Office 365 and SharePoint Online Using PowerShell: The 2026 Guide

To manage SharePoint Online with PowerShell, use three modules: SharePoint Online Management Shell for tenant and site collection settings, PnP PowerShell for lists, items, files and permissions inside sites, and Microsoft Graph PowerShell for users, groups and Teams. Sign-in has changed: PnP needs your own Entra ID app since September 2024, and scripts using SharePointOnlineCredentials stopped working on May 1, 2026.

Published: 2016-07-10

Last updated: 2026-10-27

Why use PowerShell for SharePoint Online?

• Repeatable work. Create the same project site with the same lists, columns and groups every time, from one script.
• Bulk changes. Change a setting on 400 sites in one run instead of 400 visits to the admin center.
• Reports. Export sites, storage, sharing settings or group members to CSV.
• Settings with no UI. Some tenant and site settings exist only in PowerShell.

What changed since this guide was first written

Which module for which job?

Setup

# Run once. PnP PowerShell needs PowerShell 7; the other two also run in Windows PowerShell 5.1.
Install-Module Microsoft.Online.SharePoint.PowerShell -Scope CurrentUser
Install-Module PnP.PowerShell -Scope CurrentUser
Install-Module Microsoft.Graph -Scope CurrentUser

# Register your own Entra ID app for PnP interactive sign-in (needs rights to create apps and consent)
Register-PnPEntraIDAppForInteractiveLogin -ApplicationName "PnP PowerShell - Contoso" -Tenant "contoso.onmicrosoft.com"

Register-PnPEntraIDAppForInteractiveLogin prints the new app's client ID. Keep it; every PnP connection uses it. The PnP registration guide covers manual setup and narrower permissions.

Connect

Interactive, with MFA

# Tenant administration
Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

# One site, with PnP
$ClientId = "<your-app-id>"
Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/Sales" -Interactive -ClientId $ClientId

# Users and groups
Connect-MgGraph -Scopes "User.Read.All", "Group.Read.All"

Unattended, with a certificate

Connect-SPOService -Url "https://contoso-admin.sharepoint.com" -ClientId "<app-id>" -TenantId "<tenant-id>" `
    -CertificatePath "C:\Certs\spo-automation.pfx"

Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/Sales" -ClientId "<app-id>" `
    -Tenant "contoso.onmicrosoft.com" -CertificatePath "C:\Certs\spo-automation.pfx"

The app needs SharePoint application permissions, such as Sites.FullControl.All, and admin consent. See Connect-SPOService for every sign-in option.

Sites

# Create a communication site and a Microsoft 365 group-connected team site
New-PnPSite -Type CommunicationSite -Title "Policies" -Url "https://contoso.sharepoint.com/sites/policies"
New-PnPSite -Type TeamSite -Title "Project Falcon" -Alias "project-falcon"

# List every site collection with storage and sharing
Get-SPOSite -Limit All |
    Select-Object Url, Title, Template, StorageUsageCurrent, SharingCapability, Owner

# One site in detail
Get-SPOSite -Identity "https://contoso.sharepoint.com/sites/Sales" -Detailed | Format-List

# Turn off guest sharing on one site
Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/Finance" -SharingCapability Disabled

# Delete to the recycle bin, and restore
Remove-SPOSite -Identity "https://contoso.sharepoint.com/sites/old-project"
Restore-SPODeletedSite -Identity "https://contoso.sharepoint.com/sites/old-project"

Lists, columns and items

The 2016 version of this guide did this with raw CSOM and field XML. PnP PowerShell does the same in a few lines:

Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/Sales" -Interactive -ClientId $ClientId

New-PnPList -Title "Quotations" -Template GenericList -OnQuickLaunch
Add-PnPField -List "Quotations" -DisplayName "Quote Date" -InternalName "QuoteDate" -Type DateTime -AddToDefaultView
Add-PnPField -List "Quotations" -DisplayName "Client ID"  -InternalName "ClientId"  -Type Text     -AddToDefaultView
Add-PnPField -List "Quotations" -DisplayName "Rep"        -InternalName "Rep"       -Type User     -AddToDefaultView

Add-PnPListItem -List "Quotations" -Values @{
    Title = "Q-2026-0142"; QuoteDate = "2026-10-27"; ClientId = "CON-001"; Rep = "megan@contoso.com"
}

To reuse a whole site design, list columns, views and all, capture it once with Get-PnPSiteTemplate and apply it to new sites with Invoke-PnPSiteTemplate.

Groups and permissions

# SharePoint groups on a site
Get-SPOSiteGroup -Site "https://contoso.sharepoint.com/sites/Sales"
New-SPOSiteGroup -Site "https://contoso.sharepoint.com/sites/Sales" -Group "Sales Leads" -PermissionLevels "Edit"
Add-SPOUser -Site "https://contoso.sharepoint.com/sites/Sales" -LoginName "megan@contoso.com" -Group "Sales Leads"

# Make someone a site collection administrator
Set-SPOUser -Site "https://contoso.sharepoint.com/sites/Sales" -LoginName "it-admin@contoso.com" -IsSiteCollectionAdmin $true

# Break inheritance on a library and grant a group, with PnP
Set-PnPList -Identity "Contracts" -BreakRoleInheritance -CopyRoleAssignments
Set-PnPListPermission -Identity "Contracts" -Group "Sales Leads" -AddRole "Read"

Group-connected team sites get their members from the Microsoft 365 group. Change membership with Graph (New-MgGroupMember) or in Teams, not with Add-SPOUser.

Guests and external sharing

# Tenant-wide sharing setting
Get-SPOTenant | Select-Object SharingCapability, DefaultSharingLinkType, RequireAnonymousLinksExpireInDays

# Every guest account in Entra ID
Connect-MgGraph -Scopes "User.Read.All"
Get-MgUser -Filter "userType eq 'Guest'" -All -Property DisplayName, Mail, CreatedDateTime |
    Select-Object DisplayName, Mail, CreatedDateTime

These show who exists, not what they can reach. To see which sites, files and links each guest has, see SharePoint external users report.

Recipe: tenant site report to CSV

# Every site collection with storage, sharing, lock state and last content change
Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

Get-SPOSite -Limit All -IncludePersonalSite:$false |
    Select-Object Url, Title, Template, Owner,
        @{ n = "StorageGB"; e = { [math]::Round($_.StorageUsageCurrent / 1024, 2) } },
        SharingCapability, LockState, LastContentModifiedDate |
    Export-Csv "C:\Reports\spo-sites.csv" -NoTypeInformation -Encoding UTF8

Tips

• Read before you write. Run a report and check the CSV before any script that changes things.
• Use -WhatIf where cmdlets support it, and test on a test site.
• PowerShell has no undo. Deleted sites go to the recycle bin, but most other changes don't.
• Expect throttling on large tenants. PnP retries automatically; add pauses in long loops of your own.
• Keep scripts in source control with a short header saying what they change.

When a tool is faster than a script

Scripts are ideal for one-off changes and automation. For reports you run every month, such as permissions at item level across every site, sharing links, broken links or an inventory of every list, the scripts get long, slow and hard to maintain.

SharePoint Essentials Toolkit runs those reports without scripts, across SharePoint Online and SharePoint Server, and exports them to Excel. Community Edition is free on up to 20 site collections. For the on-premises side in PowerShell, see how to remotely manage SharePoint on-premises.

Frequently asked questions

Why did my SharePointOnlineCredentials script stop working?

SharePointOnlineCredentials uses the legacy IDCRL sign-in protocol, which Microsoft permanently retired for SharePoint Online and OneDrive on May 1, 2026. Rewrite the script to use PnP PowerShell with your own Entra ID app, or get an OAuth token with MSAL and attach it to the CSOM context.

Should I use SharePoint Online Management Shell or PnP PowerShell?

Use SharePoint Online Management Shell for tenant administration: sites, sharing settings and tenant settings. Use PnP PowerShell for work inside sites: lists, items, files, fields and permissions. Use Microsoft Graph PowerShell for users, groups and Teams. Most admins use all three.

Why does Connect-PnPOnline -Interactive ask for a ClientId?

The shared PnP Management Shell app was deleted on September 9, 2024. You now register your own Entra ID app, for example with Register-PnPEntraIDAppForInteractiveLogin, and pass its client ID to Connect-PnPOnline or set it in the ENTRAID_APP_ID environment variable.

Can SharePoint Online PowerShell scripts run unattended with MFA on?

Yes, with app-only certificate authentication. PnP PowerShell has supported it for years. SharePoint Online Management Shell supports it from version 16.0.26712.12000, with Connect-SPOService -ClientId -TenantId and a certificate.

Do I need to be a global administrator?

No. Connect-SPOService needs the SharePoint Administrator role. PnP PowerShell cmdlets work with whatever access your account or app has on each site, though registering the Entra ID app needs a role that can create app registrations and grant consent.