Site lifecycle and sprawl control

Why sprawl is the default state

Sites are cheap to create and nobody's job to retire. A Team, a Planner plan, a Loop workspace, a Stream channel — each provisions a SharePoint site behind it, usually via self-service. Left alone, an estate accretes thousands of sites, most of them inactive, many ownerless (the creator left), each still holding content, storage and — crucially — access grants Copilot can reach. Lifecycle governance is the drain that stops the bath overflowing.

Control the birth: creation restrictions

• Group/Team creation is the real spigot, since most sites are group-connected. Restrict Microsoft 365 Group creation to an approved security group (an Entra setting) and you throttle site creation at source.
• Direct site creation in the SharePoint admin center can be limited (who sees the "Create site" command; whether classic subsites are allowed at all).

Control the drift: inactivity and ownership policies

• Microsoft 365 Group expiration policy — groups (and their sites) must be renewed on a cadence or they're deleted; renewal can be activity-based so busy sites auto-renew.
• SharePoint Advanced Management site lifecycle policies — an inactive site policy flags/certifies sites with no activity over a window, and an ownerless group policy hunts for a new owner when the last one leaves (the top cause of un-governable sites).

Control the end: archive and read-only

• Microsoft 365 Archive — move a cold site to a distinct archived tier: it stops counting against active storage and leaves normal access, but reactivation carries a cost/latency, so it's for genuinely dormant content, not a filing cabinet.
• The read-only tier — a site's LockState can be set to ReadOnly (content browsable, no edits) or NoAccess (sealed), versus Unlock. Read-only is the graceful pre-deletion holding pattern: freeze the site, wait out the objections, then archive or delete.

The failure modes

• Deleting the site loses the Team. Group-connected sites belong to the group; don't delete the site to "tidy up" — you delete the Team, its chat tabs and its membership. Retire the group.
• Ownerless sites are silent risks. No owner means no one attests to access, no one renews, no one responds to a sharing review — and the content stays fully live to everyone who ever had a link.
• Archive is not deletion. Archived content still exists for eDiscovery and still counts under retention holds; it's a storage-tier move, not disposal.
• NoAccess blocks admins too for content operations — set it knowing you'll Unlock before any migration or restore work.

What to watch (proofs)

• Inventory + activity: Get-SPOSite -Limit All | select Url, Owner, LastContentModifiedDate, StorageUsageCurrent — the dormant/ownerless candidates.
• Lock state: Get-SPOSite <url> | fl LockState — confirm the read-only/frozen tier is actually applied; Set-SPOSite -LockState ReadOnly to apply.
• Policy coverage: SAM's site lifecycle management dashboard — count of inactive and ownerless sites, and how many have been actioned.
• Creation control in force: the Entra group-creation setting — is EnableGroupCreation scoped to an allowed group, or open to everyone (the sprawl faucet wide open)?