M365 Governance as Code
Most governance tools give you a green box. A green box cannot tell you whether something is enforced by the product, documented as a limit, merely recommended, or just our opinion. Those four sentences lead to four different conversations.
The problem with a passing score
A governance report usually arrives as a list of green and red. It reads as certainty, and most of it is not.
Consider four statements that a typical report renders identically:
- the product enforces this, and there is no alternative;
- the product imposes a boundary, and here is the number;
- Microsoft recommends this, and permits the other option;
- we think this is a good idea, and a reasonable organisation may decline.
Those are not degrees of the same thing. They lead to different budgets, different deadlines and very different conversations with an auditor. A tool that renders them the same way has removed the one piece of information the reader needed.
There is a second problem, and it is worse because it is invisible. When a check cannot read something, most tools show a pass. Missing evidence becomes compliance, and nobody can tell which greens were observed and which were merely assumed.
What this tool does differently
Every rule declares its own nature, in the rule file, before anything runs:
| The claim | What it means | What the rule must carry |
|---|---|---|
| Requirement | The product enforces this | A Microsoft source |
| Documented limit | A boundary with a number | A source, and the limit shown beside the observed value |
| Documented guidance | Microsoft recommends it, and permits the alternative | A source |
| Convention | Common practice that nobody documents | A written rationale |
| Opinion | Our position, stated as ours | A written rationale |
A source never decides the type. An opinion may cite documentation and remains an opinion. The link explains the claim; it does not change what kind of claim it is.
And when a fact cannot be read, the result is not a pass. It is an explicit unresolved state, and the report says so in words: missing evidence is a fact about the collection, not a fact about your tenant.
What you get
- a read only PowerShell collector that gathers facts and normalises them to JSON;
- a local engine that applies the rules and produces the result;
- public rules, in plain text, that you can read, argue with, and change;
- a report in Markdown for people and in JSON for pipelines;
- example data, so you can run the whole thing before you point it at anything real.
What it does not do
- it does not change anything in your tenant, and has no write path at all;
- it does not send your inventory, your report, or anything else to us;
- it does not say compliant when it has no data;
- it does not turn a recommendation into a requirement;
- it does not replace a technical audit, and does not claim to.
A result, in full
This is what one finding looks like. Nothing is abbreviated:
Result: fail
The list holds 148,000 items, above Microsoft's documented limit of 100,000,
and still inherits its permissions. Inheritance can no longer be broken on
this list, so it cannot be given unique permissions later.
Basis: documented limit
Observed: 148,000 items
Limit: 100,000 items
Source: Microsoft documentation, checked on a stated date
Limitation: this measures a position, not a trajectory. A list at 99,000
items and growing passes today and loses the option within weeks.
The last line is required by the rule format. Every rule has to answer one question in writing: how can this rule pass while the problem survives? A rule whose author cannot answer that has not been understood well enough to be published.
Where your data goes
Nowhere. The collector runs on your machine, against your tenant, with your credentials, and writes a file to your disk. The engine reads that file locally. There is no account, no upload and no telemetry, because there is no service on our side to receive any of it.
If the sign in is interactive, the report says so, on the first page: that run saw what one person can see, and nothing in it should be read as a statement about the whole tenant.
Where it fits
This tool answers a different question from the SharePoint Compass. The Compass helps you choose a direction for a SharePoint estate. This one measures observable conditions in a Microsoft 365 tenant and tells you how much confidence each answer deserves.
If you would rather have the reading done with you, we can review your results together and tell you which findings actually matter in your context.