M365 Governance as Code
Microsoft 365 governance that shows its work.
Evidence, basis and uncertainty preserved from the read to the conclusion.
From evidence to a conclusion you can inspect
The Engine records evidence, evaluates published rules and preserves the limits of what was established. Inspect its contracts and rule documentation before interpreting a result.
Read the core conceptsExplore the product
- Rules39 published rules, each with its basis and what a pass does not settle
- AssuranceHow far each capability has been proved, and where the path stops today
- TrustThe read-only model, identity, and how a pass is earned
- Manual of commandsThe earlier commands one by one, each with its usage quoted from the engine
- DocumentationThe manual end to end, including what each collector reads and with what permission
- Migration verificationWhat a move actually moved, from a read taken before it and one taken after
Used from one command line: m365g
The Engine is driven by m365g. Read-only collectors read a Microsoft 365 tenant and write nothing to it, what they read is kept as evidence with where it came from and what could not be read, and published rules assess that evidence. Where the evidence cannot say, the answer is unknown and never a pass. The earlier name, m365-governance, still works for every command.
- Install and first useOne package installs m365g, platform by platform, and the first run needs no tenant
- Authentication and sessionsSigning in once, where the session is kept, and the scope each read asks for
- Command reference59 commands by service: what each reads, what it needs and how far it is proved
- Collector catalogue24 read-only collectors, each with what its proof did not cover
- Composed scenariosExternal access, ownership, application credentials and Conditional Access, answered from evidence already collected
- Evidence and reportsWhy a view is not the evidence, and how a refusal or a gap is shown and never turned into a pass
Read alongside
Run it before you point it at anything.
Everything offline, against evidence that ships with the package. No tenant, no app registration, no PowerShell.
$ pipx install m365-governance-as-code==1.0.0b10
$ m365g evaluate --evidence <a-fixture.json>
3 rule evaluations across 1 resource
Fail 1
Unknown 2
Pass 0
Fail · SPO-LIST-001 · documented-limit
The list holds 148000 items, above Microsoft's documented
limit of 100,000, and still inherits its permissions.
Unknown · SPO-LIST-002 · documented-limit
The scope count does not settle this list's position
relative to the 50,000 limit. This is not a pass.