Deleting SharePoint Online Site Collection Programatically

Last week, I got a requirement, where I need to delete some 300+ SPO site collections. Its a tedious process to delete SPO SC manually by going to Site Settings page and click on the link "Delete site".

So I thought is there any better way to delete the SPO site collections programmatically. There is no CSOM api, where we can leverage to delete the Site Collections and one of my colleague asked me to try using HTTPWebRequest approach

Here are the high level steps that he suggested me to do:

1. For one Site Collection, go to site settings page and click on "Delete site" link
2. Once you are on that page, for the delete button click event, do the fiddler trace and capture the all the actions that fiddler is doing for that operation
3. Mimic the same using C# code

I followed the same approach that he has suggested and I am able to delete the SPO site collection

Here are the important things that needs to be remembered when doing this operation

1. First we need to authenticate using SharePoint Online
2. Get Authenticated cookie to avoid redirects
3. Set appropriate request headers
4. Set appropriate POST parameters and url encode the same

Deleting a site collection using Http approach is a three step process:

1. Authenticate using SPO credentials and get the authenticate cookie for the site collection that needs to be deleted
2. Need to get post parameters such as form digest, view state, event target, event validation etc
3. Using the SPO credentials and using the post parameters, created another http web request object that will delete the site collections

Authenticating to SharePoint online

To authenticate to SharePoint online, we need SharePoint client dll's. Refer the following SharePoint client side dlls

1. Microsoft.SharePoint.Client
2. Microsoft.SharePoint.Client.Runtime

The below method is used to authenticate the user using SPO credentials



Getting Authentication Cookie

After authentication, we need to get authenticated cookie for the site collection, that needs to be deleted

The below code is used to get authenticated cookie



We need to add the cookie that got generated to the CookieContainer class, which will be added to the HTTPWebRequest class

Setting up the HttpWebRequest instance

The below code will show how to create HttpWebRequest class and how to pass SPO credentials and how to setup the CookieContainer that has been discussed above



The url for deleting the site collection will be: "site collection url"/_layouts/15/deleteweb.aspx.

For ex: https://your tenant/teams/sitecollectionname/_layouts/15/deleteweb.aspx

For the Http Web Request class, we need to set the following properties. This information we got from the fiddler trace

Method = "POST"
ContentType = "application/x-www-form-urlencoded"
UserAgent = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; WOW64; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; BRI/2; InfoPath.3)";

Apart from setting the properties, we also need to set some form parameters, the same form parameters that "Delete" button will set on the "deleteweb.aspx"

These form parameters we can get from the fiddler trace

1. __REQUESTDIGEST
2. __VIEWSTATE
3. __EVENTVALIDATION
4. __VIEWSTATEGENERATOR
5. SideBySideToken

In order to get the above form parameters, first we need to get the html source for the deleteweb.aspx and from that html source, we need to scrap the html source to get the above values.

I have written two functions, first function will return the html source and the second function will parse the html source and will get the desired values as discussed above





The below code will show to use the above two methods and set the post parameters for the http web request class



Setting the post data and pass that post data to the web request class



__EVENTTARGET has been hard coded to "ctl00$PlaceHolderMain$ctl07$RptControls$BtnDelete" which we got from the fiddler trace and this can be used as is until unless Microsoft does not change the button name and position in the deleteweb.aspx

The below part of post data has been hard coded which I copied directly from the fiddler trace. Convert the string post data to byte array and pass that information to the request object




 The final step is to get the HttpWebResponse for the http web request that has been created above




If the response string contains, "Working on it", then we can assume that site has been deleted