Orphaned and inactive SharePoint sites: regaining control of the data lifecycle
A SharePoint site usually outlives the project that created it, and often its owner too. In our audits a large share of sites have not been modified for a long time, some no longer have any active administrator, and their sharing links remain open. These forgotten spaces concentrate risks that nobody is watching.
Why forgotten sites are a problem
A site with no active owner is no longer governed. Nobody reviews its members, nobody removes guest access, nobody checks the "anyone with the link" links created three years ago. The data it holds, sometimes sensitive, stays accessible long after it has stopped being useful.
This has several concrete consequences:
- lasting exposure through sharing links and guests that are never revoked;
- excessive retention of personal data, contrary to the GDPR storage limitation principle;
- search results and AI assistants fed with outdated or poorly protected content;
- a storage cost that grows for no benefit.
Two different situations: ownerless and inactive
An ownerless site can be heavily used: think of a team site whose manager has left. For sites connected to a Microsoft 365 group, the site owners are the group owners; for communication sites and classic sites, they are the site collection administrators. One unplanned departure is enough to leave a site without anyone in charge.
An inactive site has had no significant activity for a given period, but may still have an owner who has simply forgotten about it. The two situations call for different responses: reassign ownership in the first case, question the site's usefulness in the second.
Finding the sites concerned
The SharePoint admin centre and PowerShell let you extract the list of sites with their last content modification date, storage, template and administrators. Cross-referenced with the list of disabled or deleted accounts, it reveals orphaned sites.
SharePoint Advanced Management provides dedicated tools: inactive site policies, which automatically notify owners and can make a site read-only or archive it; site ownership policies, which detect sites below a minimum number of owners; and data access governance reports. The licensing terms for these features have changed over time; check what is available in your tenant.
Start with a fallback administrator. Setting an administration account or group as secondary administrator on every site ensures nobody is locked out on the day the owner leaves. It is a simple measure that prevents many crisis situations.
Organising the lifecycle
A gradual approach works better than a big clean-up:
- Reassign ownership of orphaned sites that are still in use, relying on active members or the department's management.
- Ask the owners of inactive sites whether the site is still useful.
- Make read-only the sites whose usefulness is uncertain, which reduces risk without deleting anything.
- Archive sites that must be kept but are no longer consulted. Microsoft 365 Archive moves a site to cold storage, with a reactivation cost; check the current billing model.
- Delete what no longer has any reason to exist. A deleted site can be restored from the deleted sites recycle bin for 93 days.
Before deleting anything, check retention obligations. Retention policies and litigation holds apply regardless of site deletion: content stays preserved as long as an obligation exists. Conversely, if no policy covers a site, its deletion is final once the restore window has passed.
Prevention rather than cure
The best way to limit orphaned sites is to act at creation time and when people leave: require two owners, apply an expiration policy to groups, and include the reassignment of sites the person owned in the leaver process. An annual review, carried out by the owners themselves, then keeps accountability alive.
What an audit checks
- The proportion of sites with no changes for more than a year.
- Sites where no owner or administrator is an active account.
- Sharing links and guests present on inactive sites.
- Whether a secondary administrator and a two-owner requirement are in place.
- The inactive site, ownership and archiving policies in place.
- How sites are handled in the leaver process.
- How deletion fits with retention policies.