M365 Storage Optimiser v1.0 Demo

Enterprise SharePoint & OneDrive storage automation suite. Sanitised portfolio reconstruction of a live 32TB M365 tenant — reduced from 98% to 64% utilisation in under 6 months without data loss.
📅 Deployed: April 2025 🏢 Tenant: UK Local Government Organisation 🔐 Auth: Entra ID + Certificate (JWT assertion) 📊 Sites: 9 departments, 1.5M files, 32TB
34%
Storage Reduction
32TB → 64% utilisation
250→25
Version Limit
Major versions retained
90+
Monitoring Runs
Iterative batch tracking
12
PowerShell Scripts
Full automation pipeline
£0
External Spend
Built in-house
0
Data Loss
No accounts deleted
🏠 Dashboard
📋 Scan
✂️ Trim
📊 Status
🛠 Tools
🔐 Setup
📄 Docs
📈 Report

Project Overview

Sanitised reconstruction of the SharePoint version history automation project — from conception to deployment.

🔧 The Challenge

The organisation's SharePoint estate was at 98% utilisation. Storage was being consumed by excessive version history — default 500 major versions per file. With limited budgets, an internal solution was needed.

⚙️ The Solution

A custom PowerShell pipeline using Entra ID certificate authentication, Graph API queries, and batch version trimming. Two scripts working in tandem: one for setting limits and trimming, one for monitoring job progress.

Pipeline Architecture

┌─────────────┐ ┌──────────────┐ ┌───────────────┐ ┌──────────────┐ │ Entra ID │───▶│ Storage │───▶│ Set Version │───▶│ Batch Trim │ │ Cert Auth │ │ Counter.ps1 │ │ Limit.ps1 │ │ Job.ps1 │ └─────────────┘ └──────────────┘ └───────────────┘ └──────────────┘ │ ▼ ┌─────────────┐ ┌──────────────┐ ┌───────────────┐ │ Audit Log │◀───│ Job Status │◀───│ Progress │ │ Export │ │ Check.ps1 │ │ Poll.ps1 │ └─────────────┘ └──────────────┘ └───────────────┘

Key Scripts

ScriptPurposeAuth
Combined.ps1Main orchestrator — CSV import, version limit prompt, batch set, batch trim, audit logCert + PnP
StorageCounter.ps1JWT assertion → Graph API → site size calculationJWT + Graph
Working_Job_Status.ps1Full status dashboard — polls Master.csv, updates 15+ columns per siteSPO Admin
PrivateChannelInfoCheck.ps1Enumerates all Teams, channels, members via Graph APICert + Graph
OneDriveCheck.ps1Batch OneDrive site check with exponential backoff, 50-site batchesGraph + SPO
Provision_New_2.ps1OneDrive provisioning with full logging and 15-min waitSPO Admin

Scan Tenant Sites

Scan all SharePoint sites and report storage usage, file counts, and version history limits.

Trim Version History

Set version history limits and trim excess versions in throttling-safe batches.

Job Status Dashboard

Monitor batch-delete job progress across all sites. Polls Get-SPOSiteFileVersionBatchDeleteJobProgress.

Tool Suite

Complete inventory of PowerShell scripts and supporting documents.

📁 Set Expiary & Trimjob (12 scripts)

📁 OneDrive-Check (4 methods, 6 scripts)

📁 Provisioning (3 scripts)

📁 Other Utilities (5 scripts)

Entra ID + Certificate Auth Setup

PnP PowerShell now requires your own Entra ID app registration for modern automation. This guide separates delegated/interactive setup from the unattended certificate pattern used by this portfolio reconstruction.
1

Create Entra ID App Registration

Navigate to Entra ID → App registrations → New registration. Enter a name, leave defaults, click Register. Note the Application (Client) ID and Tenant (Directory) ID.

2

Configure API Permissions

For interactive PnP use, add SharePoint Delegated permissions such as AllSites.Read. For unattended certificate/app-only automation, use SharePoint Application permissions such as Sites.Read.All or Sites.FullControl.All, then grant admin consent. Choose the least privilege that covers the operation.

3

Generate Self-Signed Certificate

In PowerShell as Administrator:

$CertificateName = "M365 Storage Optimiser" $CertificatePassword = "" $DocumentsFolder = [Environment]::GetFolderPath("MyDocuments") $Certificate = New-SelfSignedCertificate -Subject $CertificateName ` -CertStoreLocation "Cert:\CurrentUser\My" -KeyExportPolicy Exportable ` -KeySpec Signature -KeyLength 2048 -KeyAlgorithm RSA -HashAlgorithm SHA256 Export-Certificate -Cert $Certificate -FilePath "$DocumentsFolder\$CertificateName.cer" Export-PfxCertificate -Cert $Certificate -FilePath "$DocumentsFolder\$CertificateName.pfx" ` -Password (ConvertTo-SecureString -String $CertificatePassword -Force -AsPlainText)
4

Install & Upload Certificate

Install both .cer and .pfx files on the machine (right-click → Install Certificate, accept defaults). Then upload the .cer file to Entra ID: App → Certificates & secrets → Upload certificate. Note the Thumbprint.

5

Build JWT Assertion (StorageCounter.ps1 pattern)

$jwtHeader = @{ alg = "RS256"; typ = "JWT"; x5t = [Convert]::ToBase64String($cert.GetCertHash()) } $jwtPayload = @{ aud = "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" iss = $appId; sub = $appId; jti = [guid]::NewGuid() exp = [int][double]::Parse((Get-Date).AddMinutes(10).ToUniversalTime()...) nbf = [int][double]::Parse((Get-Date).ToUniversalTime()...) } # Sign with private key → client_assertion # POST to token endpoint → access_token # Authorization: Bearer {token} for Graph API calls
6

Authenticate in PowerShell

Use the collected IDs and certificate thumbprint in your scripts:

$ClientID = "your-client-id" $ThumbPrint = "your-cert-thumbprint" $Tenant = "your-tenant-id" Connect-PnPOnline -Url $SiteURL -ClientId $ClientID -Thumbprint $ThumbPrint -Tenant $Tenant # OR Connect-SPOService -Url "https://tenant-admin.sharepoint.com"
✓ Sanitised reconstruction of the certificate/app-only setup pattern used in the production 32TB storage reduction project

Documentation

Supporting documents created alongside the project.

📘 SharePoint Version History Project Document

860KB. Full project lifecycle: introduction, objectives, challenges (deprecated cmdlets, silent auth changes, user permissions), solution overview, process pipeline, testing, deployment, outcome.

Project Doc

📗 Entra ID App Registration Guide

2.7MB. Complete step-by-step guide with screenshots: app registration, API permissions, admin consent, cert generation, cert installation, authentication in PowerShell.

Technical Guide

📕 SharePoint Versioning User Guide

1.4MB. User-facing guide explaining version history, how it works, and what the changes mean for end users.

User Guide

📙 SharePoint Versioning via Online Management Shell

1.4MB. Technical reference for managing version history via PowerShell and SharePoint Online Management Shell.

Technical Ref

📋 Master CSV Tracking Log

90+ iterative CSV files from April 2-9, 2025. Each run tracked per-site progress: files processed, versions deleted, storage released, error counts.

Monitoring

📊 Project 2 — Unlicensed OneDrive Cleanup

Three versions (v1, v4, Temp). Cross-referenced audit reports, stakeholder engagement across 100+ users, compliance admin access.

Project Doc

📊 Project 3 — HB CIC Automation

SQL + PTC Automation pipeline. Full SDLC: requirements gathering, SQL development, PTC integration, UAT, deployment, monitoring.

Project Doc

📊 Project 4 — Financial Systems Runbook

ITIL-based runbook documenting 50+ PTC error types, actionable fixes, criticality levels, and response procedures.

Project Doc

🏆 EPA Project — Freshservice CMDB Migration

End-point assessment project. Migrated software catalogue from Excel to Freshservice CMDB with relationship mapping.

EPA

📄 Dataset: Unlicensed OneDrive Users

773KB CSV of users with cross-referenced access data. Method 2/3 scripts used this to identify unlicensed access.

Data

📄 Dataset: OneDriveAdmins ActionList

1.3MB CSV mapping OneDrive site ownership, admin access, and license status for escalation.

Data

🔐 Certifications

Data Science Certificate (Codecademy), Introduction to Cybersecurity (Cisco), BCS RITTech registration.

Cert

Storage Report

Before/after comparison with summary metrics.