How to find locked sites in SharePoint Online

Before you start

Use an account with the SharePoint Administrator role. For Get-SPOSite, Microsoft says the account must be a SharePoint Online administrator and a site collection administrator. In PowerShell 7 the SharePoint Online Management Shell must be loaded through Windows PowerShell, which the last line of the install block does.

The lock state is read live. The root site can't be locked, and a site in the Recycle Bin isn't returned. The examples read and export and change nothing; they never call Set-SPOSite.

Option 1

Find locked sites with PowerShell

Install the module once, then connect and export the locked sites. The connection prompts you to sign in. Replace contoso with your tenant's name.

# Install once, if the module is not already installed.
Install-Module Microsoft.Online.SharePoint.PowerShell -Scope CurrentUser
# In PowerShell 7 only: load the module through Windows PowerShell.
Import-Module Microsoft.Online.SharePoint.PowerShell -UseWindowsPowerShell

$ErrorActionPreference = 'Stop'
Connect-SPOService -Url 'https://contoso-admin.sharepoint.com'
try {
    $sites = @(Get-SPOSite -Limit All -Filter "LockState -ne 'Unlock'")
    if ($sites.Count -eq 0) {
        Write-Output 'No SharePoint site is locked.'
    } else {
        $sites | Sort-Object LockState, Url |
            Select-Object Title, Url, LockState, Template, Owner, LastContentModifiedDate |
            Export-Csv -Path './locked-sites.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($sites.Count) locked sites written to locked-sites.csv."
    }
} finally {
    Disconnect-SPOService
}

The filter runs in SharePoint, so only locked sites come back, grouped by lock state. Microsoft says the filter's operators are case sensitive, so keep -ne in lower case. OneDrives are left out by default; add -IncludePersonalSite $true after -Limit All to include them. LastContentModifiedDate shows when the site's content last changed, which helps tell a site kept as an archive from one in use.

Check a single site

Reconnect with Connect-SPOService, then read 1 site's lock state by its address. The export above disconnects when it finishes.

# Run while connected to SharePoint. Replace the example address.
Get-SPOSite -Identity 'https://contoso.sharepoint.com/sites/research' |
    Select-Object Title, Url, LockState

Option 2

Check a site in the admin centre

1. Sign in to the SharePoint admin centre as a SharePoint Administrator.
2. Go to Sites > Active sites and search for the site.
3. Select the site to open its panel. Microsoft says a site put into read-only mode by a site lifecycle management policy offers Unlock there; leave it alone, as it takes the site out of read-only mode.
4. Open the site's address in a browser. A read-only site shows a message that it's under maintenance and read only, and a no-access site shows 403 Forbidden or goes to the address your organisation set for blocked sites.

This suits checking 1 site that a user reports. To list every locked site, use PowerShell or Altivane.

Common questions

Why is a site read only when it isn't in the list?

Microsoft says the message that a site is read only at the site collection administrator's request usually means a site policy closed it. Read-only mode from a site lifecycle management policy is also separate from the lock state. If neither applies, check the Message center and Service health for maintenance.

Why can't I unlock a site with PowerShell?

Microsoft says the unlock command doesn't work on a site that a site closure policy closed and made read only. Check whether a site policy applies and follow Microsoft's steps for site closure policies to reopen it. The examples here only read the lock state.

How do I find sites nobody uses before locking them?

Look at when each site was last used. See how to find inactive sites in SharePoint Online.