How to Clean Up Orphaned SharePoint Sites and Users (The Ultimate Guide)

As a Microsoft 365 Administrator, one of the most persistent security and governance nightmares is dealing with orphaned SharePoint sites and users.

When employees leave the company, or external contractors finish their projects, their accounts are typically disabled or deleted from Microsoft Entra ID (formerly Azure AD). However, their footprint within SharePoint Online often remains untouched. These “orphaned” accounts still hold permissions to sensitive documents, and sites without active owners quickly turn into compliance risks.

In this guide, we will walk you through the manual PowerShell methods to identify and clean up orphaned SharePoint sites and users, and then show you a much faster, automated way to handle it.

The Security Risks of Orphaned Users and Sites

Before diving into the technical solution, it is important to understand why cleaning up these artifacts is critical for your M365 governance strategy:

• Data Breach Vulnerability: Disabled accounts that still hold permissions can be exploited if an attacker manages to re-enable or hijack the identity.
• Compliance Violations: Auditors heavily scrutinize environments that retain access for terminated employees.
• Administrative Overhead: Sites without active owners (Orphaned Sites) clutter your tenant, making storage management and site lifecycle governance impossible.

How to Find Orphaned SharePoint Sites using PowerShell

An orphaned site is a SharePoint site collection where all Site Administrators have been deleted or disabled in Entra ID. To find these sites, you can use the PnP PowerShell module.

Here is a script to scan your tenant and identify sites lacking active owners:

# Connect to SharePoint Admin Center
Connect-PnPOnline -Url "https://yourtenant-admin.sharepoint.com" -Interactive -ClientId <your-client-id>

# Get all site collections
$AllSites = Get-PnPTenantSite

$OrphanedSites = @()

foreach ($Site in $AllSites) {
    # Get Site Admins
    $Admins = Get-PnPTenantSite -Identity $Site.Url -Detailed | Select-Object -ExpandProperty Owners
    
    $HasActiveOwner = $false
    foreach ($Admin in $Admins) {
        # Check if the user exists and is active in Entra ID
        $User = Get-PnPEntraIDUser -Identity $Admin.LoginName -ErrorAction SilentlyContinue
        if ($User -and $User.AccountEnabled -eq $true) {
            $HasActiveOwner = $true
            break
        }
    }
    
    if (-not $HasActiveOwner) {
        $OrphanedSites += $Site.Url
        Write-Host "Orphaned Site Found: $($Site.Url)" -ForegroundColor Red
    }
}

# Export results
$OrphanedSites | Out-File -FilePath "C:\Temp\OrphanedSites.txt"

Warning: Running this script on a large tenant (1,000+ sites) can take hours and may run into throttling limits. Always test scripts in a non-production environment first.

How to Remove Orphaned Users from a SharePoint Site

Once you have identified disabled users, you need to strip their permissions from SharePoint. Simply deleting them from Entra ID does not instantly remove their permissions across all SharePoint Document Libraries.

You can remove a user from a specific site using this snippet:

# Connect to the specific site
Connect-PnPOnline -Url "https://yourtenant.sharepoint.com/sites/Marketing" -Interactive -ClientId <your-client-id>

# Remove the orphaned user
Remove-PnPUser -Identity "terminated.employee@yourdomain.com" -Force

Write-Host "User removed successfully." -ForegroundColor Green

While effective, doing this manually across hundreds of sites and thousands of files where unique permissions (item-level permissions) are broken is nearly impossible.

The Better Way: Automate Cleanup with SPClean

If you are managing a mid-to-large Microsoft 365 environment, writing and maintaining custom scripts to handle API throttling, pagination, and unique item-level permissions is exhausting.

That is why we built SPClean.

SPClean is a robust, native PowerShell module designed specifically for M365 Administrators to automate the entire cleanup process.

Why Use SPClean?

• Tenant-Wide Scanning: Instantly scans thousands of sites to identify orphaned users and ownerless sites without PowerShell throttling issues.
• What-If Dry Runs: Safely preview exactly which users will be removed and which sites will be flagged before making any actual changes.
• One-Click Remediation: Automatically strip permissions from disabled Entra ID users across all Site Groups, Lists, and deeply nested Folders.

Conclusion

Governing a Microsoft 365 tenant requires vigilance, especially when it comes to the user offboarding lifecycle. While PnP PowerShell provides the raw tools necessary to find and clean up orphaned SharePoint sites and users, manual scripting doesn’t scale well.

By implementing automated solutions like SPClean, you can ensure your tenant remains secure, compliant, and free of administrative clutter.

If you found this guide helpful, be sure to check out our other Admin Automation tutorials!