SharePoint

Recover a SharePoint Online Site

Posted on by Adam Fowler

In SharePoint Online, it’s easy to delete an entire site or documents in a site.

Recovering documents is also quite easy, go to the site’s recycle bin which is normally located at https://contoso.sharepoint.com/sites/sitename/_layouts/15/RecycleBin.aspx – replacing ‘contoso’ with your tenant name, and ‘sitename’ with the actual site name. Deleted items can be selected and restored to their original location.

“How long are deleted items kept in the Recycle Bin?

In SharePoint Online, the default retention time is 93 days for both site recycle bin (first stage) and site collection recycle bin (second stage). The site recycle bin storage counts against your site collection storage quota and the List View Threshold. The site collection recycle bin retention starts at the same time for both recycle bins when the item is first deleted, so the total maximum retention time is 93 days for both recycle bins. The default amount of space for the site collection is 200% of the site collection quota.”

However, I had some issues when trying to recover an entire site. My top level recycle bin https://contoso.sharepoint.com/_layouts/15/RecycleBin.aspx showed nothing. I’m unsure if there’s another way of viewing deleted sites via the web interface, and gave up after a lot of clicking around and Googling, but it’s easy to do with PowerShell.

After installing the SharePoint Online Management Shell, and connecting to SharePoint Online with the ‘Connect-SPOService‘ cmdlet (and don’t forget to use HTTPS rather than HTTP when connecting to your SharePoint Online instance or you’ll get a rather generic error: connect-sposervice : Could not authenticate to SharePoint Online http://contoso-admin.sharepoint.com/ using OAuth 2.0), you can see what your deleted sites are with this command:

Get-SPODeletedSite

Simple, you’ll then be presented with a list of all sites that are deleted and waiting in the recycle bin along with when they were deleted, and how many days are remaining before they disappear from the recycle bin. Sites deleted seem to sit in that recycle bin for 30 days, rather than site collection items but I couldn’t find any documentation supporting this.

To restore a deleted site, just use the following command with the URL of the site to restore, which you can see from the ‘get’ command above

Restore-SPODeletedSite -identity https://conotos.sharepoint.com/sites/oops

That’s it. Your site is back.

From what I’ve read, there is no way to change the retention values of SharePoint Online recycle bins.

Azure Active Directory – Assigning Groups to Applications in PowerShell

Posted on by Adam Fowler

Azure Active Directory Applications have been around for a while, but it’s I’ve found it hard to find good information on them beyond the biggest benefit of Marketplace Apps.

Along with my Azure AD B2B journey (still in preview at time of writing), the option of pushing out something like a SharePoint Online site as an app is one of the jigsaw pieces required to make the whole B2B process work – as a version of the apps page is displayed as the default link to anyone who accepts an Azure AD B2B invite and logs in for the first time.

MyApps – an externally invited user will only see the apps they have access to (by default, none)

I’m trying to gloss over details here, as there’s a lot of steps with different parts of the Microsoft world to get a process automated end to end for inviting external users to a SharePoint Online site – but the last step of assigning a user or group to an application has no documentation I could find, that showed how to achieve this via PowerShell.

All I want to do here, is create an Application in Azure AD, then assign a group to it. Members of the group will then see the application on MyApps.

Two different modules are required – Azure Active Directory V2 PowerShell module and Azure Resource Manager.

What we can do with these two modules is first create the application with the New-AzureRMADApplication command:

New-AzureRmADApplication -DisplayName "SharePoint Online Site A" -HomePage "https://contoso.sharepointonline.com/sitea" -IdentifierUris "https://contoso.sharepointonline.com/sitea"

Easy, now you have an application that will point to the URL entered in Azure Active Directory. Assigning a group to it is a bit trickier…

First, a few values need to be obtained:

$app = Get-AzureRmADApplication | where displayname -eq "SharePoint Online Site A"
$appid = $app.ApplicationId
$fullgroup = get-msolgroup -all | where displayname -eq "SharePoint Online Site A"

This is getting the two objects as variables – the Application itself, and the group that you want to add onto it.

Then a new Service Principal needs to be created based on the Application, as this is required when adding the group onto the application:

New-AzureADServicePrincipal -AppId $appid

Another variable is needed, which is the new Service Principal we just created:

$servicePrincipal = Get-AzureADServicePrincipal -Filter "appId eq '$appId'"

Finally, we can assign the group to the application:

New-AzureADGroupAppRoleAssignment -objectid $fullgroup.objectid -principalid $fullgroup.objectid -resourceid $serviceprincipal.objectid -id ([Guid]::Empty)

You can check that this has applied by the Azure Active Directory portal too, by going to your Active Directory section, choosing ‘Applications’ and finding your app, then go into ‘users and groups’ and find the group. You should see a ‘yes’ in the assigned field.

If there’s any interest in documenting the entire SharePoint Online and Azure AD B2B invite process and script, let me know. It’s a great way of sharing data with clients via a portal.

Update 15th June 2017

Microsoft made a change with the IdentifierURI field, which is also called AppID if you view it in the Azure portal. Previously, it could be any unique URL, it just has to be unique amongst your apps (as to why it has to be a URL at all, I couldn’t get an answer on). Now, it can be anything as long as it’s not sharepoint.com or dynamics.com as they’ve reserved those for other reasons. My example above, and what I’d been using in production was variants of sharepoint.com – as the unique URI might as well be the actual URL of the site. If you use a URL that’s not allowed anymore, you’ll get the error:

New-AzureRMADApplication : Operation returned an invalid status code ‘BadRequest’