How to read the catalogue
A collector is one read of one surface. A command runs it, and the evidence it writes is what rules and inspections read afterwards.
- Collector and state. The collector's name is the one
m365g collector describe NAMEtakes. The label is the state of the command that runs it, derived as on the command reference. The live validation state under it is the Engine's own word:full,partialornone. - Reads. The calls the collector makes, as the Engine records them.
- Permissions. The permissions recorded for the read.
not-establishedis printed as that word: no least-privilege set has been proved for the read, which is not the same as needing none. Minimum permissions sets them side by side. - Needs. The address the command has to be given.
- Rules and reader. The rules that evaluate what the collector writes, and who reads it besides.
- What its proof did not cover. The limits the Engine's record of the read carries, in the record's own words. A collector that has read a directory has read one directory, and this column is what that one read left unproved. Read it before relying on the collector.
The same catalogue is printed by m365g collector list, and one collector at a time by m365g collector describe NAME. Both are described on the overview. The copy on this page was taken by running the first of them with --format json at the commit named under the table, and it reaches no tenant.
PowerShell
m365g collector list --format jsonA state is never added to another. The table has no total of collectors by state, and no figure for how much of the Engine a tenant has answered: each row says what one read established.
Every collector
24 collectors, from the Engine's own catalogue at commit 0c269e9d29d0.| Collector and state | Reads and permissions | Needs, rules and reader | What its proof did not cover |
|---|---|---|---|
agentsPublished, tenant-verifiedLive validation state: fullthe Copilot agents in one site, and the sources each declaresRun by m365g spo agent listService agents, through PowerShell | Reads Get-PnPWeb Get-PnPCopilotAgentPermissions Sites.Read.All | Needs --site-urlFeeds no rule.Read by the agent inventory in a report, and any viewer. | an empty surface proves the read and not the branch that reports a population |
applicationsPublished, tenant-verifiedLive validation state: fullthe application registrations in the directory, when each credential ends, and what each asks forRun by m365g entra app listService entra, through Microsoft Graph | Reads GET /v1.0/applications ($select of eight properties; a credential's hint and a certificate's bytes are never kept)Permissions Application.Read.All | Needs --tenant-urlFeeds no rule.Read by the application list an operator enumerates, and the application exposure inspection. | no credential ended inside the default window, so the `ending` branch has not run against a directoryone page: paging is proved against a stand-in onlyno refusal was met, and no registration came back without a credential listone directory, one moment: nothing here establishes how another tenant answers |
conditional-accessPublished, tenant-verifiedLive validation state: fullthe Conditional Access policies, named locations and Security Defaults state of one tenantRun by m365g entra ca listService entra, through Microsoft Graph | Reads GET /v1.0/identity/conditionalAccess/policies GET /v1.0/identity/conditionalAccess/namedLocations GET /v1.0/policies/identitySecurityDefaultsEnforcementPolicyPermissions Policy.Read.All | Needs --tenant-urlFeeds the rules CA-RECOVERY-001 CA-SCOPE-001 CA-STATE-001Read by governance rules. | no rule existed at the time, and the slice's own path is still unprovedno representation check was made: whether a policy's effect matches what its fields say was not observedreport-only and disabled policies are read as configuration and their effect on a sign-in was not observedone directory, one moment: nothing here establishes how another tenant's directory answers |
groupsPublished, tenant-verifiedLive validation state: fullthe Microsoft 365 groups in the directory, and how many owners and members each has, by kind and never by nameRun by m365g entra group listService entra, through Microsoft Graph | Reads GET /v1.0/groups ($filter to Microsoft 365 groups)
GET /v1.0/groups/{id}/owners ($select=id)
GET /v1.0/groups/{id}/members ($select=id)PermissionsGroupMember.Read.All | Needs --tenant-urlFeeds no rule.Read by the group list an operator enumerates, and the ownership inspection. | no group refused its owners or its members, so the document a refusal writes is proved against a stand-in onlyone page of groups and one page per relationship: paging is proved against a stand-in onlysome connected sites did not say who administers them, so the second surface could not be compared for thosewhether a named site administrator is also one of the group's owners was not read: no identity is kept, which is why the inspection reports a rangeone directory, one moment: nothing here establishes how another tenant answers |
guestsPublished, tenant-verifiedLive validation state: fullthe guest accounts in the directory, by object id and never by nameRun by m365g entra guest listService entra, through Microsoft Graph | Reads GET /v1.0/users?$filter=userType eq 'Guest' ($select of six properties, none of which names a person)Permissions User.Read.All | Needs --tenant-urlFeeds no rule.Read by the guest list an operator enumerates, and the external access inspection. | a population of one: it proves the path and not the range, and neither a pending invitation nor a disabled account was observedone page: paging is proved against a stand-in onlyno refusal was met: the document a refused read writes is proved against a stand-in onlyone directory, one moment: nothing here establishes how another tenant answers |
service-principalsPublished, tenant-verifiedLive validation state: fullthe service principals in the directory: whether each is enabled, whose application it is, and when its own credentials endRun by m365g entra serviceprincipal listService entra, through Microsoft Graph | Reads GET /v1.0/servicePrincipals ($select of eight properties; a credential's hint and a certificate's bytes are never kept)Permissions Application.Read.All | Needs --tenant-urlFeeds no rule.Read by the service principal list an operator enumerates, and the application exposure inspection. | one page: the population was below the page size asked for, so paging is proved against a stand-in onlyno refusal was metwhat any service principal was granted was not read: that needs a scope that has not been decidedone directory, one moment: nothing here establishes how another tenant answers |
tenant-governancePublished, tenant-verifiedLive validation state: fullwhat every user in a tenant may do without asking, and how many accounts hold the role that may do anythingRun by m365g entra tenant governance getService entra, through Microsoft Graph | Reads GET /v1.0/policies/authorizationPolicy
GET /v1.0/policies/authenticationMethodsPolicy (the method configurations are expanded by the service, so this is one read and not one per method)
GET /v1.0/roleManagement/directory/roleAssignments ($filter on the Global Administrator template, $select only)
GET /v1.0/users/{id}?$select=id,onPremisesSyncEnabled (once per principal, so that no display name is ever received)PermissionsPolicy.Read.All RoleManagement.Read.Directory Policy.Read.AuthenticationMethod | Needs --tenant-urlFeeds the rules ENTRA-AUTH-001 ENTRA-AUTH-002 ENTRA-AUTH-003 ENTRA-AUTH-004 ENTRA-AUTH-005 ENTRA-AUTH-006 ENTRA-GUEST-001 ENTRA-METHOD-001 ENTRA-METHOD-002 ENTRA-METHOD-003 ENTRA-ROLE-001 ENTRA-ROLE-002 ENTRA-ROLE-003Read by governance rules. | no representation check was made: no field's claimed effect was read against the effecteligible assignments under Privileged Identity Management were not read, so a count of standing Global Administrators may understate who can become onethe authentication methods policy publishes what the tenant permits and never what anybody registered or usedone directory, one moment: nothing here establishes how another tenant's directory answers |
forwardingPublished, tenant-verifiedLive validation state: fullwhether mail can leave this organisation automatically, and which of the three controls that govern it are in which positionRun by m365g exo forwarding getService exchange, through PowerShell | Reads Get-HostedOutboundSpamFilterPolicy Get-RemoteDomainPermissions Exchange.ManageAsApp | Needs --tenant-urlFeeds the rules EXO-FORWARD-001 EXO-FORWARD-002Read by governance rules. | mail flow rules, the third route by which mail leaves automatically, are not read: a tenant can forward through one while both of these controls say otherwisethe branch that passes has not run against a directory: it is proved by fixtures onlyone policy and one remote domain: it proves the path and not the range, and an organisation with several of either has not been readthe rules were evaluated over the collected document; the whole run to a bundle was not made, so the bundle and consumer stages are unattemptedone directory, one moment: nothing here establishes how another tenant answers |
licensingPublished, tenant-verifiedLive validation state: partialwhat is assigned in one tenant, and whether the usage reports are permitted to name the people who hold itRun by m365g entra license listService licensing, through PowerShell | Reads Get-MgSubscribedSku Get-MgUser -Property assignedLicenses GET /v1.0/admin/reportSettings GET /v1.0/reports/getOffice365ActiveUserDetailPermissions Organization.Read.All User.Read.All Reports.Read.All ReportSettings.Read.All | Needs --tenant-urlFeeds no rule.Read by the licensing evidence in a report, and any viewer. | the usage report was read and names nobody: attribution is not available while this tenant conceals identifiable information, which is a tenant setting rather than a property of this readdependency is collected by nothing, so what a capability is required for is unknown rather than absentone user observed is a population of one and proves the path rather than the rangeno conclusion about removing or downgrading a licence follows from any of this, and none is publishedthe artefact digest is unrecoverable: the evidence was deleted when the vertical closed, which the rule against keeping tenant data required and the programme's rule about keeping what a proof names did not allow, and this record exists because of that loss |
activityPublished, tenant-verifiedLive validation state: fullwhen a person last changed something on one siteRun by m365g spo activity getService sharepoint, through PowerShell | Reads Get-PnPWeb Get-PnPTenantSitePermissions not-establishedNo least-privilege set has been proved for this read. It does not mean the read needs none. | Needs --site-url, --tenant-urlFeeds the rules SPO-ACTIVITY-001Read by governance rules. | The Engine's record lists nothing. |
brand-centerPublished, tenant-verifiedLive validation state: fullthe organisation asset libraries a brand centre is built on, and the boundary its assets are published acrossRun by m365g spo brandcenter getService sharepoint, through PowerShell | Reads Get-PnPOrgAssetsLibrary Get-PnPTenantCdnEnabled -CdnType Public|Private Get-PnPTenantCdnOrigin -CdnType Public|Private Get-PnPTenantCdnPolicies -CdnType PublicPermissions Sites.FullControl.All | Needs --tenant-urlFeeds no rule.Read by the brand distribution surface in a report, and any viewer. | no rule reads this evidence, so nothing about the tenant is concluded from itno representation check was madeone directory, one moment |
classificationPublished, tenant-verifiedLive validation state: fullwhat a site records about the kind of content it holdsRun by m365g spo classification getService sharepoint, through PowerShell | Reads Get-PnPWeb Get-PnPSitePermissions Sites.Read.All | Needs --site-urlFeeds the rules SPO-CLASS-001 SPO-CLASS-002 SPO-CLASS-003 SPO-CLASS-004Read by governance rules. | no pagination surface exists here |
customizationPublished, tenant-verifiedLive validation state: fullthe surfaces by which executable content or customization can reach a page on one siteRun by m365g spo customization getService sharepoint, through PowerShell | Reads Get-PnPWeb -Includes EffectiveBasePermissions Get-PnPFeature -Scope Web Get-PnPList -Identity SitePagesPermissions Sites.Read.All | Needs --site-urlFeeds the rules SPO-SCRIPT-001Read by governance rules. | one site, and the state it holds is custom script blocked: the branch that reports a site permitting custom script has not run against a directoryno representation check was made: the setting's effect was not read against the effectone directory, one moment: nothing here establishes how another tenant answers |
hubsPublished, tenant-verifiedLive validation state: fullthe sites registered as hubs, and how each is setRun by m365g spo hub listService sharepoint, through PowerShell | Reads Get-PnPHubSitePermissions not-establishedNo least-privilege set has been proved for this read. It does not mean the read needs none. | Needs --tenant-urlFeeds no rule.Read by the hub list an operator enumerates, and a report. | a tenant with no hub has not been read: the zero the tenant document exists to carry is proved by a fixture onlyneither hub has a parent hub and both restrict association, so the branches for a parent and for an unrestricted hub have not run against a directoryone listed hub was referenced by no enumerated site; whether it has no associated site or the delegated enumeration did not show one is not establishedone directory, one moment: nothing here establishes how another tenant answers |
modernityPublished, tenant-verifiedLive validation state: fullhow one site is built: template, branding, publishingRun by m365g spo modernity getService sharepoint, through PowerShell | Reads Get-PnPWeb Get-PnPList Get-PnPFeature Get-PnPPagePermissions Sites.Read.All | Needs --site-urlFeeds the rules SPO-MODERN-001 SPO-MODERN-003 SPO-MODERN-004Read by governance rules. | no pagination surface exists here |
ownersPublished, tenant-verifiedLive validation state: fullwho administers one siteRun by m365g spo owner listService sharepoint, through PowerShell | Reads Get-PnPWeb Get-PnPSiteCollectionAdminPermissions Sites.Read.All | Needs --site-urlFeeds the rules SPO-SITE-001 SPO-SITE-002Read by governance rules. | one document is a population of one, and proves the path rather than the range |
permissionsPublished, tenant-verifiedLive validation state: fullevery visible list on a site, and its inheritanceRun by m365g spo permission listService sharepoint, through PowerShell | Reads Get-PnPList Get-PnPListItemPermissions Sites.Read.All | Needs --site-urlFeeds the rules SPO-LIST-001 SPO-LIST-002 SPO-LIST-003Read by governance rules. | The Engine's record lists nothing. |
sharingPublished, tenant-verifiedLive validation state: fullwhat one site permits, and its default linkRun by m365g spo sharing getService sharepoint, through PowerShell | Reads Get-PnPWeb Get-PnPSite Get-PnPTenantSitePermissions not-establishedNo least-privilege set has been proved for this read. It does not mean the read needs none. | Needs --site-url, --tenant-urlFeeds the rules SPO-SHARE-001 SPO-SHARE-002 SPO-SHARE-005Read by governance rules. | The Engine's record lists nothing. |
sitesPublished, tenant-verifiedLive validation state: fullevery site this identity can enumerateRun by m365g spo site listService sharepoint, through PowerShell | Reads Get-PnPTenantSitePermissions not-establishedNo least-privilege set has been proved for this read. It does not mean the read needs none. | Needs --tenant-urlFeeds the rules SPO-SITE-003Read by governance rules. | no pagination was exercised: the population was 11 itemsthe rule's deciding branches did not run: no enumerated site has a storage limit set, so neither a pass nor a fail was reached against a directorya delegated enumeration: it establishes what this identity was shown and never what the tenant containsone directory, one moment: nothing here establishes how another tenant answers |
sites-guestsPublished, tenant-verifiedLive validation state: fullwhich guest accounts each enumerated site has met, by object id and never by nameRun by m365g spo site guestsService sharepoint, through PowerShell | Reads Get-PnPTenantSite Get-PnPUserPermissions not-establishedNo least-privilege set has been proved for this read. It does not mean the read needs none. | Needs --tenant-urlFeeds no rule.Read by the list of guests per site an operator enumerates, and the external access inspection. | the two sides of the comparison did not overlap in this directory, so a guest both listed and met has not been observed against a directory: that branch is proved by a test onlywhat an account is that a site has met and the directory does not list as a guest was not readthe sites that refused were recorded under the earlier classification in that run; the corrected one is proved by a test over the same messagesbeing in a site's list of users is not having access, and nothing here reads accessone directory, one moment: nothing here establishes how another tenant answers |
sites-ownersPublished, tenant-verifiedLive validation state: fullwho administers every enumerated site, read site by siteRun by m365g spo site adminsService sharepoint, through PowerShell | Reads Get-PnPTenantSite Get-PnPSiteCollectionAdminPermissions not-establishedNo least-privilege set has been proved for this read. It does not mean the read needs none. | Needs --tenant-urlFeeds the rules SPO-SITE-001 SPO-SITE-002Read by governance rules. | no group was expanded: a site administered by a group has an unknown number of administratorsthe ownership rules were not evaluated over this collection in this run, so the assessment stage is unattempted herethrottling was not met at this sizeone directory, one moment: nothing here establishes how another tenant answers |
sites-sharingPublished, tenant-verifiedLive validation state: fullwhat every enumerated site permits, read site by siteRun by m365g spo sharing listService sharepoint, through PowerShell | Reads Get-PnPTenantSite Get-PnPTenantSite -IdentityPermissions not-establishedNo least-privilege set has been proved for this read. It does not mean the read needs none. | Needs --tenant-urlFeeds the rules SPO-SHARE-001 SPO-SHARE-002 SPO-SHARE-005Read by governance rules. | no site refused its own read, so the document a refusal writes is proved by a fixture onlythrottling was not met at this size; behaviour under it has not been observedthe sharing rules were not evaluated over this collection in this run, so the assessment stage is unattempted hereone directory, one moment: nothing here establishes how another tenant answers |
spfxPublished, tenant-verifiedLive validation state: partiala site's app catalog: which solutions lag their versionRun by m365g spo spfx listService sharepoint, through PowerShell | Reads Get-PnPAppPermissions Sites.Read.All | Needs --site-urlFeeds the rules SPO-SPFX-001Read by governance rules. | the branch that reports a component has never run against a directorythe rule did not decide: a comparison of installed and available versions needs a site catalog, which this run did not readthe branch that reports a solution behind its catalog version has not run against a directoryone directory, one moment: nothing here establishes how another tenant answers |
tenant-sharingPublished, tenant-verifiedLive validation state: fullwhat the organisation permits, which every site inherits by defaultRun by m365g spo tenant sharing getService sharepoint, through PowerShell | Reads Get-PnPTenantPermissions not-establishedNo least-privilege set has been proved for this read. It does not mean the read needs none. | Needs --tenant-urlFeeds the rules SPO-SHARE-003 SPO-SHARE-004Read by governance rules. | no representation check was made: no setting's claimed effect was read against the effecta tenant default is not a statement about any site's own sharingone directory, one moment |