or chargeback models require strict manual quotas.


# Define Storage Quota (e.g., 25 GB)
$StorageQuotaMB = 25600
$WarningLevelMB = 23040 # 90% warning level

Set-PnPTenantSite `
    -Url $SiteUrl `
    -StorageQuota $StorageQuotaMB `
    -StorageQuotaWarningLevel $WarningLevelMB

Applying Sensitivity Labels

In modern Microsoft 365 governance, Sensitivity Labels are the primary mechanism for controlling sharing and device access policies. You can apply a label directly during or immediately after provisioning:


$HighlyConfidentialLabelId = "a1b2c3d4-e5f6-7a8b-9c0d-123456789abc"

Set-PnPTenantSite `
    -Url $SiteUrl `
    -SensitivityLabel $HighlyConfidentialLabelId

Associating Sites with Hub Sites

To ensure navigation consistency, unified search scopes, and shared branding, enterprise sites should be associated with a Hub Site upon creation:


$HubSiteUrl = "https://contoso.sharepoint.com/sites/CorporateHub"
Add-PnPHubSiteAssociation -Site $SiteUrl -HubSite $HubSiteUrl

Applying PnP Provisioning Templates

Instead of manually configuring web parts and lists, apply a standardized template using Invoke-PnPSiteTemplate. This ensures every project or department site starts with the exact same functional architecture.

Lifecycle Governance

Provisioning a site is only 10% of the governance equation; Lifecycle Management is the other 90%. A complete governance strategy must include:

M365 Group Expiration Policies: Automatically prompt owners to renew active sites and archive inactive ones.
Access Reviews: Regularly require site owners to audit and recertify guest and member access.
Microsoft Purview Retention Labels: Ensure critical data is retained for legal compliance and obsolete data is securely deleted.

Preventing Ownerless Sites

A core pillar of SharePoint governance is ensuring every Site Collection has an active, accountable owner. However, as employees transition roles or leave the company, their accounts are disabled in Entra ID.

If a Site Owner’s account is disabled, the site becomes “ownerless,” posing a severe security risk as access requests, sharing approvals, and lifecycle management are completely halted.

Instead of manually auditing thousands of sites, we highly recommend utilizing SPClean. SPClean proactively scans your SharePoint tenant to identify orphaned administrators and ownerless sites. It provides automated remediation pathways to assign new owners, ensuring your governance model remains intact even through heavy employee turnover.

FAQ

Should I disable self-service SharePoint site creation?
While you shouldn’t strictly block all creation, it is a best practice for enterprises to govern it via approval workflows and automated provisioning to maintain naming and compliance standards.

Can PnP PowerShell apply sensitivity labels?
Yes. You can use the -SensitivityLabel parameter with Set-PnPTenantSite to apply labels programmatically.

What is the maximum storage size for a SharePoint Online site?
A single SharePoint Online site collection can store up to 25 TB of data, provided your tenant has sufficient pooled storage available.

Conclusion

Provisioning SharePoint sites at scale requires more than just a New-PnPSite command; it requires a comprehensive approach to naming conventions, templates, sensitivity labels, and lifecycle management. By using PnP PowerShell to centralize creation, you eliminate site sprawl and maintain a clean, performant, and secure Microsoft 365 environment.