PowerShell can make SharePoint administration faster and more repeatable, but the dangerous beginner mistake is treating an internet script as a harmless set of instructions. A SharePoint script runs with the permissions of its connection and can change hundreds of sites in seconds.
Before your first command, choose the right module, understand the permission boundary, connect with a supported authentication method and prove the script on a read-only sample.
Fact-checked against Microsoft Learn and PnP PowerShell documentation on 24 August 2026.
1. “SharePoint PowerShell” is not one module
For SharePoint Online, two common choices are:
- Microsoft SharePoint Online Management Shell, with commands such as
Connect-SPOService,Get-SPOSiteandSet-SPOSite. - PnP PowerShell, with broader Microsoft 365 community cmdlets such as
Connect-PnPOnline,Get-PnPListandGet-PnPTenantSite.
They are not interchangeable. A script written for one module will not automatically work in the other, and their authentication and support models differ. PnP PowerShell is community supported.
Install modules for your user unless your managed workstation requires a different approach:
Install-Module Microsoft.Online.SharePoint.PowerShell -Scope CurrentUser
Install-Module PnP.PowerShell -Scope CurrentUser
Check what is actually installed:
Get-Module Microsoft.Online.SharePoint.PowerShell, PnP.PowerShell -ListAvailable |
Select-Object Name, Version, Path
Do not pin a blog's module version forever. Match the module, PowerShell and Node requirements in the current project documentation.
2. Authentication and permissions are different questions
Signing in proves identity. It does not grant every SharePoint permission.
The SharePoint Administrator role can manage many tenant settings, but some site-level commands also require access to the individual site. Application-only automation requires an Entra app registration and deliberately granted application permissions. Interactive scripts may use delegated access instead.
Ask four questions before running a script:
- Which identity will connect?
- Which tenant role does it hold?
- Which site or Graph permissions does the command require?
- Is tenant-wide consent genuinely necessary?
Use the least privilege that completes the task, and remove temporary access after the work.
3. Execution policy is not a security guarantee
PowerShell execution policy helps prevent accidental script execution. Microsoft explicitly describes it as a safety feature, not a security system.
Do not respond to every error by setting Unrestricted for the whole machine. First inspect the current scopes:
Get-ExecutionPolicy -List
If a trusted local script is blocked, understand why, validate its source and use the narrowest change allowed by your organisation. A signed script can still be harmful, and an unsigned script can still contain important work. Read the code either way.
4. Start read-only and reduce the blast radius
Replace “run it on the tenant” with a short validation ladder:
- Run a
Get-*command against one test site. - Export the proposed targets to CSV.
- Check exclusions such as OneDrive, archived sites and personal sites.
- Add
-WhatIfwhen the cmdlet supports it. - Change one non-production object.
- Read the object back independently.
- Only then expand the scope.
Use -ErrorAction Stop, try/catch and a durable log. An empty pipeline after an authentication failure can otherwise look like a successful zero-result report.
5. Treat scripts, secrets and exports as production assets
Do not put passwords, client secrets or certificates in source code. Store automation credentials in an approved secret store and rotate them. Keep scripts in version control, review changes, and record the module versions used for an important run.
Exports can be sensitive too. A CSV containing site URLs, owners, external users or administrators is an access map. Store it somewhere appropriate and delete disposable copies.
If AI generated part of the script, the same rules apply. Verify every command against current documentation, inspect loops and filters, and test the rollback path. AI output is not a permission boundary or a vendor guarantee.
A safe first exercise
Connect to the SharePoint Online admin service and list five sites without changing them:
Connect-SPOService -Url "https://contoso-admin.sharepoint.com"
Get-SPOSite -Limit All |
Select-Object -First 5 Url, Title, Owner, StorageUsageCurrent
Replace contoso with your tenant name. Run this only from an approved admin workstation with an authorised account. If connection or access fails, fix the identity and role rather than weakening unrelated security controls.
Keep learning in a controlled environment
Join the SharePoint & Teams Admins Space for practical administration patterns and peer review.