Set-SPOSite -LockState: make a SharePoint Online site read-only or block access

To lock a SharePoint Online site, connect as a SharePoint Administrator and run Set-SPOSite -Identity URL -LockState ReadOnly (users can open but not change content) or -LockState NoAccess (all traffic is blocked). -LockState Unlock restores normal access. Read the current value from the LockState property of Get-SPOSite.

Connect-SPOService -Url https://contoso-admin.sharepoint.com
Set-SPOSite -Identity https://contoso.sharepoint.com/sites/project-x -LockState ReadOnly
Get-SPOSite -Identity https://contoso.sharepoint.com/sites/project-x | Select-Object Url, LockState

Replace contoso and the site URL with your own. Microsoft's reference says you must be a SharePoint administrator and a site collection administrator of the site to run Set-SPOSite.

The values

Typical uses: ReadOnly for a project that is finished but must stay available, or during a migration so nobody writes to the source; NoAccess for a site that must disappear for users while it is reviewed, without deleting it.

What the module checks before connecting

In version 16.0.27709.12000, -LockState is a plain string parameter with no list of allowed values, and the site object exposes LockState as a string too. The block shows this, and that a misspelled value such as Locked passes parameter binding and only meets the connection check:

Import-Module Microsoft.Online.SharePoint.PowerShell -DisableNameChecking
$p = (Get-Command Set-SPOSite).Parameters['LockState']
'-LockState type: ' + $p.ParameterType.Name
'ValidateSet: ' + [bool]($p.Attributes | Where-Object { $_.ValidValues })
'Parameter sets: ' + ($p.ParameterSets.Keys -join ', ')
'Get-SPOSite LockState: ' + [Microsoft.Online.SharePoint.PowerShell.SPOSite].GetProperty('LockState').PropertyType.Name
try { Set-SPOSite -Identity https://contoso.sharepoint.com/sites/project-x -LockState Locked -ErrorAction Stop } catch { $_.Exception.Message }

-LockState type: String
ValidateSet: False
Parameter sets: ParamSet1
Get-SPOSite LockState: String
No connection available. Use Connect-SPOService before running this CmdLet.

Because nothing in the module rejects a typo, copy the values exactly from the table above and confirm the result with Get-SPOSite.

Redirect NoAccess sites

Instead of a bare 403 you can send blocked users to a page that explains why:

Set-SPOTenant -NoAccessRedirectUrl 'https://contoso.sharepoint.com/sites/help/SitePages/site-locked.aspx'

The setting is tenant-wide and applies to every site with LockState NoAccess.

Lock several sites

Import-Csv .\sites-to-lock.csv | ForEach-Object {
  Set-SPOSite -Identity $_.Url -LockState ReadOnly
}
Get-SPOSite -Limit All | Where-Object LockState -ne 'Unlock' | Select-Object Url, LockState

The CSV needs a Url column. The second line lists every site that is not unlocked, which is a quick audit after a migration.

Pitfalls

• The root site collection cannot be locked.
• Set-SPOSite has many parameter sets; -LockState shares one with -Owner, -NoWait and the common site settings. If you add a parameter from another set and get Parameter set cannot be resolved using the specified named parameters., split the change into two Set-SPOSite commands.
• Locks apply to the whole site collection, including OneDrive sites if you target their URL; there is no per-library lock state.
• Run the module in Windows PowerShell 5.1, or in PowerShell 7 with -UseWindowsPowerShell. Before Connect-SPOService, every call returns No connection available.

FAQ