How to Clean Up SharePoint: Best Practices From Microsoft MVPs

A SharePoint cleanup works best in this order: inventory what you have, report on permissions and fix them from the bottom up, archive or delete stale content, retire custom code and old forms and workflows, then keep it clean with regular reports. That's the advice our 2017 panel of Microsoft MVPs gave, and most of it matters even more now that Microsoft 365 Copilot can surface anything a user has access to.

Published: 2017-09-29

Last updated: 2026-11-09

Where this advice comes from

In August 2017 we hosted the first episode of The Expert Series, a 60-minute webinar on SharePoint cleanup, with four Microsoft MVPs on the panel:

• Joel Oleson, who joined the SharePoint product team at the start, on user experience and intranets.
• Liam Cleary, on security and permissions.
• Andrew Connell, on development and custom code.
• Vlad Catrinescu, on infrastructure and administration.

The audience was mostly on SharePoint 2013, with some on 2016 and SharePoint Online. Their top cleanup priority in the poll was permissions and security, followed by performance. Below is the panel's advice, grouped by area, with notes on what has changed since.

1. Start with an inventory

Asked what a new admin should do first with a farm nobody had managed for two years, Vlad's answer was to find out how SharePoint is used and by whom, document what the infrastructure looks like, and check that backups work before anything else, so a deleted site on day two isn't a crisis.

The same applies in SharePoint Online. You need a list of every site, subsite, list and library, with size, owner and last activity, before you can decide what to keep.

• Built-in: the SharePoint admin center's Active sites page exports site collections with storage and last activity. It doesn't include subsites or lists.
• Toolkit (free): Get inventory of sites & lists exports sites, subsites, lists and libraries with sizes, item counts, settings and last modified dates. See SharePoint inventory: export everything to Excel.

2. Clean up permissions from the bottom up

Liam's first point was that SharePoint has no built-in view of who has access to everything, so cleanup starts with a report, whether from PowerShell or a tool. Then:

• Start with unique permissions and direct grants. Look for broken inheritance and individual accounts added straight to lists, folders and files. Work "from the bottom upwards", from the lowest level where permissions can be set.
• Use groups as the model, with sensible exceptions. Put people in directory groups, put those groups in SharePoint groups, and grant permissions to the SharePoint groups. But don't create a directory group for five people; it's fine to add a few individuals where needed.
• Write down why. "Nine times out of 10, when I do an audit of an environment, no one seems to know why something was done."
• Make it routine. One of Liam's clients sent a security report to site owners every 30 days. He suggested an audit at least every quarter.

"Just because the CEO says he wants access, tell him 'no,' because he may not need access." — Liam Cleary

Toolkit: the permissions report, sharing links report and Full Control report are free in Community Edition. Bulk changes, such as removing an account everywhere, are part of Enterprise.

3. Archive or delete stale content

Joel's point was about relevance: if the home page still shows news from two years ago, people stop visiting, even when a list two levels down is busy. Clean up the high-visibility pages, archive old content, and get departments to own their own news instead of one person who hates writing it.

On finding unused sites, Vlad warned that PowerShell's site-level LastContentModifiedDate is often wrong, because Microsoft's own system changes update it. A site nobody has opened in a year can show yesterday's date.

• Built-in: use last activity in the admin center and the SharePoint site usage report. SharePoint Advanced Management adds inactive site policies that email owners and can make sites read-only or archive them.
• Toolkit (free): the list inventory's Is Unused column and last item modified dates work at list level, where the signal is more reliable. Largest files and version history shows where storage goes.

4. Retire custom code, old forms and old workflows

Andrew's advice was to "build like you're going to the cloud": move away from farm solutions (WSPs) and server-side code, build client-side with the SharePoint Framework where you can, and run anything that has to be server-side outside SharePoint, calling it through the APIs. For existing code, decide case by case whether it's worth rebuilding.

Joel added two points. Before building, check whether a product already does it. On upgrade, avoid the forklift:

"The forklift scenario to pick it up and dump it has got to go." — Joel Oleson

Build the destination first, then decide what moves into it. Specifically, he said to let InfoPath go and move to Power Automate, Power Apps or another current product.

Toolkit (free): Content search > Text on pages and in web parts finds pages that still embed old Script Editor or Content Editor code, or reference a retired script, across sites.

Andrew also answered a question about whether the SharePoint Framework opens security holes. His point: the risk is the same as for any custom code. If someone can change a script file your web part loads from a CDN, that script runs as whoever views the page, including the CEO. Review code before it goes to production, and control who can change deployed files.

5. Fix broken links

Broken links came up in the audience questions: how to find links to documents and images that were moved or deleted. After a migration or a restructure, links in pages, documents and navigation break quietly.

• Toolkit (free): Find broken links scans pages, web parts, navigation and Office and PDF files. Replacing links in bulk is part of Enterprise. See how to find broken links in SharePoint.

One attendee asked whether scanning 20,000 files would slow the farm. The answer then, still true: the toolkit reads through the same client APIs a browser uses, so the load is similar to someone opening those files, and how many requests run at once is what matters.

6. Remove people who have left

Asked how to remove deleted users from site collections, Vlad's answer was PowerShell: list each site's users, check whether each still exists in the directory, and remove the ones that don't.

• Toolkit: filter the free permissions report or user inventory by the people who left to see everywhere they still have access. Clean orphaned users, which removes accounts that no longer exist in the directory, is part of Enterprise.

7. On-premises: keep the farm healthy

Vlad's top three maintenance practices, still the right list for SharePoint Server:

1. Patch. Install SharePoint and Windows updates regularly. Unpatched servers are how attackers get in.
2. Read the logs. Check the event logs, SQL Server and search crawl logs. He had seen farms with 300,000 crawl errors on a million documents, meaning a third of the content couldn't be found.
3. Secure and document. Use HTTPS everywhere, and document the farm, certificates and their expiry dates, and what each custom solution touches.

For content databases, he recommended keeping them small, ideally under 200 GB, even though larger is supported, because backup, restore and migration are faster. Use Move-SPSite to give a large site collection its own database. Set up SQL maintenance plans, choose the recovery model to match your backups so logs don't grow unchecked, and pre-grow new databases so SQL Server isn't auto-growing during uploads.

A starter script: site inventory with storage and activity

The original webinar came with two site inventory scripts. This short replacement uses the SharePoint Online Management Shell and only reads. Treat LastContentModifiedDate as a hint, for the reason Vlad gave.

# Every site collection with storage, owner, sharing and last content change
Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

Get-SPOSite -Limit All -IncludePersonalSite:$false |
    Select-Object Url, Title, Template, Owner, StorageUsageCurrent, SharingCapability, LastContentModifiedDate |
    Sort-Object LastContentModifiedDate |
    Export-Csv "C:\Reports\site-inventory.csv" -NoTypeInformation -Encoding UTF8

Cleanup checklist

Frequently asked questions

Where should a SharePoint cleanup start?

With an inventory: every site, list and library, how big it is, who owns it and when it was last used. You can't decide what to keep, archive or fix without it. Then report on permissions before changing any.

How do I clean up SharePoint permissions?

Export a permissions report first. Start at the lowest level, with items and lists that have unique permissions and direct grants to individual people, and work upwards. Replace individual grants with groups where it makes sense, record why any exception exists, and re-run the report at least quarterly.

How do I find unused SharePoint sites?

Use last activity from the SharePoint admin center or usage reports, and last item modified dates at list level. Site-level LastContentModifiedDate from PowerShell can be misleading, because system changes update it. SharePoint Advanced Management adds inactive site policies, and the toolkit's list inventory flags unused lists.

What custom code needs cleaning up before moving to SharePoint Online?

Farm solutions (WSPs) and server-side code don't run in SharePoint Online. In SharePoint Online, SharePoint Add-ins and SharePoint 2013 workflows were retired on April 2, 2026, and InfoPath Forms Services was removed after July 14, 2026. Replace them with SharePoint Framework, Power Automate and Power Apps.

How often should SharePoint be cleaned up?

Treat it as a routine, not a project. Liam Cleary described a client that sent a security report to site owners every 30 days; at a minimum, review permissions and stale content quarterly, and always before a migration.