Permission & Access Issues

How to Prevent Users from Accessing a Retained SharePoint Site

Chanuka Geekiyanage Sep 25, 2026 869 views

Question details

An administrator needs to lock or restrict access to a retained SharePoint site so that former members can no longer access it, without blocking site administrators.

How to Prevent Users from Accessing a Retained SharePoint Site

Product: SharePoint
Device & OS: not provided
Scenario: A SharePoint site is kept active due to a retention policy after its associated Microsoft 365 group or team is deleted, requiring a method to block user access.
Observed behavior: Former members still retain access to the site even though they no longer appear in the standard membership list, and using a standard PowerShell lock blocks administrators as well.

Before you start

Ensure you have SharePoint Administrator or Global Administrator privileges and verify your licensing level, as some access control features require Microsoft Entra ID Premium or SharePoint Premium.

Solution 1Recommended

Use Conditional Access to Block Users

Implement a Conditional Access policy to block general access to the specific SharePoint site while explicitly excluding site administrators.

Since SharePoint does not offer a native site lock that only affects standard users, Microsoft Entra Conditional Access is the most effective way to selectively block access to specific sites without locking out administrators.

Open Conditional Access

Create a new policy

Click 'New policy', assign it a recognizable name (e.g., 'Block Retained SharePoint Site'), and select all users under the 'Users' assignment.

Exclude Administrators

In the 'Exclude' tab of the Users section, select your SharePoint administrators or specific admin accounts so they bypass the block.

Target the SharePoint site

Under 'Target resources', select 'Cloud apps', then choose 'Office 365 SharePoint Online'. Configure the policy to apply to the specific site URL.

Enforce the block

Under 'Grant' in Access controls, select 'Block access'. Turn on the policy and save your changes.

Licensing Requirement: Conditional Access requires a Microsoft Entra ID P1 or P2 license. If you do not have this license, you must manually remove site permissions instead.

Solution 2

Manually Remove User Permissions via Site Collection Settings

Access the hidden People and Groups page to manually delete former users and groups from the site's permissions.

Solution 3

Use SharePoint Advanced Management (Restricted Access Control)

Utilize SharePoint Premium features to restrict access to a specified Microsoft 365 group.

Free Microsoft Office alternative

Discover a Lightweight and Free Alternative to Microsoft Office

While you manage complex SharePoint permissions and site retention policies, you can streamline your everyday document tasks with WPS Office. It provides robust compatibility with Microsoft Word, Excel, and PowerPoint files without the heavy administrative overhead.

1. Download WPS Office: Visit the official WPS website and download the installation package for your operating system.
2. Install and Launch: Run the installer, follow the on-screen instructions, and launch the application once complete.
3. Open Office Documents: Drag and drop your Word, Excel, or PowerPoint files directly into WPS Office to view and edit them with perfect formatting.

Seamlessly compatible with Microsoft Office formats (.docx, .xlsx, .pptx)Lightweight architecture that runs smoothly on Windows, Mac, and LinuxAll-in-one suite combining Document, Spreadsheet, Presentation, and PDF toolsFree to use with a familiar UI, minimizing learning curves for new users

microsoft office alternative - wps office

Frequently Asked Questions

Why does using Set-SPOSite -LockState NoAccess block administrators?

The 'NoAccess' lock state applies to the entire site collection universally. It overrides all individual permissions, including those of Global and SharePoint Administrators, strictly preventing any access or modifications until the lock is lifted.

Why do users still have access to a SharePoint site after the associated Microsoft 365 group is deleted?

If a retention policy applies to the site, SharePoint preserves the site even after the parent group is deleted. During this process, user permissions may be retained at the site level, granting former members access even if they no longer appear in standard Teams or Group membership lists.

Is an extra license required to use Restricted Access Control in SharePoint?

Yes, Restricted Access Control is part of SharePoint Advanced Management. Using this feature requires an additional SharePoint Premium or Advanced Management add-on license.

Document & File Issues