Using PowerShell to create SharePoint Sites

clear
#------------------------------------------------
#--------------V1 initial release----------------
#----------------DR 15/10/2021-------------------
#------------------------------------------------
#------------------Infomation--------------------
#You will be require to login three time for this script to function 
#as you need to login to different parts of Office 365, Azure and 
#SharePoint, logins are Interactive to allow 2FA accounts to work also

#Once the sites has been created, if you are using Azure AD Connect and
#set $ConnectToAD = $true below users will need adding into the correct
#groups to get the correct permissions

#Disabling sharing links etc will ensure no data is able to be shared with
#users who do not alread have access to site files

#Giving users Owner permissions will enabled them to be able to create
#sharing links outside the the site i.e. people who do not already have access
#------------------------------------------------

#--------------Permissions reference-------------
#Visitors (Read Access)
#Members (Contirubte/Write)
#Owners (Full Control of the SharePoint site)
#------------------------------------------------

#-------------------Change Log-------------------
#18-10-21 - Updated the section that adds AD User groups to SharePoint to use c:0t.c|tenant| as the start of the entry point for group names.
#19-10-21 - Set-GPPermission now removed Authenticated Users from having the GPO Applied, the GPOS are now only applied to the AD SharePoint groups

#---------------------To Do----------------------
#Find a way for the GPOs to be auto populated with the library names and IDs

#------------------------------------------------
#User configurable variables
$TenantName = "" # Your Azure tenant name (the bit before -admin.sharepoint.com)
$TenantFriendlyName = "" # A friendly name for your tenant, Company name, School name etc
$SiteName = "" # The name of the site to be created
$OwnerEmail = "" # The email of the user who is to be the new site Owner
$StorageQuota = "26214400" # Storage Quota for the site, 26214400 is 25Tb the default
$ConnectToAD = $true # Are you using Azure AD connect and want to connect AD Groups to SharePoint if false then perms will need adding manually
$ADGroupPath = "" # Use an LDAP Path here thats sync to Office 365 to create the AD Groups
#------------------------------------------------

#------------------------------------------------
#Do not alter these unless you know what you are doing!
$docLib = 'Documents'
$TenantAdminURL = "https://" + $TenantName + "-admin.sharepoint.com"
$TenantClientURL = "https://" + $TenantName + ".sharepoint.com"
$SiteURL = $TenantClientURL + "/sites/" + $SiteName
$ADOwnersGroupName = "SharePoint - " + $TenantFriendlyName + " - " + $SiteName + " Owners"
$ADMembersGroupName = "SharePoint - " + $TenantFriendlyName + " - " + $SiteName + " Members"
$ADVisitorsGroupName = "SharePoint - " + $TenantFriendlyName + " - " + $SiteName + " Visitors"
$GPOName = "SharePoint - " + $TenantFriendlyName + " - " + $SiteName
$SPOwnersGroupName = $SiteName + " Owners"
$SPMembersGroupName = $SiteName + " Members"
$SPVisitorsGroupName = $SiteName + " Visitors"
#------------------------------------------------

#------------------------------------------------WORKING
#Check we are running as Admin and elevate if not
write-host "Info: Checking we are elevated" -foregroundcolor green
$ver = $host | select version
if ($ver.Version.Major -gt 1)  {$Host.Runspace.ThreadOptions = "ReuseThread"}

# Verify that user running script is an administrator
$IsAdmin=[Security.Principal.WindowsIdentity]::GetCurrent()
If ((New-Object Security.Principal.WindowsPrincipal $IsAdmin).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator) -eq $FALSE)
{
	"`nERROR: You are NOT a local administrator.  Run this script after elevating to Administrator."
	exit
}
#------------------------------------------------

#------------------------------------------------WORKING
#Uninstall old SharePointPnPPowerShellOnline if it exists
Write-Host "Uninstall old SharePointPnPPowerShellOnline if it exists" -foregroundcolor green
If (Get-InstalledModule Microsoft.Online.SharePoint.PowerShell) {
    Write-Host "SharePointPnPPowerShellOnline is installed, uninstalling." -foregroundcolor green
    Uninstall-Module -Name SharePointPnPPowerShellOnline -AllVersions -Force
}

#Install dependancies
write-host "Info: Install dependancies" -foregroundcolor green
If (-not(Get-InstalledModule Microsoft.Online.SharePoint.PowerShell)) {
    Write-Host "Module Microsoft.Online.SharePoint.PowerShell does not exist, installing." -foregroundcolor green
    Install-Module -Name Microsoft.Online.SharePoint.PowerShell
	} else {
	write-host "Info: Module Microsoft.Online.SharePoint.PowerShell already Installed" -foregroundcolor green
}

If (-not(Get-InstalledModule PnP.PowerShell)) {
    Write-Host "Module PnP.PowerShell does not exist, installing." -foregroundcolor green
    Install-Module -Name PnP.PowerShell
	} else {
	write-host "Info: Module PnP.PowerShell already Installed" -foregroundcolor green
}

If (-not(Get-InstalledModule AzureAD)) {
    Write-Host "Module AzureAD does not exist, installing." -foregroundcolor green
    Install-Module -Name AzureAD
	} else {
	write-host "Info: Module AzureAD already Installed" -foregroundcolor green
}
#------------------------------------------------

#------------------------------------------------WORKING
#Get latest updates for modules
write-host "Info: Updating modules to latest versions" -foregroundcolor green
Update-Module -Name Microsoft.Online.SharePoint.PowerShell
Update-Module -Name PnP.PowerShell
Update-Module -Name AzureAD
#------------------------------------------------

#------------------------------------------------WORKING
#Connect to to SPOService
try{
	write-host "Info: connecting to SPOService" -foregroundcolor green
    Connect-SPOService -Url $TenantAdminURL
    write-host "Info: Connected succesfully to SPOService" -foregroundcolor green
}
catch{
    write-host "Error: Could not connect to SPOService" -foregroundcolor red
    exit
}
#------------------------------------------------

#------------------------------------------------WORKING
if ($ConnectToAD -eq $true) {
	#Create the AD Groups
	write-host "Info: Create AD Groups" -foregroundcolor green
	New-ADGroup -Name $ADOwnersGroupName -SamAccountName $ADOwnersGroupName -GroupCategory Security -GroupScope DomainLocal -DisplayName $ADOwnersGroupName -Path $ADGroupPath -Description "Membership of this group gives Owner (Full Control) access to the root of $SiteName"
	New-ADGroup -Name $ADMembersGroupName -SamAccountName $ADMembersGroupName -GroupCategory Security -GroupScope DomainLocal -DisplayName $ADMembersGroupName -Path $ADGroupPath -Description "Membership of this group gives Member (Read and Write) access to the root of $SiteName"
	New-ADGroup -Name $ADVisitorsGroupName -SamAccountName $ADVisitorsGroupName -GroupCategory Security -GroupScope DomainLocal -DisplayName $ADVisitorsGroupName -Path $ADGroupPath -Description "Membership of this group gives Visitor (Read) access to the root of $SiteName"
	
    #Create Group Policies
	write-host "Info: Create GPO" -foregroundcolor green
    New-GPO -Name $GPOName
	#Remove Authenticated Users from having the GPO Applied
	Set-GPPermission -Name $GPOName -TargetName "Authenticated Users" -TargetType Group -PermissionLevel GpoRead -Replace
	#Add the new AD Groups to have the GPO Applied
	Set-GPPermission -Name $GPOName -TargetName $ADOwnersGroupName -TargetType Group -PermissionLevel GpoApply
	Set-GPPermission -Name $GPOName -TargetName $ADMembersGroupName -TargetType Group -PermissionLevel GpoApply
	Set-GPPermission -Name $GPOName -TargetName $ADVisitorsGroupName -TargetType Group -PermissionLevel GpoApply

	
	#Run a Delta Sync to Office 365
	write-host "Info: Run AD Delta Sync" -foregroundcolor green
	Start-ADSyncSyncCycle -PolicyType Delta
	
    #Wait for 3 minutes to allow 365 to register the sync
    $Seconds = 180
    $EndTime = [datetime]::UtcNow.AddSeconds($Seconds)
    while (($TimeRemaining = ($EndTime - [datetime]::UtcNow)) -gt 0) {
		Write-Progress -Activity 'Watiting for...' -SecondsRemaining $TimeRemaining.TotalSeconds
		Start-Sleep 1
	}
}
#------------------------------------------------

#------------------------------------------------WORKING
#verify if site already exists in SharePoint Online
write-host "Info: Checking if site already exists" -foregroundcolor green
$siteExists = get-SPOSite -Limit ALL | where{$_.url -eq $SiteURL}

#verify if site already exists in the recycle bin
write-host "Info: Checking if site already exists in the recycle bin" -foregroundcolor green
$siteExistsInRecycleBin = get-SPODeletedSite -Limit ALL | where{$_.url -eq $SiteURL}

#create site if it doesn't exists
if (($siteExists -eq $null) -and ($siteExistsInRecycleBin -eq $null)) {
    write-host "Info: Creating $($SiteName)" -foregroundcolor green
    #Create a new site with the Doc Centre template BDR#0
    New-SPOSite -Url $SiteURL -Owner $OwnerEmail -StorageQuota $StorageQuota -CompatibilityLevel 15 -LocaleID 1033 -Template "BDR#0" -TimeZoneId 2 -Title $SiteName
	write-host "Info: Site $($SiteName) Created" -foregroundcolor green
}
elseif ($siteExists -eq $true){
    write-host "Error: $($SiteURL) already exists" -foregroundcolor red
    exit
}
else{
    write-host "Error: $($SiteURL) still exists" -foregroundcolor red
    exit
}
#------------------------------------------------

#------------------------------------------------WORKING
#Wait for 3 minutes for Office 365 to acknowledge the new site
write-host "Waiting for 3 minutes for Office 365 to acknowledge the new site" -foregroundcolor green
$Seconds = 180
$EndTime = [datetime]::UtcNow.AddSeconds($Seconds)
while (($TimeRemaining = ($EndTime - [datetime]::UtcNow)) -gt 0) {
	Write-Progress -Activity 'Watiting for...' -SecondsRemaining $TimeRemaining.TotalSeconds
	Start-Sleep 1
}
#------------------------------------------------

#------------------------------------------------WORKING
#Connect to PnPOnline now the site is created
try{
	write-host "Info: Connecting to PnPOnline" -foregroundcolor green
    Connect-PnPOnline -Url $SiteURL -Interactive
    write-host "Info: Connected succesfully to PnPOnline" -foregroundcolor green
}
catch{
    write-host "Error: Could not connect to PnPOnline" -foregroundcolor red
    exit
}
#------------------------------------------------

#------------------------------------------------WORKING
#Disable check out on the new site
write-host "Info: Disabling check out on the new site" -foregroundcolor green
#Function to Disable Checkout Option for all libraries in a site
Function Disable-PnPRequireCheckout
{
    param
    (
	[parameter(Mandatory = $true, ValueFromPipeline = $True)]$Web
    )
	
    Try {
        Write-host "Processing Web:"$Web.URL -foregroundcolor green
		
        #Array to exclude system libraries
        $SystemLibraries = @("Form Templates", "Pages", "Preservation Hold Library","Site Assets", "Site Pages", "Images",
		"Site Collection Documents", "Site Collection Images","Style Library","Drop Off Library")
		
        $Libraries = Get-PnPList -Includes BaseType, Hidden, EnableVersioning -ErrorAction Stop
        #Get All document libraries
        $DocumentLibraries = $Libraries | Where {$_.BaseType -eq "DocumentLibrary" -and $_.Hidden -eq $False -and $_.Title -notin $SystemLibraries}
		
        #Disable Checkout
        ForEach($Library in $DocumentLibraries)
        {
            If($Library.ForceCheckout)
            {
                #Powershell to disable checkout for the library
                Set-PnPList -Identity $Library -ForceCheckout $false
                Write-host "`tRequire Check-out disabled on '$($Library.Title)'" -f Green 
			}
            Else
            {
                Write-host "`tRequire Check Out is already set to 'No' at '$($Library.Title)'" -f Yellow 
			}
		}
	}
    Catch {
        Write-host "`tError:" $_.Exception.Message -foregroundcolor Red 
	}
}
Get-PnPWeb | Disable-PnPRequireCheckout  
Get-PnPSubWeb -Recurse | ForEach-Object { Disable-PnPRequireCheckout $_ }
#------------------------------------------------

#------------------------------------------------WORKING
#Function to disable access request on SharePoint Online
write-host "Info: Disabling access request on the new site" -foregroundcolor green
Function Disable-PnPAccessRequest
{
    [cmdletbinding()]
    Param(
	[parameter(Mandatory = $true, ValueFromPipeline = $True)] $Web
    )
    Try {
        Write-host "Disabling Access Request on:"$web.Url -foregroundcolor Yellow 
        If($Web.HasUniqueRoleAssignments)
        {
            #Disable Access Request          
            $Web.RequestAccessEmail = [string]::Empty
            $Web.SetUseAccessRequestDefaultAndUpdate($False)
            $Web.Update()
            Invoke-PnPQuery
            Write-host "`tAccess Request has been Disabled!"$web.Url -foregroundcolor Green 
		}
        else
        {
            Write-host "`tWeb inherits permissions from the parent!"$web.Url -foregroundcolor Yellow 
		}
	}
    Catch {
        write-host "`tError Disabling Access Request: $($_.Exception.Message)" -foregroundcolor Red
	}
}
#Call the Function for Root Web and all Subwebs
Get-PnPWeb -Includes HasUniqueRoleAssignments | Disable-PnPAccessRequest
Get-PnPSubWeb -Recurse -Includes HasUniqueRoleAssignments | ForEach-Object { Disable-PnPAccessRequest $_ }
#------------------------------------------------

#------------------------------------------------WORKING
#Disable Members sharing files folders or the site
write-host "Info: Disable Members sharing files folders or the site" -foregroundcolor green
function DisableMemberSharing($siteUrl ) {
    write-host "Info: Disabling Members sharing files folders or the site" -foregroundcolor green
    $web = Get-PnPWeb -Includes MembersCanShare, AssociatedMemberGroup.AllowMembersEditMembership
    $web.MembersCanShare=$false
    $web.AssociatedMemberGroup.AllowMembersEditMembership=$false
    $web.AssociatedMemberGroup.Update()
    $web.RequestAccessEmail = $null
    $web.Update()
    $web.Context.ExecuteQuery()
}
write-host "Info: Disabling sharing for none owners" -foregroundcolor green
Set-SPOSite -Identity $SiteURL -DisableSharingForNonOwners
Set-SPOSite -Identity $SiteURL -SharingCapability Disabled -DefaultLinkToExistingAccess $true -DisableCompanyWideSharingLinks Disabled
#------------------------------------------------

#------------------------------------------------WORKING
#Connect to PNPOnline and AzureAD
write-host "Info: Connect to PnPOnline ManagementShell" -foregroundcolor green
try{
	write-host "Info: Connecting to PnPManagementShell" -foregroundcolor green
    Connect-PnPOnline $SiteURL -PnPManagementShell
    write-host "Info: Connected succesfully to PnPManagementShell" -foregroundcolor green
}
catch{
    write-host "Error: Could not connect to PnPManagementShell" -foregroundcolor red
    exit
}

write-host "Info: Connect to AzureAD" -foregroundcolor green
try{
	write-host "Info: Connecting to AzureAD" -foregroundcolor green
    Connect-AzureAD
    write-host "Info: Connected succesfully to AzureAD" -foregroundcolor green
}
catch{
    write-host "Error: Could not connect to AzureAD" -foregroundcolor red
    exit
}

#------------------------------------------------WORKING
#Add the AD Groups to SharePoint
write-host "Info: Add the AD Groups to SharePoint" -foregroundcolor green

if ($ConnectToAD -eq $true) {
	
	# Get the SharePoint site
	$SPOSite = Get-SPOSite $SiteURL
	
	$ADOwnersGroupID = (Get-AzureADGroup -SearchString $ADOwnersGroupName).ObjectId
	$OwnersLoginName = "c:0t.c|tenant|" + $ADOwnersGroupID
	write-host "Info: Adding AD Group $ADOwnersGroupName with Login ID $OwnersLoginName to Owners" -foregroundcolor green
	Add-SPOUser -Site $SPOSite -LoginName $OwnersLoginName -Group $SPOwnersGroupName
	
	$ADMembersGroupID = (Get-AzureADGroup -SearchString $ADMembersGroupName).ObjectId
	$MembersLoginName = "c:0t.c|tenant|" + $ADMembersGroupID
	write-host "Info: Adding AD Group $ADMembersGroupName with Login ID $MembersLoginName to Members" -foregroundcolor green
	Add-SPOUser -Site $SPOSite -LoginName $MembersLoginName -Group $SPMembersGroupName
	
	$ADVisitorsGroupID = (Get-AzureADGroup -SearchString $ADVisitorsGroupName).ObjectId
	$VisitorLoginName = "c:0t.c|tenant|" + $ADVisitorsGroupID
	write-host "Info: Adding AD Group $ADVisitorsGroupName with Login ID $VisitorLoginName to Visitors" -foregroundcolor green
	Add-SPOUser -Site $SPOSite -LoginName $VisitorLoginName -Group $SPVisitorsGroupName
	
}
#------------------------------------------------

#------------------------------------------------WORKING
#Get the library IDs
write-host "Info: Get Azure Tenant ID" -foregroundcolor green
$tenantId = (Get-AzureADTenantDetail).objectId
write-host "Info: Tenant ID: $tenantId" -foregroundcolor green

$PnPSite = Get-PnPSite -Includes Id | Select Id
$PnPWeb = Get-PnPWeb | Select Id
$PnPList = Get-PnPList 'Documents' | Select Id

# Convert Tenant ID
$tenantId = $tenantId -replace '-','%2D'

# Convert Site ID
$PnPSite = Get-PnPSite -Includes Id | select id
$PnPSite = $PnPSite.Id -replace '-','%2D'
$PnPSite = '%7B' + $PnPSite + '%7D'

# Convert Web ID
$PnPWeb = Get-PnPWeb -Includes Id | select id
$PnPWeb = $PnPWeb.Id -replace '-','%2D'
$PnPWeb = '%7B' + $PnPWeb + '%7D'

# Convert List ID
$PnPList = Get-PnPList $docLib -Includes Id | select id
$PnPList = $PnPList.Id -replace '-','%2D'
$PnPList = '%7B' + $PnPList + '%7D'
$PnPList = $PnPList.toUpper()

$FULLURL = 'tenantId=' + $tenantId + '&siteId=' + $PnPSite + '&webId=' + $PnPWeb + '&listId=' + $PnPList + '&webUrl=https%3A%2F%2F' + $TenantName + '%2Esharepoint%2Ecom%2Fsites%2F' + $siteName + '&version=1'

# Output the FULL URL To Copy and Paste
Write-Output 'Library ID: ' $FULLURL
Write-Host "You will now need to manually add this library ID to the GPO - $GPOName" -foregroundcolor magenta
#------------------------------------------------