Errors, partial coverage and limitations

The commands this page reads

A refused site is a row, never a closed site

When the read of one site is refused, the site still gets an evidence document. The fact a rule would read is present and says why it has no value:

Board Papers  https://contoso.sharepoint.com/sites/board-papers
  site · https://contoso.sharepoint.com/sites/board-papers
  sharing.capability  [permission-denied] Access denied. You do not have permission to perform this action or access this resource.
  enumeration         UNAVAILABLE: Enumerated 4 sites with a delegated identity. Sites this identity cannot see are absent from this run, and their number is not knowable from here.
  sharing             UNAVAILABLE: Access denied. You do not have permission to perform this action or access this resource.

In the inspection the same site is a row whose setting is the state in brackets:

Board Papers  https://contoso.sharepoint.com/sites/board-papers
  in force         not-established  (this site's sharing setting was not read)
  site / org       [permission-denied] / ExternalUserSharingOnly
  external sharing not-established · new guests not-established · anonymous links not-established
  guests met       [not-collected]

SharePoint's own refusal, Access is denied, was once recorded as missing, an absence; it is recorded as [permission-denied], which is what it is.

[permission-denied] is a fact about the read, not about the site. The site may permit anything. Reading the row as "sharing is off" would turn a refusal into the most favourable answer available, which is why the value is not-established in all three columns and the site is counted under external sharing not-established, apart from the sites where sharing is not permitted.

The same holds for who administers a site. A site that refuses m365g spo site admins is a row of the ownership inspection with [permission-denied] and the standing not-established, apart from the sites that name too few.

An enumerated site nobody read stays not-established

A site can be in the evidence without a sharing read: it was listed by spo site list and spo sharing list was not run, or was run earlier, before the site existed. The inspection gives it a row and does not give it a value:

Old Campaigns  https://contoso.sharepoint.com/sites/old-campaigns
  in force         not-established  (this site's sharing setting was not read)
  site / org       [not-collected] / ExternalUserSharingOnly
  external sharing not-established · new guests not-established · anonymous links not-established
  guests met       [not-collected]

[not-collected] means no document in the evidence carries this fact for this site. The enumeration's own site.sharing_capability is not used to fill the gap: it is [not-supported] on every site, because the enumeration path does not populate it.

The organisation's setting was not read

Without the document from spo tenant sharing get, a site's own setting is all the inspection has. It shows it, and says what is missing from the answer:

Project Falcon  https://contoso.sharepoint.com/sites/project-falcon
  in force         ExternalUserAndGuestSharing  (the site's own setting; what the organisation permits was not read, so the bound it places on this site is not established)
  site / org       ExternalUserAndGuestSharing / [not-collected]
  external sharing permitted · new guests permitted · anonymous links permitted
  guests met       [not-collected]

ExternalUserAndGuestSharing is what the site is set to. Whether the organisation narrows it is not established, and the row says so instead of presenting the site's value as what is in force without qualification.

A row that left the evidence was not deleted

m365g governance inspect-diff compares two inspections. A row in the earlier one and not in the later one is reported as having left the evidence, and nothing more: the resource may be gone, or hidden from the identity that collected, or not collected that time. Two inspections with different parameters, or of different scenarios, are refused and not compared.

Duplicates

Two documents for one site, from two collections kept under the same directory, are one row. The latest read is used and the duplicate is reported, in a line under the counts:

5 SharePoint sites in the evidence:
  external sharing not-established: 2
  external sharing not-permitted: 1
  external sharing permitted: 2
  1 sites were in the evidence more than once; the latest read of each was used

A site with a sharing read always wins over the same site without one, so an enumeration document cannot hide the read that answered the question. The JSON of the inspection lists the duplicated sites by address.

An empty answer is not an empty site

A site can answer the administrators read with no entries. That is not a site with no administrators: an identity that cannot resolve them receives the same empty list, and the collector cannot tell the two apart. The fact is recorded as [partial], with that reason, and the inspection reports it as not established:

Old Campaigns  https://contoso.sharepoint.com/sites/old-campaigns
  standing         not-established  (the site did not say who administers it; that is not a site with no administrators)
  administrators   read: [partial] · named - · groups -
  Microsoft 365 group  [not-collected]

A group is not a number of people

An administrator that is a group is not expanded into its members, with the one exception in the next section. A site whose named administrators fall short of the operator's number, and which also has a group, is not-established: it is never reported as having too few, and the group is never counted as one person or as none.

Intranet Home  https://contoso.sharepoint.com/sites/intranet-home
  standing         not-established  (1 named administrators and 1 groups whose members were not read, so the number of people cannot be compared with the threshold)
  administrators   read: observed · named 1 · groups 1
  Microsoft 365 group  [not-collected]

A group's owners are counted only where the group administers the site

The ownership inspection counts the owners of a site's Microsoft 365 group as its administrators in one case only: when the group among the site's administrators is the owners claim of that same group. The result is then a range and never a sum, because a named administrator may also be an owner and no identity is kept to tell.

Regions Hub  https://contoso.sharepoint.com/sites/regions-hub
  standing         not-established  (between 1 and 2 people: 1 named and 1 group owners, and whether they are the same people was not read)
  administrators   read: observed · named 1 · groups 1
  people           at least 1, at most 2
  Microsoft 365 group  connected · owners that are users 1

Any other group, the members claim, or owners that could not be read expand nothing, and the site keeps the standing its named administrators give it.

A registration is not an application that can sign in

A registration is the definition; what signs in to a directory is its service principal there. The application governance inspection says yes, or no with the reason, only when the service principals were read. Without that collection every row says [not-collected], and a credential's standing is never read as the application being usable.

A list that was not returned is not an empty list

An application whose credentials the service did not return is not-established in the application governance inspection, never no-credentials. Only an observed empty list is an application with nothing to expire.

Legacy Importer  application-id-0005
  standing         not-established  (the credentials of this application were not returned)
  credentials      ended - · ending - · later - · earliest end -
  can sign in here [not-collected]
  asks for         application 1 · delegated 0  (asked, not granted)

Old evidence gives an old answer, and says so

The application governance inspection measures from when the evidence was collected, never from the clock. Evidence collected a month ago shows a credential as ending that may have ended since. The collection time is on every row and in the question, and the remedy is a new collection, not a later run over the same documents.

A refused read of the policies is not a tenant with no policy

When m365g entra ca list is refused, the Conditional Access policies inspection prints no row and says first, among what it does not establish, that the read was refused. No policy in the evidence is never reported as no policy in the tenant.

A definition is not a sign-in

The same inspection reports what each policy's definition says: whether it is enforced, whom it names and whom it leaves out. It expands no group and no role, evaluates no condition, and combines no policies. It does not say who a policy applies to.

Met is not access

m365g spo site guests reads which guest accounts each site has met, from the site's own list of users. An entry stays after a permission is removed, and a guest reached through a group may have access with no entry of their own. The external access inspection says met and never access, and an account a site has met that the directory does not list as a guest is reported as that and not explained.

One read of one directory is not a proved range

m365g entra guest list, m365g entra app list, m365g entra serviceprincipal list, m365g entra group list and m365g spo site guests have each read one directory. The Engine's record of each read lists what it did not cover, and those parts are proved against a stand-in for the service only.

• Guests. A population of one account: neither a pending invitation nor a disabled account was observed. One page. No refusal met.

• Applications. No credential ended inside the default window, so the ending branch of the inspection has not run against a directory. One page. No refusal met, and no registration came back without a credential list.

• Service principals. One page. No refusal met. What any service principal was granted was not read.

• Groups. No group refused its owners or its members. One page of groups and one page for each relationship. Some connected sites did not say who administers them, so the second surface could not be compared for those.

• Guests each site has met. The accounts the sites had met and the guests the directory listed did not overlap, so a guest both listed and met has not been observed against a directory. The sites that refused were recorded under the earlier classification in that run.

For all five, one directory at one moment establishes nothing about how another answers. The label on each command follows the Engine's record and says no more than it does.

Empty evidence is not a clean tenant

A directory with no evidence document in it is refused. The command exits 2 and prints nothing on stdout:

no evidence document was found under ./evidence. This scenario reads: sites-sharing, tenant-sharing.

A directory that holds evidence and no SharePoint site gives an inspection that says so:

No SharePoint site is in this evidence.

0 SharePoint sites in the evidence:

Its last line reads From 0 evidence documents.

Neither is a finding about a tenant. No row with permitted on it means only that no such row was read. The same holds for a read: a view of no documents prints Nothing was read., and a tenant with no hub is a different statement, carried by a tenant document whose hubs.count is 0.

A partial list has no established end

Every document an enumeration writes carries the note that the list is partial: sites the identity cannot see are absent, and their number is not knowable from the evidence. The inspection repeats it in what it does not establish. Nothing downstream can repair this by counting, because the missing sites are not in anything that could be counted. Evidence and provenance has the wording.

Permissions recorded as not-established

Several SharePoint reads record their permissions as not-established. That word means no least-privilege set has been proved for the read. It does not mean the read needs none, and the command reference prints it as the word it is.

Exit codes

A logout that cannot clear the stored sign-in exits 1 and keeps its record. A login on a machine where protected storage cannot be established is refused before anybody signs in.

What these pages cannot show

These pages were written from the Engine's source and from output its code produces offline. They show the shape of what the commands print. They are not a record of a run against a tenant, and they carry no claim about how any real organisation is set.