Evidence and provenance

The options on this page

All four arrived in 1.0.0b10. collect --output DIRECTORY, the form earlier releases had, still writes a collection's evidence to that directory and prints its report.

A view is not the evidence

m365g spo sharing list reads, and prints what it read. What it prints is a view: a rendering of the evidence documents the collection wrote, which adds nothing to them. The documents are the product. They carry the provenance (who collected, when, by which path, as which kind of identity), the coverage (what was asked for, what completed, what was unavailable and why) and the schema. Rules evaluate the documents, never a view.

Without --evidence-out the documents are not kept, and the command says so on every run, on stderr:

evidence NOT kept: this is a view. --evidence-out DIRECTORY keeps what was read, with its provenance.

With it, the documents are written to the directory and the same view is printed:

m365g spo sharing list --tenant-url https://contoso-admin.sharepoint.com --evidence-out ./evidence/sharing

evidence kept in evidence/sharing: the documents this view was made from.

Only the view is on stdout. The collection's own report, its progress and these notes go to stderr, so --output json can be piped.

Four views of the same documents

--output chooses how the result is shown: text, json, csv or md.

• json is the evidence documents themselves, untouched. It is the one view that carries everything.
• text is one block per resource, one line per fact.
• csv and md are one row per resource.

One column per fact, named family.fact

Collectors group facts in families. A view shows one line or one column per fact, named family.fact, which is the path a rule uses for the same fact. The CSV and Markdown views open with eight stable columns and continue with the facts, sorted by name:

resource_type,name,url,native_id,tenant,collected_at,completed,unavailable,sharing.capability,sharing.default_link_permission,sharing.default_link_type,sharing.effective_default_link_type
site,Board Papers,https://contoso.sharepoint.com/sites/board-papers,https://contoso.sharepoint.com/sites/board-papers,contoso.sharepoint.com,2026-11-10T09:21:40Z,,"enumeration, sharing",[permission-denied],,,
site,Finance Close,https://contoso.sharepoint.com/sites/finance-close,https://contoso.sharepoint.com/sites/finance-close,contoso.sharepoint.com,2026-11-10T09:21:40Z,sharing,enumeration,Disabled,View,Internal,Internal
site,Project Falcon,https://contoso.sharepoint.com/sites/project-falcon,https://contoso.sharepoint.com/sites/project-falcon,contoso.sharepoint.com,2026-11-10T09:21:40Z,sharing,enumeration,ExternalUserAndGuestSharing,Edit,None,Direct
site,Supplier Portal,https://contoso.sharepoint.com/sites/supplier-portal,https://contoso.sharepoint.com/sites/supplier-portal,contoso.sharepoint.com,2026-11-10T09:21:40Z,sharing,enumeration,ExternalUserSharingOnly,View,Direct,Direct

An observed value, or a state in brackets

A cell holds one of two things.

• An observed fact is shown as what was observed: Disabled, View, true.
• Any other state is shown as the state itself, in square brackets, with no value beside it: [permission-denied], [missing], [not-supported], [not-collected].

That is the one translation a view makes, and it is declared here so it can be undone: the word in brackets is the collector's own state, unchanged, and the contract value behind every cell is in the JSON view. A cell in brackets can never be mistaken for a value that was observed. In the first row of the CSV above, past the eight leading columns, sharing.capability is [permission-denied] and the three cells after it are empty, because the document holds no such facts for that site.

The text view prints the collector's detail beside a state that is not observed:

https://contoso-admin.sharepoint.com
  tenant · contoso.sharepoint.com
  tenant_sharing.capability                ExternalUserSharingOnly
  tenant_sharing.default_link_type         Direct
  tenant_sharing.file_anonymous_link_type  [missing] FileAnonymousLinkType was not returned for this tenant.

Coverage: completed and unavailable

Every document says what was asked for, what completed and what did not. In the views those are the completed and unavailable columns, and in the text view an unavailable area is a line of its own:

Board Papers  https://contoso.sharepoint.com/sites/board-papers
  site · https://contoso.sharepoint.com/sites/board-papers
  sharing.capability  [permission-denied] Access denied. You do not have permission to perform this action or access this resource.
  enumeration         UNAVAILABLE: Enumerated 4 sites with a delegated identity. Sites this identity cannot see are absent from this run, and their number is not knowable from here.
  sharing             UNAVAILABLE: Access denied. You do not have permission to perform this action or access this resource.

Two different things are unavailable in that block, and they are not the same kind of statement. sharing was refused for this site. enumeration is about the population the site came from.

What partial enumeration means

An enumeration lists what the collecting identity can see. For a delegated identity that is not the tenant, and every document the enumeration writes says so in its coverage:

enumeration  UNAVAILABLE: Enumerated 4 sites with a delegated identity. Sites this identity cannot see are absent from this run, and their number is not knowable from here.

The state behind that line is partial. It does not mean the listed sites were read in part: each listed site has its own completed and unavailable. It means the list itself has no established end. A site the identity cannot see is not in the evidence, is not counted anywhere, and is not reported as missing, because nothing in the evidence knows it exists. The same note is written when an application identity enumerates, with the kind of identity named.

Narrowing and ordering a view

--where COLUMN=VALUE shows the resources whose column prints that value, and --sort COLUMN orders them. Both take the column names of the table views, the ones named family.fact. --where can be given more than once, and a resource is shown only when every condition holds.

A filter chooses what is shown, and never what is read or kept. Every resource is read whatever the filter says, and --evidence-out keeps every document. The command says how many it left out, on the error stream.

m365g spo sharing list --where sharing.capability=disabled --tenant-url https://contoso-admin.sharepoint.com --evidence-out ./evidence/sharing

Finance Close  https://contoso.sharepoint.com/sites/finance-close
  site · https://contoso.sharepoint.com/sites/finance-close
  sharing.capability                   Disabled
  sharing.default_link_permission      View
  sharing.default_link_type            Internal
  sharing.effective_default_link_type  Internal
  enumeration                          UNAVAILABLE: Enumerated 4 sites with a delegated identity. Sites this identity cannot see are absent from this run, and their number is not knowable from here.

1 of 4 resources shown. The filter chose what is shown: every resource was read, and the evidence kept holds all of them.

The comparison is with what the view prints in that column, without regard to case: disabled finds Disabled.

A refusal is found by its state, in brackets. A state is printed in square brackets so that a filter for a value can never match something that was not observed. Board Papers refused its read. Asking for a value does not find it, and neither does --where site_guests.guests=permission-denied without the brackets, which shows 0 of 4. Asking for the state does:

m365g spo site guests --where "site_guests.guests=[permission-denied]" --tenant-url https://contoso-admin.sharepoint.com

Board Papers  https://contoso.sharepoint.com/sites/board-papers
  site · https://contoso.sharepoint.com/sites/board-papers
  site_guests.guests  [permission-denied] Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
  enumeration         UNAVAILABLE: Enumerated 4 sites with a delegated identity. Sites this identity cannot see are absent from this run, and their number is not knowable from here.
  site_guests         UNAVAILABLE: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

A column nobody has is refused. A mistyped name would otherwise answer that nothing matched. The command stops with exit code 2 and refusing to filter:, followed by the columns the view does have. For --where sharing.capabilty=Disabled:

no column is called `sharing.capabilty`. The columns of this view are: collected_at, completed, name, native_id, resource_type, sharing.capability, sharing.default_link_permission, sharing.default_link_type, sharing.effective_default_link_type, tenant, unavailable, url

A view the filter emptied says so in its own words. --where name=Nobody over the same four sites shows 0 of 4, and the text view prints Nothing that was read matches the filter. That is a different sentence from Nothing was read., which is about the tenant and not about the filter.

Numbers sort before text. A column of counts with a refusal in it still sorts: the counts come first, in number order, and the state follows. This is --sort site_guests.guests over the four sites, with the title of each block and the one line it was ordered on; a run prints every line of each block.

Finance Close  https://contoso.sharepoint.com/sites/finance-close
  site_guests.guests                  0

Supplier Portal  https://contoso.sharepoint.com/sites/supplier-portal
  site_guests.guests                  2

Project Falcon  https://contoso.sharepoint.com/sites/project-falcon
  site_guests.guests                  3

Board Papers  https://contoso.sharepoint.com/sites/board-papers
  site_guests.guests  [permission-denied] Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

A filter and an order say nothing about a site. They decide which of the documents that were read are printed, and in what order.

What a view never does

Nothing is concluded in a view. Nothing is counted as good or bad, and no total is drawn over unlike things. A count that does appear is the length of a list the document holds, named for the list it counts.