OneDrive for Business - Delegation to Manager after employee leaves company

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

# Get-OneDriveOwner.ps1

# This script gathers info about additional (potentially unwanted) Site Collection Admin permissions for OneDrive for Business sites
# The script is not really polished, use on your own risk
Import-Module Microsoft.Online.SharePoint.PowerShell

# change the SPO tenant name accordingly. For example "demotenant"
$SPOTenantName = "<ENTER YOUR SHAREPOINT TENANT NAME HERE>"

# set this to your admin user. For example "[email protected]"
$SPOAdminUsername = "<ENTER YOUR SPO ADMIN UPN HERE>"

# output file path (CSV file)
$outputFile = "C:\temp\OneDriveAdditionalManagers-$($SPOTenantName)-$(Get-Date -Format "yyyy-MM-dd_HHmmss").csv"

# insert spo tenant name
Connect-SPOService -Url "https://$($SPOTenantName)-admin.sharepoint.com"

# List all OneDrive Sites
$AllOneDriveSites = Get-SPOSite -IncludePersonalSite $true -Limit all -Filter "Url -like '-my.sharepoint.com/personal/'" | Where-Object {$_.Title -ne "RedirectSite"}

foreach($site in $AllOneDriveSites) {
    # temporarily add admin user as SPO site admin; suppress output
    try {
        $null = Set-SPOUser -Site $site.Url -LoginName $SPOAdminUsername -IsSiteCollectionAdmin $True
    } catch {
        $txt = "Error while trying to add admin user $($SPOAdminUsername) to site $($site.Url)"
        Write-Host $txt
        $txt | Out-file -FilePath "$($outputFile)-LOG.txt" -Append -Encoding utf8
        # skip to next loop iteration
        continue
    }

    # get all user assignments for the current site
    $SiteUsers = Get-SPOUser -Site $site.Url -Limit All
    $additionalSiteUsers = $SiteUsers | Where-Object {
        $_.IsSiteAdmin -eq $true -and
        $_.LoginName -ne $SPOAdminUsername -and
        $_.DisplayName -ne $site.Title -and
        $_.IsGroup -eq $false
    }

    # Check if there are unexpected users added to the site
    if(($additionalSiteUsers | Measure-Object).Count -ne 0) {
        Write-Host "Site '$($site.Title)' has $($additionalSiteUsers.Count) additional users."
        foreach($additionalSiteUser in $additionalSiteUsers) {
            Write-Host "$($additionalSiteUser.DisplayName) ($($additionalSiteUser.LoginName))"

            # custom object for output to csv
            [PSCustomObject]@{
                "SiteURL" = $site.Url
                "SiteTitle" = $site.Title
                "AdditionalUserDisplayName" = $additionalSiteUser.DisplayName
                "AdditionalUserLoginName" = $additionalSiteUser.LoginName
            } | Export-Csv -Encoding utf8 -Delimiter ";" -Append -NoTypeInformation -Path $outputFile
        }
    }

    # remove admin user from SPO/Onedrive site (we only added it temporarily)
    try {
        $null = Set-SPOUser -Site $site.Url -LoginName $SPOAdminUsername -IsSiteCollectionAdmin $false
    } catch {
        $txt = "Error while trying to remove admin user $($SPOAdminUsername) from site $($site.Url)"
        Write-Host $txt
        $txt | Out-file -FilePath "$($outputFile)-LOG.txt" -Append -Encoding utf8
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

# Compare-OneDriveSitesWithUsers.ps1

Connect-AzureAD

# I also filtered out a specific service accounts that had access to many OneDrives.
# if you don't have something similar, then you probably don't need the Where-Object part here
$sites = Import-csv "C:\temp\OneDriveAdditionalManagers-mytenant.csv" -Encoding utf8 -Delimiter ";" | Where-Object {$_.AdditionalUserLoginName -ne "[email protected]"}

# Try to get AAD Users for each SPO site
foreach($site in $sites) {
    Write-Host "Searching for user $($site.SiteTitle)..."
    # filtering out guests for some edge cases
    $user = Get-AzureADUser -SearchString $site.SiteTitle | Where-Object {$_.UserType -ne "Guest"}
    $resultCount = ($user | Measure-Object).Count
    if($resultCount -gt 1) { 
        Write-Host "$resultCount results for user $($site.SiteTitle)!"
        $user
    } elseif($resultCount -eq 1) {
        Write-Host "User exists! $($user.UserPrincipalName)"
        $site | Add-Member -NotePropertyName "UserStillExists" -NotePropertyValue $true -Force
    }    
}

# check
$sites | ft SiteTitle,UserStillExists

$sites | Where-Object {$_.UserStillExists -ne $true} | Measure-Object

$sites | Where-Object {$_.UserStillExists -ne $true} | Export-Csv -Path C:\temp\OneDriveAdditionalManagers-NonExistingUsers.csv -Delimiter ";" -Encoding utf8

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

# Remove-AdditionalOneDriveOwners.ps1
Import-Module Microsoft.Online.SharePoint.PowerShell

# change the SPO tenant name accordingly. For example "demotenant"
$SPOTenantName = "<ENTER YOUR SHAREPOINT TENANT NAME HERE>"

# set this to your admin user. For example "[email protected]"
$SPOAdminUsername = "<ENTER YOUR SPO ADMIN UPN HERE>"

# output log file path
$outputFile = "C:\temp\OneDriveAdditionalManagers-Cleanup-$($SPOTenantName)-$(Get-Date -Format "yyyy-MM-dd_HHmmss").txt"

# insert spo tenant name
Connect-SPOService -Url "https://$($SPOTenantName)-admin.sharepoint.com"

# import sites to clean from CSV file
$SitesToClean = Import-Csv -Path "C:\temp\OneDriveSitesToCleanPermissions.csv" -Delimiter ";" -Encoding utf8

foreach($site in $SitesToClean) {
    # temporarily add admin user as SPO site admin; suppress output
    try {
        $null = Set-SPOUser -Site $site.SiteURL -LoginName $SPOAdminUsername -IsSiteCollectionAdmin $True
    } catch {
        $txt = "Error while trying to add admin user $($SPOAdminUsername) to site $($site.SiteURL)"
        Write-Host $txt
        $txt | Out-file -FilePath $outputFile -Append -Encoding utf8
        # skip to next loop iteration
        continue
    }

    # remove additional user from SPO site according to CSV file
    try {
        # first remove admin rights
        $null = Set-SPOUser -Site $site.SiteUrl -LoginName $site.AdditionalUserLoginName -IsSiteCollectionAdmin $false
        # then remove the user from the site
        Remove-SPOUser -Site $site.SiteURL -LoginName $site.AdditionalUserLoginName
        $txt = "Removed user $($site.AdditionalUserLoginName) from site $($site.SiteURL)."
        Write-Host $txt -ForegroundColor Green
        $txt | Out-file -FilePath $outputFile -Append -Encoding utf8
    } catch {
        $txt = "Error while trying to remove user $($site.AdditionalUserLoginName) from site $($site.SiteURL). Error details: $_"
        Write-Host $txt -ForegroundColor Red
        $txt | Out-file -FilePath $outputFile -Append -Encoding utf8
    }

    # remove admin user from SPO/Onedrive site (we only added it temporarily)
    try {
        $null = Set-SPOUser -Site $site.SiteURL -LoginName $SPOAdminUsername -IsSiteCollectionAdmin $false
    } catch {
        $txt = "Error while trying to remove admin user $($SPOAdminUsername) from site $($site.SiteURL)"
        Write-Host $txt
        $txt | Out-file -FilePath $outputFile -Append -Encoding utf8
    }

}