How to Automate SharePoint Site Requests — Part 3: The Creation Engine

by

We’ve got the form and approvals working. Now we build the piece that actually creates the SharePoint site. This lives in Azure Automation — think of it as a cloud robot that runs a script whenever we tell it to.

First, Set Up Azure Automation

  1. Go to the Azure portal (portal.azure.com)
  2. Search for “Automation Accounts”
  3. Create a new one (or use an existing one from your Cloud team)
  4. Once created, go to “Runtime Environments”
  5. Create one using “PowerShell 7.2”
  6. Add the “PnP.PowerShell” module to it (this is the tool that talks to SharePoint)

Import Your Certificate

Remember that certificate file from Part 1?

  1. In your Automation Account, go to “Certificates”
  2. Click “Add a certificate”
  3. Name it “SharePoint-Provisioner-Cert”
  4. Upload the file ending in .pfx
  5. Enter the password you set earlier

Create the Runbook

A “runbook” is just a script that Azure runs for you.

  1. Go to “Runbooks”
  2. Click “Create a runbook”
  3. Name it “SiteProvision-Real”
  4. Choose type “PowerShell” and runtime “7.2”
  5. Click “Create”

Now paste in the script. It runs in six stages:

Stage 1 receives the request details from your approval flow.

Stage 2 logs in to SharePoint using the certificate (no passwords needed).

Stage 3 creates the actual site:

New-PnPSite -Type CommunicationSite -Title $siteTitle -Url $targetSiteUrl -Owner $primaryOwner -Wait

Stage 4 sets up permissions. This is the clever part. Instead of giving the requester full control (where they could accidentally delete the site), we:

  • Make the admin team the true owners
  • Give the requester “Design” access (they can manage content but not destroy the site)
  • Assign the member and visitor groups appropriately

Stage 5 updates the request list to say “Provisioned” and adds the site link.

Stage 6 triggers the notification email from Part 2.

Connect It to Your Approval Flow

  1. In your runbook, click “Add webhook”
  2. Name it, set it to expire in one year
  3. Copy the web address it gives you (you only see this once, so save it!)
  4. Go back to your MainApprovalFlow from Part 2
  5. Paste this address into the HTTP action’s URL field

One Important Tip

When adding a security group to SharePoint in the script, use this special format:

c:0t.c|tenant|THE-GROUP-ID

Not the group’s name. This trips up a lot of people.

What’s Next

In the final part, we’ll build the user-friendly form that starts it all — plus I’ll share the lessons I learned the hard way so you can avoid them.

Leave a Comment