Why SharePoint sprawl becomes an AI problem
Open the SharePoint admin center and browse the list of active sites. In most enterprise tenants, a significant fraction of these sites hasn't been used in months — or even years. A site created for a project, the project finished, the site forgotten. Repeat over several years and you get a digital cemetery.
It's not just clutter. Three concrete costs accumulate silently.
Three impacts not to underestimate
1. Storage billed at a loss Each inactive site continues to consume your tenant storage quota. Beyond the threshold included in your license, every additional gigabyte is billed — for files nobody consults.
2. Unmonitored attack surface Each site carries permissions configured at a specific point in time, forgotten shared links, guest access never revoked. Without active monitoring, these are information leak vectors that accumulate.
3. Copilot index pollution This is the most recent risk. When an AI agent — Microsoft 365 Copilot, or any third-party tool connected to your tenant via Microsoft Graph — answers a question like "What is our onboarding process?", it doesn't know that a document from 2021 comes from a site archived long ago. It returns the most semantically relevant document, not the most recent. Cleaning up the tenant before connecting an AI tool is not an optional step: it's foundational.
Copilot indexes everything that is accessible
By default, Microsoft 365 Copilot indexes all content that the user has access to, including inactive SharePoint sites. A read-only site remains indexed as long as you don't explicitly restrict content discovery.
SharePoint Advanced Management: the native solution
The core feature addressed here is site lifecycle management, included in SharePoint Advanced Management. It automates the detection, notification, and enforcement of actions on inactive sites.
Licenses: what you need to know
| Scenario | License required | Indicative cost |
|---|---|---|
| You already have Microsoft 365 Copilot (enterprise add-on or Copilot for Business) | SharePoint Advanced Management included | No additional cost |
| Fewer than 300 seats, Copilot for Business plan | SharePoint Advanced Management included | No additional cost |
| No Copilot license | SharePoint Advanced Management Plan 1 (add-on) | $3 per user per month |
Beyond lifecycle
SharePoint Advanced Management also covers oversharing management, sensitive data access reports, and site attestation policies. Lifecycle management is just one of its components.
Step 1: Generate inventory of inactive sites
Before configuring any policy, start with an assessment. The built-in assessment in the portal replaces the PowerShell scripts that were previously necessary to obtain this data.
Access the Advanced Management section
In the SharePoint admin center, select Advanced Management in the left navigation pane. This entry only appears once the license is activated on the tenant.
Launch a new assessment
Click Start a new assessment and select Site lifecycle. The analysis can take up to 48 hours depending on tenant size. It covers SharePoint activity, but also Teams, Viva Engage, and Exchange Online to evaluate overall activity associated with each site.
Download the CSV report
Once the analysis is complete, download the report. The CSV file contains, for each inactive site:
- Site name and URL
- Creation date
- Last activity date
- Storage volume used
- Owner email address (or indication of no owner)
The Is Inactive column is pre-filtered to True — only affected sites are exported.
Start with ownerless sites
In customer environments, sites without an owner (empty owner column) are often the most problematic. Resolve ownership first before automating archive actions: without a recipient for notifications, the policy runs empty.
Step 2: Configure the lifecycle policy
Once the inventory is established, create an inactive site management policy to automate ongoing management.
Access lifecycle policies
In Advanced Management, go to Policies > Site lifecycle management. Three types of policies are currently available:
- Inactive site policy: detection and action on inactive sites
- Site ownership policy: notifications to assign an owner to orphaned sites
- Site attestation: asks owners to confirm content relevance
Click Inactive site policy > Open > Create a new policy.
Define the scope
Two scope options are available:
- Upload a CSV: list up to 10,000 URLs, suitable for large accounts with fine segmentation
- Select sites at scale: selection by site template — recommended option for most organizations
Templates include sites connected to Teams, sites connected to a Microsoft 365 group without Teams, communication sites, etc. Select All unless you have an explicit reason to exclude a category.
Available exclusion options:
- Sites with active retention policies or retention holds (recommended to exclude if retention policies are already in place)
- Specific sites to never archive (manual exclusion list)
- Filters by sensitivity label or by creation source
Set the inactivity threshold
Define the duration after which a site is considered inactive. The default value is 90 days. The maximum configurable is 6 months. A value of 3 to 6 months is recommended for most deployments — 1 month would be too aggressive except in specific business contexts.
Configure notifications
Notification recipients are site owners (recommended method for modern sites) or site admins (legacy method). The email content is customizable — an opportunity to integrate your internal procedures (SOP) on lifecycle management.
Owners receive a notification asking them to certify the site (confirm it's still in use) or not to respond. After three notifications without response, the configured enforcement action applies.
Choose the enforcement action
Two options are available:
- Read-only access: users can view content but cannot modify it. Reversible from the SharePoint admin center at any time. Recommended as a first step.
- Archive: requires the Microsoft 365 Archive service (separate paid add-on). The site is removed from the active quota. Reactivation possible from the portal.
Archive ≠tiering
The native archive action does not allow redirection to a third-party archiving solution. If your organization uses an external archiving tool, the "Archive" action of the policy points exclusively to Microsoft 365 Archive.
Enable simulation mode first
Before any production rollout, enable simulation mode. The policy generates reports and preview emails without applying any action. This is the recommended approach to validate the scope and adjust exclusions before switching to active mode.
Name the policy explicitly (e.g., Lifecycle-Global-90j) — you will be prompted to create multiple policies with different scopes.
Restrict Copilot indexing on inactive sites
Putting a site in read-only mode is not enough to exclude it from the Copilot index. An additional step is necessary.
From the SharePoint admin center, access the Active sites list, open the site in question, then enable the Restrict content discovery option. This option, available with SharePoint Advanced Management, excludes the site from Microsoft 365 Copilot results, AI agents, and organization-wide search.
Only available with SharePoint Advanced Management
Content discovery restriction is a SharePoint Advanced Management feature. It is not available with a standard Microsoft 365 license.
Reversibility: what users see and how to undo
When a site switches to read-only, a banner appears at the top of the site telling users to contact the administrator. Each open document displays a read-only indicator.
To reactivate a site:
- In read-only: from SharePoint admin center > Active sites, select the site and choose Unlock.
- In Archive: from the same interface, use the reactivation option — the site returns to active state and re-enters the storage quota.
Owners and admins receive an automatic notification when switching to read-only.
Key takeaways
- SharePoint sprawl generates three cumulative costs: excess storage, unmonitored attack surface, and AI index pollution.
- SharePoint Advanced Management is included in Microsoft 365 Copilot licenses (enterprise and Copilot for Business). Without Copilot, it is available as an add-on at $3 per user per month.
- Start with an assessment (up to 48 hours) to get the CSV of inactive sites with ownership and storage.
- Deploy the policy in simulation mode before activating enforcement.
- Read-only is instantly reversible; archiving requires Microsoft 365 Archive.
- Combine the lifecycle policy with the Restrict content discovery restriction to truly exclude obsolete sites from Copilot.
- Fix the ownership problem first (ownerless sites) before automating notifications — otherwise alerts reach nobody.
