Permission & Access Issues

How to Remove a Deleted User from OneDrive Site Collection Administrators

Phi Hung Vo Oct 14, 2026 869 views

Question details

A deleted employee account remains listed as a site collection administrator across thousands of OneDrive sites.

How to Remove a Deleted User from OneDrive Site Collection Administrators

Product: SharePoint Online
Device & OS: not provided
Scenario: Administrators are trying to clean up permissions across thousands of personal OneDrive sites after an employee has left the organization.
Observed behavior: Standard Set-SPOUser and Get-SPOUser PowerShell commands fail to recognize or remove the deleted user identity from the administrator lists.

Before you start

Ensure you have the SharePoint Online Management Shell and PnP PowerShell modules installed, and that you possess Global Administrator or SharePoint Administrator privileges.

Solution 1Recommended

Use PnP PowerShell to Remove the Deleted User

The most effective method is utilizing a custom PnP PowerShell script to authenticate into each site and remove the specific identity claim.

Because standard SharePoint Online modules fail to resolve deleted identities, you must use PnP PowerShell along with the exact identity claim string (e.g., i:0#.f|membership|user@domain.com) to bypass the resolution issue.

Enumerate OneDrive sites

Run the Get-SPOSite command with the IncludePersonalSite $true parameter to gather a list of all personal OneDrive URLs in your tenant.

Add a temporary administrator

Use Set-SPOUser to temporarily add a secondary active global administrator to the site collection so you have permission to make changes.

Connect via PnP PowerShell

Execute Connect-PnPOnline with your administrative credentials to authenticate against each specific OneDrive site.

Remove the deleted identity

Run the Remove-PnPSiteCollectionAdmin command specifying the deleted user's exact identity claim string.

Revert temporary permissions

Remove the temporary global administrator account you added in step 2 to restore the original security posture of the user's OneDrive.

Use PnP PowerShell to Remove the Deleted User

Script Automation: Since this involves potentially tens of thousands of sites, you should wrap these commands in a foreach loop within your script to process all URLs automatically.

Solution 2

Contact Microsoft 365 Support

If scripting is not viable for your organization, Microsoft support can assist on the backend.

Free Microsoft Office alternative

Manage Your Office Documents Effectively with WPS Office

While administrative backend tasks require specialized PowerShell scripts in Microsoft 365, end-user document management can be incredibly simple. WPS Office provides a lightweight, highly compatible, and free alternative to Microsoft Office for your daily productivity and file management needs.

1. Download WPS Office: Visit the official WPS website and download the free installation package for your operating system.
2. Install the Software: Run the downloaded installer and follow the simple on-screen instructions to complete the setup.
3. Open Your Files: Launch WPS Office to directly open, edit, and save your existing Microsoft Office documents without any formatting loss.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Lightweight design ensures fast launch times and smooth performance on older devices.All-in-one tabbed interface supports organizing documents, spreadsheets, and PDFs in a single window.Familiar user interface makes migrating from Microsoft Office completely seamless and intuitive.

Frequently Asked Questions

Why can't I remove a deleted user with the standard Set-SPOUser command?

Once a user account is deleted from Microsoft Entra ID, standard SharePoint Online commands fail to resolve the user's identity properly, preventing standard permission removal processes from succeeding.

What is an identity claim in SharePoint Online?

An identity claim is a unique string that SharePoint uses to identify users, typically formatted as 'i:0#.f|membership|user@domain.com'. PnP PowerShell requires this exact string to target and remove a deleted user's residual permissions.

Do I need global administrator rights to run PnP PowerShell scripts for OneDrive?

Yes, to enumerate all OneDrive sites in a tenant and modify site collection administrators across them, you must possess global administrator or SharePoint administrator privileges.

Can I automate the removal process across all 30,000 sites?

Yes. By using a 'foreach' loop in your PnP PowerShell script, you can iterate through the list of sites generated by Get-SPOSite and apply the Remove-PnPSiteCollectionAdmin command to each one automatically.

Document & File Issues