How to read the table
- Service and kind. The service is the group a command is typed under. An
enumerationlists what the identity can see, areadreads one target, ascenariorelates evidence already collected, and acommandworks on evidence, rules or the installation. - Reads. The calls the collector makes, as the Engine records them.
- Permissions. The permissions recorded for the read.
not-establishedis printed as that word: no least-privilege set has been proved for the read, which is not the same as needing none. - Feeds the rules. The rules that evaluate what the read collects. A read that feeds no rule says who reads it instead.
- Live validation state. How far the Engine records the read as proved against a tenant:
full,partialornone. It is the Engine's own value and is shown as it is. - Earlier name. The command this one is another name for. Both take the same options and behave the same.
- State. Every command here is in the published release. The state says how far it is proved: whether a real tenant has answered it or only a stand-in has. It is read from the Engine's own record for each row and is explained above the table.
The rows of kind command carry a name and an earlier name and nothing else: the Engine's reference describes enumerations, reads and scenarios in full and names the rest. The earlier commands are documented in the manual, and each row links the page it corresponds to.
The reference is a copy of the file the Engine derives from its own contracts. It is not retyped here.
What the status says
Every command below is in the published release, 1.0.0b10, which installs
m365g and m365-governance. Being published is not being proved: the label says how far a real tenant has answered each one, and the states are kept apart.Published, tenant-verified The Engine records a read of a real tenant for it; the row prints how far, in the Engine's own word. 28 of the 59 commands.Published, contract-tested only It is proved against a stand-in for the service and has never read a tenant: tenant verification is pending. A scenario is in this state when no collection it reads has been read from a tenant. 0 of the 59 commands.Published, part contract-tested only A scenario, which reaches no tenant itself. Some of the collections it reads are tenant-verified and at least one is contract-tested only; the row says which. 0 of the 59 commands.Published The Engine's reference records no validation state for the command, so the page claims none beyond its being published. 31 of the 59 commands.Planned, not implemented Prepared and not built. These are listed apart, under the reference, and are not commands.Every command
59 commands, from the Engine's reference at the published commit 0c269e9d29d0.| Command and status | Service and kind | Reads and permissions | Output and rules |
|---|---|---|---|
m365g connectPublishedNo validation state is recorded for it.In the manual as m365-governance connectreach a tenant and say what was established. Collects nothing | sessioncommandsigns in, or works on a kept sign-in | Not recorded in the reference | Not recorded in the reference |
m365g connection listPublishedNo validation state is recorded for it.New in 1.0.0b10: the manual has no page for an earlier formevery stored connection. Reaches no tenant | sessioncommandsigns in, or works on a kept sign-in | Not recorded in the reference | Not recorded in the reference |
m365g connection removePublishedNo validation state is recorded for it.New in 1.0.0b10: the manual has no page for an earlier formremove a stored session and its record, as `logout --name` | sessioncommandsigns in, or works on a kept sign-in | Not recorded in the reference | Not recorded in the reference |
m365g connection usePublishedNo validation state is recorded for it.New in 1.0.0b10: the manual has no page for an earlier formmake a stored connection the active one. Reaches no tenant | sessioncommandsigns in, or works on a kept sign-in | Not recorded in the reference | Not recorded in the reference |
m365g loginPublishedNo validation state is recorded for it.New in 1.0.0b10: the manual has no page for an earlier formsign in and keep the session for later commands. The only command that keeps one | sessioncommandsigns in, or works on a kept sign-in | Not recorded in the reference | Not recorded in the reference |
m365g logoutPublishedNo validation state is recorded for it.New in 1.0.0b10: the manual has no page for an earlier formremove a stored session and its record | sessioncommandsigns in, or works on a kept sign-in | Not recorded in the reference | Not recorded in the reference |
m365g statusPublishedNo validation state is recorded for it.New in 1.0.0b10: the manual has no page for an earlier formwhich connection later commands will use. Reaches no tenant | sessioncommandsigns in, or works on a kept sign-in | Not recorded in the reference | Not recorded in the reference |
m365g spo activity getPublished, tenant-verifiedIn the manual as m365-governance collect activitywhen a person last changed something on one siteEarlier name: m365g collect activity m365g spo activity get --site-url <address> --tenant-url <address> m365g spo activity get --output csv m365g spo activity get --evidence-out ./evidence | SharePoint Onlinereadreads one target | Reads Get-PnPWeb Get-PnPTenantSitePermissions not-establishedNo least-privilege set has been proved for this read. It does not mean the read needs none.Needs --site-url, --tenant-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds the rules SPO-ACTIVITY-001Live validation state: full |
m365g spo agent listPublished, tenant-verifiedIn the manual as m365-governance collect agentsthe Copilot agents in one site, and the sources each declaresEarlier name: m365g collect agents m365g spo agent list --site-url <address> m365g spo agent list --output csv m365g spo agent list --evidence-out ./evidence | SharePoint Onlinereadreads one target | Reads Get-PnPWeb Get-PnPCopilotAgentPermissions Sites.Read.AllNeeds --site-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds no rule. Read by the agent inventory in a report, and any viewer.Live validation state: full |
m365g spo brandcenter getPublished, tenant-verifiedIn the manual as m365-governance collect brand-centerthe organisation asset libraries a brand centre is built on, and the boundary its assets are published acrossEarlier name: m365g collect brand-center m365g spo brandcenter get --tenant-url <address> m365g spo brandcenter get --output csv m365g spo brandcenter get --evidence-out ./evidence | SharePoint Onlinereadreads one target | Reads Get-PnPOrgAssetsLibrary Get-PnPTenantCdnEnabled -CdnType Public|Private Get-PnPTenantCdnOrigin -CdnType Public|Private Get-PnPTenantCdnPolicies -CdnType PublicPermissions Sites.FullControl.AllNeeds --tenant-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds no rule. Read by the brand distribution surface in a report, and any viewer.Live validation state: full |
m365g spo classification getPublished, tenant-verifiedIn the manual as m365-governance collect classificationwhat a site records about the kind of content it holdsEarlier name: m365g collect classification m365g spo classification get --site-url <address> m365g spo classification get --output csv m365g spo classification get --evidence-out ./evidence | SharePoint Onlinereadreads one target | Reads Get-PnPWeb Get-PnPSitePermissions Sites.Read.AllNeeds --site-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds the rules SPO-CLASS-001 SPO-CLASS-002 SPO-CLASS-003 SPO-CLASS-004Live validation state: full |
m365g spo customization getPublished, tenant-verifiedIn the manual as m365-governance collect customizationthe surfaces by which executable content or customization can reach a page on one siteEarlier name: m365g collect customization m365g spo customization get --site-url <address> m365g spo customization get --output csv m365g spo customization get --evidence-out ./evidence | SharePoint Onlinereadreads one target | Reads Get-PnPWeb -Includes EffectiveBasePermissions Get-PnPFeature -Scope Web Get-PnPList -Identity SitePagesPermissions Sites.Read.AllNeeds --site-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds the rules SPO-SCRIPT-001Live validation state: full |
m365g spo hub listPublished, tenant-verifiedIn the manual as m365-governance collect hubsthe sites registered as hubs, and how each is setEarlier name: m365g collect hubs m365g spo hub list --tenant-url <address> m365g spo hub list --output csv m365g spo hub list --evidence-out ./evidence | SharePoint Onlineenumerationlists what the identity can see | Reads Get-PnPHubSitePermissions not-establishedNo least-privilege set has been proved for this read. It does not mean the read needs none.Needs --tenant-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds no rule. Read by the hub list an operator enumerates, and a report.Live validation state: full |
m365g spo modernity getPublished, tenant-verifiedIn the manual as m365-governance collect modernityhow one site is built: template, branding, publishingEarlier name: m365g collect modernity m365g spo modernity get --site-url <address> m365g spo modernity get --output csv m365g spo modernity get --evidence-out ./evidence | SharePoint Onlinereadreads one target | Reads Get-PnPWeb Get-PnPList Get-PnPFeature Get-PnPPagePermissions Sites.Read.AllNeeds --site-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds the rules SPO-MODERN-001 SPO-MODERN-003 SPO-MODERN-004Live validation state: full |
m365g spo owner listPublished, tenant-verifiedIn the manual as m365-governance collect ownerswho administers one siteEarlier name: m365g collect owners m365g spo owner list --site-url <address> m365g spo owner list --output csv m365g spo owner list --evidence-out ./evidence | SharePoint Onlinereadreads one target | Reads Get-PnPWeb Get-PnPSiteCollectionAdminPermissions Sites.Read.AllNeeds --site-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds the rules SPO-SITE-001 SPO-SITE-002Live validation state: full |
m365g spo permission listPublished, tenant-verifiedIn the manual as m365-governance collect permissionsevery visible list on a site, and its inheritanceEarlier name: m365g collect permissions m365g spo permission list --site-url <address> m365g spo permission list --output csv m365g spo permission list --evidence-out ./evidence | SharePoint Onlineenumerationlists what the identity can see | Reads Get-PnPList Get-PnPListItemPermissions Sites.Read.AllNeeds --site-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds the rules SPO-LIST-001 SPO-LIST-002 SPO-LIST-003Live validation state: full |
m365g spo sharing getPublished, tenant-verifiedIn the manual as m365-governance collect sharingwhat one site permits, and its default linkEarlier name: m365g collect sharing m365g spo sharing get --site-url <address> --tenant-url <address> m365g spo sharing get --output csv m365g spo sharing get --evidence-out ./evidence | SharePoint Onlinereadreads one target | Reads Get-PnPWeb Get-PnPSite Get-PnPTenantSitePermissions not-establishedNo least-privilege set has been proved for this read. It does not mean the read needs none.Needs --site-url, --tenant-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds the rules SPO-SHARE-001 SPO-SHARE-002 SPO-SHARE-005Live validation state: full |
m365g spo sharing listPublished, tenant-verifiedIn the manual as m365-governance collect sites-sharingwhat every enumerated site permits, read site by siteEarlier name: m365g collect sites-sharing m365g spo sharing list --tenant-url <address> m365g spo sharing list --output csv m365g spo sharing list --evidence-out ./evidence | SharePoint Onlineenumerationlists what the identity can see | Reads Get-PnPTenantSite Get-PnPTenantSite -IdentityPermissions not-establishedNo least-privilege set has been proved for this read. It does not mean the read needs none.Needs --tenant-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds the rules SPO-SHARE-001 SPO-SHARE-002 SPO-SHARE-005Live validation state: full |
m365g spo site adminsPublished, tenant-verifiedIn the manual as m365-governance collect sites-ownerswho administers every enumerated site, read site by siteEarlier name: m365g collect sites-owners m365g spo site admins --tenant-url <address> m365g spo site admins --output csv m365g spo site admins --evidence-out ./evidence | SharePoint Onlineenumerationlists what the identity can see | Reads Get-PnPTenantSite Get-PnPSiteCollectionAdminPermissions not-establishedNo least-privilege set has been proved for this read. It does not mean the read needs none.Needs --tenant-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds the rules SPO-SITE-001 SPO-SITE-002Live validation state: full |
m365g spo site guestsPublished, tenant-verifiedIn the manual as m365-governance collect sites-guestswhich guest accounts each enumerated site has met, by object id and never by nameEarlier name: m365g collect sites-guests m365g spo site guests --tenant-url <address> m365g spo site guests --output csv m365g spo site guests --evidence-out ./evidence | SharePoint Onlineenumerationlists what the identity can see | Reads Get-PnPTenantSite Get-PnPUserPermissions not-establishedNo least-privilege set has been proved for this read. It does not mean the read needs none.Needs --tenant-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds no rule. Read by the list of guests per site an operator enumerates, and the external access inspection.Live validation state: full |
m365g spo site listPublished, tenant-verifiedIn the manual as m365-governance collect sitesevery site this identity can enumerateEarlier name: m365g collect sites m365g spo site list --tenant-url <address> m365g spo site list --output csv m365g spo site list --evidence-out ./evidence | SharePoint Onlineenumerationlists what the identity can see | Reads Get-PnPTenantSitePermissions not-establishedNo least-privilege set has been proved for this read. It does not mean the read needs none.Needs --tenant-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds the rules SPO-SITE-003Live validation state: full |
m365g spo spfx listPublished, tenant-verifiedThe Engine records that tenant read as partial, not as full.In the manual as m365-governance collect spfxa site's app catalog: which solutions lag their versionEarlier name: m365g collect spfx m365g spo spfx list --site-url <address> m365g spo spfx list --output csv m365g spo spfx list --evidence-out ./evidence | SharePoint Onlinereadreads one target | Reads Get-PnPAppPermissions Sites.Read.AllNeeds --site-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds the rules SPO-SPFX-001Live validation state: partial |
m365g spo tenant sharing getPublished, tenant-verifiedIn the manual as m365-governance collect tenant-sharingwhat the organisation permits, which every site inherits by defaultEarlier name: m365g collect tenant-sharing m365g spo tenant sharing get --tenant-url <address> m365g spo tenant sharing get --output csv m365g spo tenant sharing get --evidence-out ./evidence | SharePoint Onlinereadreads one target | Reads Get-PnPTenantPermissions not-establishedNo least-privilege set has been proved for this read. It does not mean the read needs none.Needs --tenant-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds the rules SPO-SHARE-003 SPO-SHARE-004Live validation state: full |
m365g entra app listPublished, tenant-verifiedIn the manual as m365-governance collect applicationsthe application registrations in the directory, when each credential ends, and what each asks forEarlier name: m365g collect applications m365g entra app list --tenant-url <address> m365g entra app list --output csv m365g entra app list --evidence-out ./evidence | Microsoft Entraenumerationlists what the identity can see | Reads GET /v1.0/applications ($select of eight properties; a credential's hint and a certificate's bytes are never kept)Permissions Application.Read.AllNeeds --tenant-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds no rule. Read by the application list an operator enumerates, and the application exposure inspection.Live validation state: full |
m365g entra ca listPublished, tenant-verifiedIn the manual as m365-governance collect conditional-accessthe Conditional Access policies, named locations and Security Defaults state of one tenantEarlier name: m365g collect conditional-access m365g entra ca list --tenant-url <address> m365g entra ca list --output csv m365g entra ca list --evidence-out ./evidence | Microsoft Entraenumerationlists what the identity can see | Reads GET /v1.0/identity/conditionalAccess/policies GET /v1.0/identity/conditionalAccess/namedLocations GET /v1.0/policies/identitySecurityDefaultsEnforcementPolicyPermissions Policy.Read.AllNeeds --tenant-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds the rules CA-RECOVERY-001 CA-SCOPE-001 CA-STATE-001Live validation state: full |
m365g entra group listPublished, tenant-verifiedIn the manual as m365-governance collect groupsthe Microsoft 365 groups in the directory, and how many owners and members each has, by kind and never by nameEarlier name: m365g collect groups m365g entra group list --tenant-url <address> m365g entra group list --output csv m365g entra group list --evidence-out ./evidence | Microsoft Entraenumerationlists what the identity can see | Reads GET /v1.0/groups ($filter to Microsoft 365 groups)
GET /v1.0/groups/{id}/owners ($select=id)
GET /v1.0/groups/{id}/members ($select=id)PermissionsGroupMember.Read.AllNeeds --tenant-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds no rule. Read by the group list an operator enumerates, and the ownership inspection.Live validation state: full |
m365g entra guest listPublished, tenant-verifiedIn the manual as m365-governance collect gueststhe guest accounts in the directory, by object id and never by nameEarlier name: m365g collect guests m365g entra guest list --tenant-url <address> m365g entra guest list --output csv m365g entra guest list --evidence-out ./evidence | Microsoft Entraenumerationlists what the identity can see | Reads GET /v1.0/users?$filter=userType eq 'Guest' ($select of six properties, none of which names a person)Permissions User.Read.AllNeeds --tenant-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds no rule. Read by the guest list an operator enumerates, and the external access inspection.Live validation state: full |
m365g entra license listPublished, tenant-verifiedThe Engine records that tenant read as partial, not as full.In the manual as m365-governance collect licensingwhat is assigned in one tenant, and whether the usage reports are permitted to name the people who hold itEarlier name: m365g collect licensing m365g entra license list --tenant-url <address> m365g entra license list --output csv m365g entra license list --evidence-out ./evidence | Microsoft Entrareadreads one target | Reads Get-MgSubscribedSku Get-MgUser -Property assignedLicenses GET /v1.0/admin/reportSettings GET /v1.0/reports/getOffice365ActiveUserDetailPermissions Organization.Read.All User.Read.All Reports.Read.All ReportSettings.Read.AllNeeds --tenant-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds no rule. Read by the licensing evidence in a report, and any viewer.Live validation state: partial |
m365g entra serviceprincipal listPublished, tenant-verifiedIn the manual as m365-governance collect service-principalsthe service principals in the directory: whether each is enabled, whose application it is, and when its own credentials endEarlier name: m365g collect service-principals m365g entra serviceprincipal list --tenant-url <address> m365g entra serviceprincipal list --output csv m365g entra serviceprincipal list --evidence-out ./evidence | Microsoft Entraenumerationlists what the identity can see | Reads GET /v1.0/servicePrincipals ($select of eight properties; a credential's hint and a certificate's bytes are never kept)Permissions Application.Read.AllNeeds --tenant-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds no rule. Read by the service principal list an operator enumerates, and the application exposure inspection.Live validation state: full |
m365g entra tenant governance getPublished, tenant-verifiedIn the manual as m365-governance collect tenant-governancewhat every user in a tenant may do without asking, and how many accounts hold the role that may do anythingEarlier name: m365g collect tenant-governance m365g entra tenant governance get --tenant-url <address> m365g entra tenant governance get --output csv m365g entra tenant governance get --evidence-out ./evidence | Microsoft Entraenumerationlists what the identity can see | Reads GET /v1.0/policies/authorizationPolicy
GET /v1.0/policies/authenticationMethodsPolicy (the method configurations are expanded by the service, so this is one read and not one per method)
GET /v1.0/roleManagement/directory/roleAssignments ($filter on the Global Administrator template, $select only)
GET /v1.0/users/{id}?$select=id,onPremisesSyncEnabled (once per principal, so that no display name is ever received)PermissionsPolicy.Read.All RoleManagement.Read.Directory Policy.Read.AuthenticationMethodNeeds --tenant-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds the rules ENTRA-AUTH-001 ENTRA-AUTH-002 ENTRA-AUTH-003 ENTRA-AUTH-004 ENTRA-AUTH-005 ENTRA-AUTH-006 ENTRA-GUEST-001 ENTRA-METHOD-001 ENTRA-METHOD-002 ENTRA-METHOD-003 ENTRA-ROLE-001 ENTRA-ROLE-002 ENTRA-ROLE-003Live validation state: full |
m365g teams team listPublishedNo validation state is recorded for it.In the manual as m365-governance collect groups --where group.is_team=trueThe reference names this command and records no description of it.Earlier name: m365g collect groups --where group.is_team=true | Microsoft Teamscommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
m365g exo forwarding getPublished, tenant-verifiedIn the manual as m365-governance collect forwardingwhether mail can leave this organisation automatically, and which of the three controls that govern it are in which positionEarlier name: m365g collect forwarding m365g exo forwarding get --tenant-url <address> m365g exo forwarding get --output csv m365g exo forwarding get --evidence-out ./evidence | Exchange Onlinereadreads one target | Reads Get-HostedOutboundSpamFilterPolicy Get-RemoteDomainPermissions Exchange.ManageAsAppNeeds --tenant-url | Output text, json, csv, md--evidence-out DIRECTORY keeps the evidence behind the viewFeeds the rules EXO-FORWARD-001 EXO-FORWARD-002Live validation state: full |
m365g evidence collectPublishedNo validation state is recorded for it.In the manual as m365-governance collectThe reference names this command and records no description of it.Earlier name: m365g collect | evidencecommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
m365g evidence evaluatePublishedNo validation state is recorded for it.In the manual as m365-governance evaluateThe reference names this command and records no description of it.Earlier name: m365g evaluate | evidencecommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
m365g evidence statsPublishedNo validation state is recorded for it.In the manual as m365-governance statsThe reference names this command and records no description of it.Earlier name: m365g stats | evidencecommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
m365g governance assessPublishedNo validation state is recorded for it.In the manual as m365-governance assessThe reference names this command and records no description of it.Earlier name: m365g assess | governancecommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
m365g governance diffPublishedNo validation state is recorded for it.In the manual as m365-governance diffThe reference names this command and records no description of it.Earlier name: m365g diff | governancecommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
m365g governance inspect app-exposurePublished, tenant-verifiedapplications: tenant-verified, collected by m365g entra app listservice-principals: tenant-verified, collected by m365g entra serviceprincipal listNew in 1.0.0b10: the manual has no page for an earlier formwhich applications hold a credential that has ended or is about toEarlier name: m365g inspect app-exposure m365g governance inspect app-exposure --evidence ./evidence m365g governance inspect app-exposure --evidence ./evidence --output csv m365g governance inspect app-exposure --evidence ./evidence --out app-exposure.json | governancescenariorelates evidence already collected | Reads the collections applications service-principalsReaches a tenant: noNeeds --evidenceOptions --expires-within | Output text, json, csv, md--out FILE keeps the inspection with the digest of the evidence it read |
m365g governance inspect ca-coveragePublished, tenant-verifiedconditional-access: tenant-verified, collected by m365g entra ca listNew in 1.0.0b10: the manual has no page for an earlier formwhom each Conditional Access policy names, leaves out, and whether it is enforcedEarlier name: m365g inspect ca-coverage m365g governance inspect ca-coverage --evidence ./evidence m365g governance inspect ca-coverage --evidence ./evidence --output csv m365g governance inspect ca-coverage --evidence ./evidence --out ca-coverage.json | governancescenariorelates evidence already collected | Reads the collections conditional-accessReaches a tenant: noNeeds --evidenceOptions --policy-id | Output text, json, csv, md--out FILE keeps the inspection with the digest of the evidence it read |
m365g governance inspect external-accessPublished, tenant-verifiedsites-sharing: tenant-verified, collected by m365g spo sharing listtenant-sharing: tenant-verified, collected by m365g spo tenant sharing getguests: tenant-verified, collected by m365g entra guest listsites-guests: tenant-verified, collected by m365g spo site guestsNew in 1.0.0b10: the manual has no page for an earlier formwhich SharePoint sites permit sharing outside the organisationEarlier name: m365g inspect external-access m365g governance inspect external-access --evidence ./evidence m365g governance inspect external-access --evidence ./evidence --output csv m365g governance inspect external-access --evidence ./evidence --out external-access.json | governancescenariorelates evidence already collected | Reads the collections sites-sharing tenant-sharing guests sites-guestsReaches a tenant: noNeeds --evidence | Output text, json, csv, md--out FILE keeps the inspection with the digest of the evidence it read |
m365g governance inspect ownershipPublished, tenant-verifiedsites-owners: tenant-verified, collected by m365g spo site adminssites: tenant-verified, collected by m365g spo site listgroups: tenant-verified, collected by m365g entra group listNew in 1.0.0b10: the manual has no page for an earlier formwhich SharePoint sites name enough administrators, and which cannot sayEarlier name: m365g inspect ownership m365g governance inspect ownership --evidence ./evidence m365g governance inspect ownership --evidence ./evidence --output csv m365g governance inspect ownership --evidence ./evidence --out ownership.json | governancescenariorelates evidence already collected | Reads the collections sites-owners sites groupsReaches a tenant: noNeeds --evidenceOptions --minimum-owners | Output text, json, csv, md--out FILE keeps the inspection with the digest of the evidence it read |
m365g governance inspect-diffPublishedNo validation state is recorded for it.New in 1.0.0b10: the manual has no page for an earlier formThe reference names this command and records no description of it.Earlier name: m365g inspect-diff | governancecommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
m365g governance reportPublishedNo validation state is recorded for it.In the manual as m365-governance reportThe reference names this command and records no description of it.Earlier name: m365g report | governancecommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
m365g governance runPublishedNo validation state is recorded for it.In the manual as m365-governance runThe reference names this command and records no description of it.Earlier name: m365g run | governancecommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
m365g governance verifyPublishedNo validation state is recorded for it.In the manual as m365-governance verifyThe reference names this command and records no description of it.Earlier name: m365g verify | governancecommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
m365g rule explainPublishedNo validation state is recorded for it.In the manual as m365-governance explainThe reference names this command and records no description of it.Earlier name: m365g explain | rulecommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
m365g rule getPublishedNo validation state is recorded for it.In the manual as m365-governance show-ruleThe reference names this command and records no description of it.Earlier name: m365g show-rule | rulecommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
m365g rule listPublishedNo validation state is recorded for it.In the manual as m365-governance list-rulesThe reference names this command and records no description of it.Earlier name: m365g list-rules | rulecommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
m365g rule showPublishedNo validation state is recorded for it.In the manual as m365-governance show-ruleThe reference names this command and records no description of it.Earlier name: m365g show-rule | rulecommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
m365g rule validatePublishedNo validation state is recorded for it.In the manual as m365-governance validateThe reference names this command and records no description of it.Earlier name: m365g validate | rulecommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
m365g migration readPublishedNo validation state is recorded for it.In the manual as m365-governance migration-readThe reference names this command and records no description of it.Earlier name: m365g migration-read | migrationcommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
m365g migration verifyPublishedNo validation state is recorded for it.In the manual as m365-governance migration-verifyThe reference names this command and records no description of it.Earlier name: m365g migration-verify | migrationcommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
m365g collector describePublishedNo validation state is recorded for it.New in 1.0.0b10: the manual has no page for an earlier formone collector: what it reads, what it needs, what was proved | enginecommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
m365g collector listPublishedNo validation state is recorded for it.New in 1.0.0b10: the manual has no page for an earlier formevery collector, with its command, service and state | enginecommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
m365g collector testPublishedNo validation state is recorded for it.New in 1.0.0b10: the manual has no page for an earlier formwhat a collector would read, without reading it (a dry run) | enginecommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
m365g engine capabilitiesPublishedNo validation state is recorded for it.In the manual as m365-governance capabilitiesThe reference names this command and records no description of it.Earlier name: m365g capabilities | enginecommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
m365g engine contractsPublishedNo validation state is recorded for it.In the manual as m365-governance contractsThe reference names this command and records no description of it.Earlier name: m365g contracts | enginecommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
m365g engine doctorPublishedNo validation state is recorded for it.In the manual as m365-governance doctorThe reference names this command and records no description of it.Earlier name: m365g doctor | enginecommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
m365g engine setupPublishedNo validation state is recorded for it.In the manual as m365-governance setupThe reference names this command and records no description of it.Earlier name: m365g setup | enginecommandworks on evidence, rules or this installation | Not recorded in the reference | Not recorded in the reference |
Planned, and not commands
Reads the Engine has prepared the permissions for and has not built, from its docs/ENTRA-COLLECTOR-PERMISSIONS.md. Nothing here can be run, and no permission in this table has been requested or granted.| What | Operation | Least privileged scope, as documented | Status |
|---|---|---|---|
| Delegated grants | GET /oauth2PermissionGrants | Directory.Read.All | Planned, not implemented |