Skip to content

FAQ and Troubleshooting

Jump to bottom
Michael Mardahl edited this page Sep 15, 2026 · 4 revisions

FAQ and troubleshooting

Known limitations

  • A specific-people link that includes a guest is removed in full; internal members on the same link lose it too (the item and any other grants stay).
  • Guest detection on specific-people links depends on the link exposing an external grantee; a follow-up report-only pass is the verification.
  • EEEU/Everyone nested inside a site permission group is group membership rather than a direct grant, so it is left alone.
  • Sharing links on list items outside document libraries are not handled.
  • Cleanup does not prevent new sharing. Use the Sharing tab's hardening toggles for that (see Tenant-Hardening).
  • The SharePoint admin site URL is derived as https://<tenant>-admin.sharepoint.com; tenants that do not follow this pattern (vanity domains, some multi-geo setups) need the Setup tab's config editor to override AdminUrl manually.
  • Restored scan-cache sessions may be stale relative to the tenant's current sharing state; rescan before acting on old results. Scan-all (X) scans one target at a time.
  • OneDrive secondary-admin management (M) released in v1.9.0 with limited live validation. List is read-only (no permission-change confirmation, no directory/Graph lookup, no CSV evidence). Add has an operator-reported successful Add via app-only auth; Remove, owner-negative cases, bulk targets, and delegated auth are still pending live-tenant validation. Treat Add/Remove with care and review BEFORE/AFTER CSV evidence. See OneDrive-Admin-Management.

Common issues

Downloaded files are blocked (Mark of the Web). Use Launch-Sharing-Manager.bat. It unblocks the whole folder recursively before starting the tool.

A site fails to connect or scan. Per-site failure isolation: the failure is logged and the run continues with the remaining targets. Check the Log tab (O opens the log file) for the underlying PnP error. Most often this is a missing Site Collection Admin grant in delegated mode, or an unreachable or nonstandard site URL.

Delegated mode cannot scan a OneDrive. The operator must be Site Collection Admin on that OneDrive. At scale this is the reason to switch to app-only certificate mode; see Authentication.

Sharing tab shows an old tenant's settings. Switching tenants clears the posture and requires a reload, so this should not happen. If it does, press R to refresh and report a bug.

Consent URL expires or consent is pending. The wizard's consent URL can be regenerated by re-running the app registration action. Only Global Administrator or Privileged Role Administrator can consent to application permissions.

Terminal renders garbage. The UI is raw VT/ANSI. Use a VT-capable terminal (Windows Terminal, iTerm2, any modern Linux terminal, SSH sessions). Legacy conhost with VT processing disabled is unsupported.

M fails with a permission error on the OneDrives tab. The OneDrive secondary-admin Add/Remove operations need Graph User.Read.All (app-only) or the delegated mode's default consent set. List needs no additional scope. If this app registration predates that scope, add it manually - see Authentication. This never falls back to a partial-match user lookup; it fails closed. Scans and revokes are unaffected.

M shows a [Failed] or [Blocked] target with no visible reason, or "Eligible: 0" and no error dialog. The preflight preview and the final report show the actual reason under each Failed/Blocked target - not just the classification word. If a run still looks reason-less, open the log file (O on the Log tab) and look for the target's URL; every preflight, evidence-export, and mutation-time failure logs the original error there, including when zero targets are eligible. See OneDrive-Admin-Management#diagnostics-and-logging.

M logs "The query expression is not supported." for a target's membership read. This was a bug in how the tool requested PnP's AadObjectId field (a dotted nested path CSOM's query translator rejects), fixed in v1.9.0 - it was never a missing Graph scope, app permission, or tenant provisioning problem. If you still see this exact message, you are on a build older than the fix; update SharePoint Sharing Manager. It fails closed (Blocked, no write) rather than guessing membership, so no mutation could have happened while this was present.

Where things live

Location Content
SharePoint-Sharing-Manager_<timestamp>.log Session log (also viewable on the Log tab)
SSM-Exports/ BEFORE/REVOKED evidence, view exports, and OneDrive secondary-admin BEFORE/AFTER evidence (see OneDrive-Admin-Management)
~/.sharepoint-sharing-manager.json Sign-in configuration, one entry per tenant
~/.sharepoint-sharing-manager-cert/ Self-signed certificate files for app-only mode
SSM-Cache/<tenant-slug>/session.json Cached scan results per tenant; contains directory data

Logs, exports, and the scan cache contain directory data. Treat them accordingly. There is no telemetry, and nothing leaves the machine except operator-triggered calls to SharePoint Online and Microsoft Graph.

The tool says a newer version is available - how do I update?

At startup the tool checks GitHub Releases and shows a notice if a newer version exists. Press Y to open the download page in your browser, then replace your copy of SharePoint-Sharing-Manager.ps1 with the new one.

Updating replaces only the script file. Your settings (~/.sharepoint-sharing-manager.json), scan cache (SSM-Cache/), and exports (SSM-Exports/) remain untouched.

The check is notify-only: the tool never downloads or replaces itself. If the machine is offline or GitHub is unreachable, the check is skipped silently and the tool starts normally.

Still stuck

Open an issue at github.com/mardahl/SharePoint-Sharing-Manager/issues with the relevant log excerpt (redact directory data as needed). For security issues, see SECURITY.md in the repo for private reporting.

Clone this wiki locally