How to Lock and Unlock SharePoint Sites in Microsoft 365

Did you ever want to lock and unlock SharePoint Sites but didn’t know how to do one or the other?

Or maybe you want a site for editing, but keep the content available? Or maybe, even completely hide a site, but be able to bring it back the way it was with one click?

In this clip from my Configuring and Managing SharePoint Online and OneDrive for Business course, you will learn how to lock and unlock sites in SharePoint Online!

Full Configuring and Managing SharePoint Online and OneDrive for Business Course

Video Summary

Here are the key points from the video:

• Introduction to Locking and Unlocking SharePoint Sites: The course explains the usefulness of locking and unlocking SharePoint sites, such as for archiving or compliance reasons.
• Locking Options: There are three lock states: unlocked (normal state), read-only (view-only access), and no access (403 error for users).
• Setting Lock States with PowerShell: Use the Set-SPOSite PowerShell cmdlet to change the lock state. For read-only, set LockState to ReadOnly; for no access, set it to NoAccess.
• Redirecting No-Access Sites: Set a redirect URL for no-access sites using the Set-SPOTenant cmdlet, guiding users to a support page.
• Unlocking Sites: Unlock a site by using the Set-SPOSite cmdlet with LockState set to Unlock, restoring full collaboration capabilities.

For more information, read the transcript blog below, or watch the video above!

Video Transcript

Hello and welcome to the SharePoint Online Administration Playbook course. My name is Vlad Catrinescu, and I’ll be your instructor for this course. In this module, we will learn how to lock and unlock SharePoint sites. We will first look at why this is useful and when locking and unlocking SharePoint sites make sense for the SharePoint admin. Finally, we will learn how to get it done.

So, let’s start. Why would we want to do this? What’s the business case? Locking a SharePoint site allows you to make the site read-only or completely block access to a site. A good example could be a project site that you want to keep as an archive but make sure it’s in read-only mode so nobody can modify, upload, or delete documents. As for blocking people from a site, you could have, for example, an old board or committee site that shouldn’t be accessed anymore, but you want to keep it there hidden for compliance or other reasons and be able to make it accessible very quickly.

Now that we know the why, let’s learn how to lock and unlock SharePoint sites. Locking and unlocking SharePoint sites is done with the SharePoint Online PowerShell module. As always, make sure you have the latest version available. There are three lock options for SharePoint sites. The first one is, of course, unlocked, which is the normal state with normal collaboration. The second option is read-only, where, as the name says, the content can be read, but you’re preventing users from adding, updating, or deleting content. The last option is no access. In no access, users would not be able to access the site at all, and they would get a 403 error. You could optionally set up a redirect URL for all of the sites locked in no access mode, so you could create a support page, for example, telling them that the site cannot be accessed and a way to contact IT if they need it.

There are some limitations you need to know. First of all, you cannot set the lock state on the root site of your tenant or a Microsoft 365 group-connected site. For sites that are Microsoft 365 group-connected and also have a Microsoft Teams team, you could look at the archive functionality provided by Microsoft Teams, but that’s outside of the scope of this course. To lock a site, more specifically in read-only, we will use the Set-SPOSite PowerShell cmdlet, which provides the identity of the site, which is the URL, and the parameter we will use is LockState. To make it read-only, we will pass ReadOnly in there. To make the site inaccessible, it’s very similar, but we will use NoAccess inside the LockState parameter. To configure the tenant-wide redirect for no-access sites, we need to specify the site or page at the tenant level. So, we will use the Set-SPOTenant PowerShell cmdlet and specify the NoAccessRedirectUrl parameter and point it to where we want people to be redirected.

Now that we have seen the theory, let’s go to the lab environment and see how we can lock and unlock SharePoint sites. We are now in the demo environment, and let me open up the PowerShell ISE, where I have already logged in to SharePoint Online by using the SharePoint Online Management Shell. In this demo, we are going to play with a few sites that we have created and modified in previous demos: Team Bravo and Alpha Team. Let’s start, first of all, by changing a site to read-only. So, to lock a site to read-only, we will use the Set-SPOSite PowerShell cmdlet, specify the identity of the site we want to do the change on, in this case, Alpha Team, and then we will use the LockState parameter, which we will set to ReadOnly. Let me run this. It should only take a few seconds, and there we go, it’s already done. Now, if I go to the browser and I refresh the Alpha Team site, I should have a warning that says this SharePoint site is read-only right now. So, if I go to documents, for example, you see I do not have the plus button. I cannot add any documents, I cannot modify the page or anything. This site is now read-only.

So, this is the read-only mode. Now, if we go back to PowerShell, let me scroll down a bit. Let’s take a look at the no-access mode. In this case, I will run again the Set-SPOSite cmdlet, provide the identity, which is Team Bravo, and then the, which is NoAccess. If I leave it like that right now, what will happen is that users will get a not found or a 403 Forbidden error. But to make this more user-friendly, I have created a page on the internet that says the site you attempted to visit has been locked, and then a bit of information on what users should do if they need to get access to the site. I can use the Set-SPOTenant cmdlet and provide that URL in the NoAccessRedirectUrl. So, if any user goes on a site that is in the no access lock state, they will be automatically redirected to that specific page on the internet. So, let’s run that. It’s already done. However, it might take a few seconds until we see the experience in the actual browser. So, let’s try to do a refresh here. Great, it worked right away. You can see that I was not able to refresh the Team Bravo site, but it has redirected me to the page that we specified in the tenant property. So now, any user that goes there, either by a bookmark or a link from an old email, will get some information that the site is still there but it’s locked and a way for them to contact somebody to get it unlocked.

Now, the last thing I want to show you is how to unlock sites. The procedure is very similar. Use the Set-SPOSite cmdlet, give it the identity, and the LockState should be Unlock. So, if I run this now on the Alpha Team site, if I go back here, and click on refresh, my warning should be gone, and now I can actually create things. Again, it might take a few minutes before the user interface experience is completely refreshed or a few refreshes if you do it right away. But as you can see, now I have my new button, and I’m ready to collaborate on this site.

This is it for this demo in which we have seen how to set a site to read-only, to no access, how to redirect all of the requests to a locked site in no access mode to a nice page on the internet that tells people what to do, and finally, how to unlock sites. This is it for this demo, and now let’s go back to the slides and finish off this module.

Before we finish this module, let’s review what we have learned. In this module, we have first looked at when locking and unlocking SharePoint sites can be useful, such as archiving project sites in read-only mode or blocking access to certain sites while keeping them intact. We have then looked at how to actually do it by using the SharePoint Online PowerShell module and the Set-SPOSite PowerShell cmdlet. We have also learned how to use the Set-SPOTenant PowerShell cmdlet to set a redirect location for sites in no-access mode.