The command
| Command | Status |
|---|---|
m365g governance inspect ownership | Published, tenant-verified |
The inspection reaches no tenant, so no tenant can verify it: it stands on the collections it reads, each with its own state, and its label follows them.
| Collection | Collected by | Status |
|---|---|---|
sites-owners | m365g spo site admins | Published, tenant-verified |
sites | m365g spo site list | Published, tenant-verified |
groups | m365g entra group list | Published, tenant-verified |
The command that feeds it
m365g spo site admins reads who administers every enumerated site, by opening each site. Enumeration shows what it prints.
m365g spo site admins --tenant-url https://contoso-admin.sharepoint.com --evidence-out ./evidence/owners
m365g governance inspect ownership --evidence ./evidenceThe first command reaches a tenant. The second does not, and gives the same inspection every time it is run over the same evidence. A site that is in the evidence without an administrators read, from m365g spo site list for example, still gets a row, which says the read was not made.
The number is yours
--minimum-owners N is the number of administrators each site is compared with. It is the operator's number: the engine holds no view on what it should be, and records the one that was used in the inspection, in its question and in its parameters. Without the option the number is 2. A number below 1 is refused, with exit 2.
What it prints
Which SharePoint sites name at least 2 administrators, and which cannot say?
Board Papers https://contoso.sharepoint.com/sites/board-papers
standing not-established (the site did not say who administers it; that is not a site with no administrators)
administrators read: [permission-denied] · named - · groups -
Microsoft 365 group [not-collected]
Finance Close https://contoso.sharepoint.com/sites/finance-close
standing fewer (1 named administrators and no group)
administrators read: observed · named 1 · groups 0
Microsoft 365 group [not-collected]
Intranet Home https://contoso.sharepoint.com/sites/intranet-home
standing not-established (1 named administrators and 1 groups whose members were not read, so the number of people cannot be compared with the threshold)
administrators read: observed · named 1 · groups 1
Microsoft 365 group [not-collected]
Old Campaigns https://contoso.sharepoint.com/sites/old-campaigns
standing not-established (the site did not say who administers it; that is not a site with no administrators)
administrators read: [partial] · named - · groups -
Microsoft 365 group [not-collected]
Project Falcon https://contoso.sharepoint.com/sites/project-falcon
standing meets (2 named administrators)
administrators read: observed · named 2 · groups 0
Microsoft 365 group [not-collected]
Supplier Portal https://contoso.sharepoint.com/sites/supplier-portal
standing at-least (3 named administrators, and groups that were not expanded)
administrators read: observed · named 3 · groups 1
Microsoft 365 group [not-collected]
6 SharePoint sites in the evidence:
at-least: 1
fewer: 1
meets: 1
not-established: 3
Not established by this inspection:
- the people behind an administrator that is a group: no group was expanded, so a site administered by a group has an unknown number of administrators
- the owners of the Microsoft 365 group or the team connected to a site: a site collection administrator, a group owner and a team owner are three different things and only the first was read
- whether an administrator is active, reachable or still employed: an account being named is not a person being responsible
- sites the collecting identity could not enumerate or open: the first are absent from the evidence, the second are rows that say so
From 6 evidence documents, sha256:c9969176ea2c…, collected 2026-11-10T09:31:12Z to 2026-11-10T09:31:12Z.The counts at the end are the number of rows in each standing, named for the standing they count. They are not added into anything, and no site is ranked against another.
--output csv and --output md give one row per site, with the columns name, url, owners_read, named_administrators, group_administrators, administrators_at_least, administrators_at_most, connected_group, group_user_owners, standing and because:
name,url,owners_read,named_administrators,group_administrators,standing,administrators_at_least,administrators_at_most,connected_group,group_user_owners,because
Board Papers,https://contoso.sharepoint.com/sites/board-papers,[permission-denied],,,not-established,,,[not-collected],,the site did not say who administers it; that is not a site with no administrators
Finance Close,https://contoso.sharepoint.com/sites/finance-close,observed,1,0,fewer,,,[not-collected],,1 named administrators and no group
Intranet Home,https://contoso.sharepoint.com/sites/intranet-home,observed,1,1,not-established,,,[not-collected],,"1 named administrators and 1 groups whose members were not read, so the number of people cannot be compared with the threshold"
Old Campaigns,https://contoso.sharepoint.com/sites/old-campaigns,[partial],,,not-established,,,[not-collected],,the site did not say who administers it; that is not a site with no administrators
Project Falcon,https://contoso.sharepoint.com/sites/project-falcon,observed,2,0,meets,,,[not-collected],,2 named administrators
Supplier Portal,https://contoso.sharepoint.com/sites/supplier-portal,observed,3,1,at-least,,,[not-collected],,"3 named administrators, and groups that were not expanded"The four standings
A standing compares one thing with the operator's number: the administrators that can be counted. A named person can be counted. A group cannot, because a group is not expanded into its members. There is one exception, described further down: the owners of the site's own Microsoft 365 group, when that group is what administers the site and its owners were read.
meets: the named administrators reach the number, and no administrator is a group.Project Falconnames 2 and the number is 2.at-least: the named administrators already reach the number, and there are groups besides. The site has at least that many administrators and possibly more.Supplier Portalnames 3 and has 1 group.fewer: the named administrators do not reach the number, and no administrator is a group, so the count is complete.Finance Closenames 1.not-established: the comparison cannot be made. It is never a polite word for too few.
Three different rows above are not-established, for three different reasons, and each row says which.
Intranet Homehas one named administrator and one group. One named person does not reach 2, and the group may hold nobody or fifty people. A group is never counted as one person and never as none, so the site is not reported as having too few.Board Papersrefused the read:[permission-denied]. A refusal says who was asking. It says nothing about who administers the site.Old Campaignsanswered with nothing:[partial]. An empty answer is not a site with no administrators: an identity that cannot resolve them receives the same empty list.
When the group that administers a site is its own Microsoft 365 group
A site connected to a Microsoft 365 group is usually administered through that group: among its administrators stands a claim that names the owners of the group. When the evidence also holds m365g spo site list and m365g entra group list, the inspection can say who is behind that one claim, because the group's owners were counted.
This read has read one directory. That is what the label above stands on, and the Engine's record of the read lists what it did not cover. No group refused its owners or its members, so the document a refusal writes is proved against a stand-in only. It was one page of groups and one page for each relationship, so paging is proved against a stand-in only. Some connected sites did not say who administers them, so for those the second surface, the claim on the site itself, could not be compared. Whether a named site administrator is also one of a group's owners was not read: no identity is kept, which is why the ownership inspection reports a range. And it was one directory at one moment, which establishes nothing about how another answers.
m365g spo site list --tenant-url https://contoso-admin.sharepoint.com --evidence-out ./evidence/sites
m365g entra group list --tenant-url https://contoso-admin.sharepoint.com --evidence-out ./evidence/groups
m365g governance inspect ownership --evidence ./evidenceBoard Papers https://contoso.sharepoint.com/sites/board-papers
standing not-established (the site did not say who administers it; that is not a site with no administrators)
administrators read: [permission-denied] · named - · groups -
Microsoft 365 group connected · owners that are users 4 (the group's, not this site's answer)
Finance Close https://contoso.sharepoint.com/sites/finance-close
standing fewer (1 named administrators and no group)
administrators read: observed · named 1 · groups 0
Microsoft 365 group none
Graduate Intake https://contoso.sharepoint.com/sites/graduate-intake
standing fewer (0 named administrators and the 1 user owners of its Microsoft 365 group: at most 1 people)
administrators read: observed · named 0 · groups 1
people at least 1, at most 1
Microsoft 365 group connected · owners that are users 1
Intranet Home https://contoso.sharepoint.com/sites/intranet-home
standing at-least (1 named administrators and the 3 user owners of its Microsoft 365 group, which is the group that administers it)
administrators read: observed · named 1 · groups 1
people at least 3, at most 4
Microsoft 365 group connected · owners that are users 3
Old Campaigns https://contoso.sharepoint.com/sites/old-campaigns
standing not-established (1 named administrators and 1 groups whose members were not read, so the number of people cannot be compared with the threshold)
administrators read: observed · named 1 · groups 1
Microsoft 365 group connected · owners that are users [permission-denied]
Project Falcon https://contoso.sharepoint.com/sites/project-falcon
standing meets (2 named administrators)
administrators read: observed · named 2 · groups 0
Microsoft 365 group connected · owners that are users 2
Regions Hub https://contoso.sharepoint.com/sites/regions-hub
standing not-established (between 1 and 2 people: 1 named and 1 group owners, and whether they are the same people was not read)
administrators read: observed · named 1 · groups 1
people at least 1, at most 2
Microsoft 365 group connected · owners that are users 1
Supplier Portal https://contoso.sharepoint.com/sites/supplier-portal
standing at-least (3 named administrators, and groups that were not expanded)
administrators read: observed · named 3 · groups 1
Microsoft 365 group connected · owners that are users 2
Team Space https://contoso.sharepoint.com/sites/team-space
standing meets (0 named administrators and the 2 user owners of its Microsoft 365 group, which is the group that administers it)
administrators read: observed · named 0 · groups 1
people at least 2, at most 2
Microsoft 365 group connected · owners that are users 2One group can be expanded, and only one. It has to be the owners claim of the group the site is connected to: the same identifier, read from two surfaces, the site's administrators and the site enumeration. Then the people behind it are that group's owners, and they were counted.
The result is a range, and never a sum. A named administrator may also be one of the group's owners, and no identity is kept to tell. So the people who administer the site are at least the larger of the two counts and at most both together, printed as people at least N, at most M. Adding the two lists would report three people for a site whose one named administrator is also one of its two group owners.
The standing is read from that range, against the operator's number.
meets: the range is one number and it reaches the number.Team Spacenames nobody and its group has 2 owners: at least 2, at most 2.at-least: the low end already reaches the number.Intranet Homenames 1 and its group has 3 owners: at least 3, at most 4.fewer: even the high end falls short.Graduate Intakenames nobody and its group has 1 owner: at most 1.not-established: the number falls inside the range.Regions Hubnames 1 and its group has 1 owner: between 1 and 2 people, and whether they are the same person was not read.
Nothing else is expanded. A site keeps the standing its named administrators give it, and the group line is shown beside it, in each of these cases.
- Another group among the administrators.
Supplier Portalis administered by 3 named people and a security group. Its Microsoft 365 group has 2 owners, and they are not its administrators: the standing isat-leastfrom the 3 named. - The members claim of the connected group, or a claim of any other group: neither is the owners of this one.
- Owners that could not be read.
Old Campaignsis administered by its group's owners, and the read of those owners was refused:[permission-denied], no count, andnot-established. - No group among the administrators.
Project Falconis connected to a group with 2 owners and names 2 administrators itself:meets, from the 2 named, and the group's owners are shown and not added.
The group line has its own empty forms: none when the site enumeration says the site is connected to no group (Finance Close), and [not-collected] when the site is not in the site enumeration, or names a group that is not in the evidence. A refused site is still a refused site: Board Papers shows a group with 4 owners, marked (the group's, not this site's answer), and stays not-established, because the site did not say who administers it.
The same evidence, another number
With --minimum-owners 3 nothing is read again. The same six documents are compared with 3:
Project Falcon https://contoso.sharepoint.com/sites/project-falcon
standing fewer (2 named administrators and no group)
administrators read: observed · named 2 · groups 0
Microsoft 365 group [not-collected]
Supplier Portal https://contoso.sharepoint.com/sites/supplier-portal
standing at-least (3 named administrators, and groups that were not expanded)
administrators read: observed · named 3 · groups 1
Microsoft 365 group [not-collected]
6 SharePoint sites in the evidence:
at-least: 1
fewer: 2
not-established: 3Project Falcon names 2, which was meets against 2 and is fewer against 3. Supplier Portal names 3 and stays at-least. The three rows that could not be compared still cannot be: no choice of number turns a refusal into a count.
Two inspections, compared
An inspection kept with --out can be compared with a later one of the same question.
m365g governance inspect ownership --evidence ./evidence/november --out ownership-november.json
m365g governance inspect ownership --evidence ./evidence/december --out ownership-december.json
m365g governance inspect-diff ownership-november.json ownership-december.jsonWhat changed: Which SharePoint sites name at least 2 administrators, and which cannot say?
before 6 documents, collected 2026-11-10T09:31:12Z to 2026-11-10T09:31:12Z
after 6 documents, collected 2026-12-10T09:30:00Z to 2026-12-10T09:30:00Z
Entered the evidence: 1
Graduate Intake
Left the evidence: 1
Old Campaigns
Changed: 2
Board Papers
owners_read: [permission-denied] -> observed
named_administrators: -> 2
group_administrators: -> 0
standing: not-established -> meets
Finance Close
named_administrators: 1 -> 2
standing: fewer -> meets
Unchanged: 3
Not established by this comparison:
- why a row left: it is not in the later evidence, which is not the same as the resource no longer existing
- what happened between the two collections: two readings are two moments, and a value that changed and changed back is not seen
- when anything changed: only that it differs between the two collection times recorded aboveBoard Papers no longer refuses the read, and Finance Close names a second administrator. Old Campaigns left the evidence, which is all the comparison says about it.
The comparison reaches no tenant and reads two files and nothing else. It is m365g governance inspect-diff, which the Engine's reference names without a validation state: Published
Only like is compared with like. The two inspections must be the same scenario with the same parameters. Anything else is refused with exit 2, because the difference in the question would be reported as a change in the tenant:
refusing to compare: the two inspections differ in parameters: {'minimum_owners': 2} and {'minimum_owners': 3}. Comparing them would report the difference in the question as a change in the tenant.A row that left is not a resource that was deleted. It is a resource that is not in the later evidence: removed, or no longer shown to the identity that collected, or not collected that time. The comparison prints what it does not establish, and that is the first line of it.
What it does not establish
The inspection prints this list itself, on every run. These are its lines.
Not established by this inspection:
- the people behind an administrator that is a group, except where that group is the owners of the Microsoft 365 group the site is connected to: those were counted, as a range. Any other group was not expanded
- whether a named administrator is also one of the group's owners: no identity is kept, which is why a site administered through its group's owners is counted as a range. A group owner is an administrator of the site only where the site's own administrators name that group's owners; a team owner was not read as such
- whether an administrator is active, reachable or still employed: an account being named is not a person being responsible
- sites the collecting identity could not enumerate or open: the first are absent from the evidence, the second are rows that say soA site collection administrator, a group owner and a team owner are three different things, and only the first two are read.
The inspection also states the relation it did not make, among its relations: group administrator -> its members: NOT JOINED.
So meets on a row is a statement about how many accounts a site names. It is not a statement that the site is looked after.