The commands
| Command | Earlier name | Status |
|---|---|---|
m365g spo site list | m365g collect sites | Published, tenant-verified |
m365g spo hub list | m365g collect hubs | Published, tenant-verified |
m365g spo sharing list | m365g collect sites-sharing | Published, tenant-verified |
m365g spo tenant sharing get | m365g collect tenant-sharing | Published, tenant-verified |
m365g spo site admins | m365g collect sites-owners | Published, tenant-verified |
m365g spo site guests | m365g collect sites-guests | Published, tenant-verified |
m365g entra guest list | m365g collect guests | Published, tenant-verified |
m365g entra app list | m365g collect applications | Published, tenant-verified |
m365g entra serviceprincipal list | m365g collect service-principals | Published, tenant-verified |
m365g entra group list | m365g collect groups | Published, tenant-verified |
m365g teams team list | m365g collect groups --where group.is_team=true | Published |
The command reference lists, for each, what it reads and the permissions recorded for it, and links the manual page of the collection it runs.
The six spo commands take --tenant-url, the address of the SharePoint admin centre, and sign in as the active connection. Their examples assume a login to the fictional contoso and a delegated identity. The four entra reads take the same address and read Microsoft Graph, each for its own scope: guests, applications, service principals, groups.
spo site list
Every site this identity can enumerate, one document per site.
m365g spo site list --tenant-url https://contoso-admin.sharepoint.comTwo of the five sites it printed:
Board Papers https://contoso.sharepoint.com/sites/board-papers
site · https://contoso.sharepoint.com/sites/board-papers
site.group_connected false
site.last_content_modified 2026-11-09T19:45:13Z
site.lock_state Unlock
site.sharing_capability [not-supported] Not evidence from this path. Get-SPOSite documents that filtered enumeration does not populate SharingCapability and may return a default; reproduced on 1 of 5 sites, 2026-08-08. Read sharing.capability from the identity path.
site.storage_limit_set false
site.storage_quota_mb 26214400
site.storage_used_mb 1880
site.storage_used_percent 0
site.template STS#3
enumeration UNAVAILABLE: Enumerated 5 sites with a delegated identity. Sites this identity cannot see are absent from this run, and their number is not knowable from here.
Project Falcon https://contoso.sharepoint.com/sites/project-falcon
site · https://contoso.sharepoint.com/sites/project-falcon
site.group_connected true
site.last_content_modified 2026-11-03T16:20:05Z
site.lock_state Unlock
site.sharing_capability [not-supported] Not evidence from this path. Get-SPOSite documents that filtered enumeration does not populate SharingCapability and may return a default; reproduced on 1 of 5 sites, 2026-08-08. Read sharing.capability from the identity path.
site.storage_limit_set false
site.storage_quota_mb 26214400
site.storage_used_mb 412
site.storage_used_percent 0
site.template GROUP#0
enumeration UNAVAILABLE: Enumerated 5 sites with a delegated identity. Sites this identity cannot see are absent from this run, and their number is not knowable from here.Each block also carries a site.group_id and a site.hub_site_id line. They hold identifiers and are left out of this example.
Three things in that output are easy to misread.
site.sharing_capabilityis[not-supported]on every site, by design. Microsoft documents that a filtered enumeration does not populate that property and may return a default. The engine records it with a state no rule can evaluate, and says where the value lives:spo sharing listreads it site by site.site.storage_quota_mbof26214400is the per-site maximum, not a limit somebody set.site.storage_limit_setsays so as a fact of its own.- The
enumerationline is about the list, not the site. See what partial enumeration means.
spo hub list
The sites registered as hubs, and how each is set. One tenant document carries the count, so a tenant with no hub is an observation and not an empty directory.
m365g spo hub list --tenant-url https://contoso-admin.sharepoint.comIntranet Home https://contoso.sharepoint.com/sites/intranet-home
site · https://contoso.sharepoint.com/sites/intranet-home
hub.association_principals 2
hub.association_restricted true
hub.has_parent_hub false
hub.name_hidden_in_navigation false
hub.permissions_sync_enabled false
hub.requires_join_approval true
Regions Hub https://contoso.sharepoint.com/sites/regions-hub
site · https://contoso.sharepoint.com/sites/regions-hub
hub.association_principals 0
hub.association_restricted false
hub.has_parent_hub true
hub.name_hidden_in_navigation false
hub.permissions_sync_enabled false
hub.requires_join_approval false
https://contoso-admin.sharepoint.com
tenant · contoso.sharepoint.com
hubs.acquisition_method enumerated
hubs.count 2
hubs.population sharepoint-registered-hub-sitesEach hub block also carries a hub.hub_site_id and a hub.site_id line, left out here for the same reason. This collection feeds no rule: Microsoft publishes no position on how hubs should be set, so the reader is the operator and the report.
spo sharing list
What every enumerated site permits, read site by site. The enumeration supplies the addresses and nothing else; every value comes from the site's own read.
m365g spo sharing list --tenant-url https://contoso-admin.sharepoint.com --evidence-out ./evidence/sharingBoard Papers https://contoso.sharepoint.com/sites/board-papers
site · https://contoso.sharepoint.com/sites/board-papers
sharing.capability [permission-denied] Access denied. You do not have permission to perform this action or access this resource.
enumeration UNAVAILABLE: Enumerated 4 sites with a delegated identity. Sites this identity cannot see are absent from this run, and their number is not knowable from here.
sharing UNAVAILABLE: Access denied. You do not have permission to perform this action or access this resource.
Finance Close https://contoso.sharepoint.com/sites/finance-close
site · https://contoso.sharepoint.com/sites/finance-close
sharing.capability Disabled
sharing.default_link_permission View
sharing.default_link_type Internal
sharing.effective_default_link_type Internal
enumeration UNAVAILABLE: Enumerated 4 sites with a delegated identity. Sites this identity cannot see are absent from this run, and their number is not knowable from here.
Project Falcon https://contoso.sharepoint.com/sites/project-falcon
site · https://contoso.sharepoint.com/sites/project-falcon
sharing.capability ExternalUserAndGuestSharing
sharing.default_link_permission Edit
sharing.default_link_type None
sharing.effective_default_link_type Direct
enumeration UNAVAILABLE: Enumerated 4 sites with a delegated identity. Sites this identity cannot see are absent from this run, and their number is not knowable from here.
Supplier Portal https://contoso.sharepoint.com/sites/supplier-portal
site · https://contoso.sharepoint.com/sites/supplier-portal
sharing.capability ExternalUserSharingOnly
sharing.default_link_permission View
sharing.default_link_type Direct
sharing.effective_default_link_type Direct
enumeration UNAVAILABLE: Enumerated 4 sites with a delegated identity. Sites this identity cannot see are absent from this run, and their number is not knowable from here.No site is dropped. Board Papers was enumerated and its own read was refused, so it has a document, a [permission-denied] where the value would be, and sharing among its unavailable areas. Errors, partial coverage and limitations says how to read that.
Only the sites that permit no sharing outside. --where sharing.capability=Disabled narrows the view to them. The four sites are still read, and Board Papers is not among the ones shown: its value was not observed, so it is neither Disabled nor anything else. --where "sharing.capability=[permission-denied]" finds it.
m365g spo sharing list --where sharing.capability=Disabled --tenant-url https://contoso-admin.sharepoint.comFinance Close https://contoso.sharepoint.com/sites/finance-close
site · https://contoso.sharepoint.com/sites/finance-close
sharing.capability Disabled
sharing.default_link_permission View
sharing.default_link_type Internal
sharing.effective_default_link_type Internal
enumeration UNAVAILABLE: Enumerated 4 sites with a delegated identity. Sites this identity cannot see are absent from this run, and their number is not knowable from here.1 of 4 resources shown. The filter chose what is shown: every resource was read.Evidence and provenance describes --where and --sort in full.
spo tenant sharing get
What the organisation permits, which every site inherits by default and which no site can exceed.
m365g spo tenant sharing get --tenant-url https://contoso-admin.sharepoint.com --evidence-out ./evidence/tenanthttps://contoso-admin.sharepoint.com
tenant · contoso.sharepoint.com
tenant_sharing.capability ExternalUserSharingOnly
tenant_sharing.default_link_type Direct
tenant_sharing.file_anonymous_link_type [missing] FileAnonymousLinkType was not returned for this tenant.The same document as a Markdown table, with --output md:
| resource_type | name | url | native_id | tenant | collected_at | completed | unavailable | tenant_sharing.capability | tenant_sharing.default_link_type | tenant_sharing.file_anonymous_link_type |
|---|---|---|---|---|---|---|---|---|---|---|
| tenant | https://contoso-admin.sharepoint.com | https://contoso-admin.sharepoint.com | contoso.sharepoint.com | contoso.sharepoint.com | 2026-11-10T09:23:05Z | tenant_sharing | | ExternalUserSharingOnly | Direct | [missing] |spo site admins
Who administers every enumerated site, read by opening each site as the identity already signed in. Who administers a site is answered by the site and by nothing else.
m365g spo site admins --tenant-url https://contoso-admin.sharepoint.com --evidence-out ./evidence/ownersThree of the six sites it printed:
Board Papers https://contoso.sharepoint.com/sites/board-papers
site · https://contoso.sharepoint.com/sites/board-papers
owners [permission-denied] Access denied. You do not have permission to perform this action or access this resource.
enumeration UNAVAILABLE: Enumerated 6 sites with a delegated identity. Sites this identity cannot see are absent from this run, and their number is not knowable from here.
owners UNAVAILABLE: Access denied. You do not have permission to perform this action or access this resource.
Old Campaigns https://contoso.sharepoint.com/sites/old-campaigns
site · https://contoso.sharepoint.com/sites/old-campaigns
owners [partial] Get-PnPSiteCollectionAdmin returned no entries. That is not the same as a site with no administrators: an identity that cannot resolve them returns the same empty list, and this collector cannot tell the two apart. Application-only identities have been observed returning nothing for a site whose administrator is a group.
enumeration UNAVAILABLE: Enumerated 6 sites with a delegated identity. Sites this identity cannot see are absent from this run, and their number is not knowable from here.
owners UNAVAILABLE: Get-PnPSiteCollectionAdmin returned no entries. That is not the same as a site with no administrators: an identity that cannot resolve them returns the same empty list, and this collector cannot tell the two apart. Application-only identities have been observed returning nothing for a site whose administrator is a group.
Project Falcon https://contoso.sharepoint.com/sites/project-falcon
site · https://contoso.sharepoint.com/sites/project-falcon
owners direct: 2 entries; direct_count=2; effective_count=2; expansion_complete=true; group_count=0; groups: 0 entries
enumeration UNAVAILABLE: Enumerated 6 sites with a delegated identity. Sites this identity cannot see are absent from this run, and their number is not knowable from here.- A site that will not open is a document, not a gap.
Board Papersrefused: itsownersfact is[permission-denied]. - An empty answer is never a site with no administrators.
Old Campaignsanswered with no entries. An identity that cannot resolve the administrators receives the same empty list, and the collector cannot tell the two apart, so the fact is[partial]and says why. - A group is recorded as a group. The line for
Project Falconholds how many administrators are named people (direct_count) and how many are groups (group_count). No group is expanded into its members.
The ownership inspection reads those two counts.
spo site guests
Published, tenant-verified
This read has read one directory. That is what the label above stands on, and the Engine's record of the read lists what it did not cover. The two sides of the comparison with the directory's guests did not overlap there, so a guest that is both listed and met has not been observed against a directory: that branch is proved by a test only. What an account is that a site has met and the directory does not list as a guest was not read. The sites that refused were recorded under an earlier classification in that run; the corrected one is proved by a test over the same messages. Being in a site's list of users is not having access, and nothing in the read is about access. And it was one directory at one moment, which establishes nothing about how another answers.
Every site keeps a list of the principals it has met: people who were granted something, people a link was sent to, people who opened the site through a group. This read opens each enumerated site, reads that list, and keeps the entries that are guests.
An identifier and never a name. For each guest only the directory object identifier is kept, which is what joins a site to the directory's own record of the same account. The login name, the display name and the mail address are read to decide whether an entry is a guest and are written nowhere. A guest with no directory account, somebody who opens a link with a one-time code, has no identifier and is counted apart, as site_guests.guests_without_account.
m365g spo site guests --tenant-url https://contoso-admin.sharepoint.com --evidence-out ./evidence/site-guestsThree of the four sites it printed, from documents written for this page. Where guest-object-id-0001 stands, a run prints the directory's object identifier for the account.
Board Papers https://contoso.sharepoint.com/sites/board-papers
site · https://contoso.sharepoint.com/sites/board-papers
site_guests.guests [permission-denied] Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
enumeration UNAVAILABLE: Enumerated 4 sites with a delegated identity. Sites this identity cannot see are absent from this run, and their number is not knowable from here.
site_guests UNAVAILABLE: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
Finance Close https://contoso.sharepoint.com/sites/finance-close
site · https://contoso.sharepoint.com/sites/finance-close
site_guests.directory_guests 0
site_guests.guest_object_ids 0 entries
site_guests.guests 0
site_guests.guests_without_account 0
enumeration UNAVAILABLE: Enumerated 4 sites with a delegated identity. Sites this identity cannot see are absent from this run, and their number is not knowable from here.
Project Falcon https://contoso.sharepoint.com/sites/project-falcon
site · https://contoso.sharepoint.com/sites/project-falcon
site_guests.directory_guests 3
site_guests.guest_object_ids guest-object-id-0001, guest-object-id-0002, guest-object-id-0009
site_guests.guests 3
site_guests.guests_without_account 0
enumeration UNAVAILABLE: Enumerated 4 sites with a delegated identity. Sites this identity cannot see are absent from this run, and their number is not knowable from here.Being in the list is not having access. An entry stays after a permission is removed, and a guest reached through a group may hold access with no entry of their own. So this establishes that a site has met a guest, which is the strongest thing the list can say. Nothing here may be read as what that guest can open today.
Board Papers refused the read with SharePoint's own Access is denied, and the fact carries [permission-denied]. Finance Close answered and has met no guest: 0 there is an observation.
entra guest list
Published, tenant-verified
This read has read one directory. That is what the label above stands on, and the Engine's record of the read lists what it did not cover. It was a population of one account, which proves the path and not the range: neither a pending invitation nor a disabled account was observed. It was one page, so paging is proved against a stand-in only. No refusal was met, so the document a refused read writes is proved against a stand-in only. The Engine's record adds that it was read again through the engine's own sign-in as a person, with a session kept by login, no further prompt and no token supplied from outside. And it was one directory at one moment, which establishes nothing about how another answers.
It asks Microsoft Graph for the accounts of type Guest and requests six properties: id, userType, accountEnabled, externalUserState, externalUserStateChangeDateTime and createdDateTime. None of them names a person. No display name, mail address or user principal name is requested, so the evidence cannot hold one: a guest is identified by the directory's object id. The permission recorded for it is User.Read.All.
It signs in as the person, through the session login kept, and asks for that one scope. A certificate, or a token the operator supplies, takes precedence when given.
m365g entra guest list --tenant-url https://contoso-admin.sharepoint.com --evidence-out ./evidence/guestsThe shape of the view, produced from documents written for this page. Where guest-object-id-0001 stands, a run prints the directory's object id for the account.
guest-object-id-0001
user · guest-object-id-0001
guest.account_enabled true
guest.created_at 2025-03-12T08:30:00Z
guest.invitation_state Accepted
guest.invitation_state_changed_at 2025-03-14T10:02:00Z
guest.user_type Guest
guest-object-id-0002
user · guest-object-id-0002
guest.account_enabled true
guest.created_at 2026-01-19T11:05:00Z
guest.invitation_state Accepted
guest.invitation_state_changed_at 2026-01-20T15:44:00Z
guest.user_type Guest
guest-object-id-0003
user · guest-object-id-0003
guest.account_enabled true
guest.created_at 2026-10-02T09:00:00Z
guest.invitation_state PendingAcceptance
guest.invitation_state_changed_at 2026-10-02T09:00:00Z
guest.user_type Guest
guest-object-id-0004
user · guest-object-id-0004
guest.account_enabled false
guest.created_at 2024-06-01T07:45:00Z
guest.invitation_state Accepted
guest.invitation_state_changed_at 2024-06-03T13:20:00Z
guest.user_type Guest
contoso.sharepoint.com
tenant · contoso.sharepoint.com
guests.acquisition_method enumerated
guests.count 4
guests.population entra-guest-user-accountsA guest existing is not a guest having access. The read says an account of type Guest is in the directory, whether it is enabled, and whether its invitation was accepted. It says nothing about what the account can reach.
entra app list
Published, tenant-verified
This read has read one directory. That is what the label above stands on, and the Engine's record of the read lists what it did not cover. No credential ended inside the default window, so the ending branch of the inspection has not run against a directory. It was one page, so paging is proved against a stand-in only. No refusal was met, and no registration came back without a credential list, so the missing case is proved against a stand-in only. The Engine's record adds that it was read again through the engine's own sign-in as a person, with a session kept by login, no further prompt and no token supplied from outside. And it was one directory at one moment, which establishes nothing about how another answers.
It enumerates the application registrations in the directory: when each credential starts and ends, how many are secrets and how many are certificates, and how many permissions each registration asks for. The permission recorded for it is Application.Read.All. Like the guest read, it signs in as the person through the kept session, for that one scope.
m365g entra app list --tenant-url https://contoso-admin.sharepoint.com --evidence-out ./evidence/applicationsTwo of the six applications in the view, produced from documents written for this page. Where application-object-id-0001 and application-id-0001 stand, a run prints the directory's own identifiers.
Payroll Export
application · application-object-id-0001
application.app_id application-id-0001
application.certificates 0
application.created_at 2024-01-10T09:00:00Z
application.credentials 2 entries
application.earliest_credential_end 2026-10-01T00:00:00Z
application.requested_application_permissions 2
application.requested_delegated_permissions 0
application.secrets 2
application.sign_in_audience AzureADMyOrg
Legacy Importer
application · application-object-id-0005
application.app_id application-id-0005
application.certificates 0
application.created_at 2024-01-10T09:00:00Z
application.credentials [missing] One kind of credential was not returned, so the list would be incomplete and is not published.
application.requested_application_permissions 1
application.requested_delegated_permissions 0
application.secrets [missing] `passwordCredentials` was not present on the application returned.
application.sign_in_audience AzureADMyOrgLegacy Importer shows the rule that matters most here: a credential list the service did not return is [missing], never an empty list. Application governance says what is deliberately never collected, and what the inspection makes of these documents.
entra serviceprincipal list
Published, tenant-verified
This read has read one directory. That is what the label above stands on, and the Engine's record of the read lists what it did not cover. It was one page: the population was below the page size asked for, so paging is proved against a stand-in only. No refusal was met. What any service principal was granted was not read: that needs a scope that has not been decided. And it was one directory at one moment, which establishes nothing about how another answers.
An application registration is the definition. A service principal is that application present in a directory, and it is the object that signs in and is granted things. A directory holds service principals for its own registrations and for applications that belong to other organisations. This read lists each one with whether it is enabled, whose application it is, and when the credentials the service principal itself holds end. The permission recorded for it is Application.Read.All.
Whose application it is, is decided from two identifiers and never from a name: the organisation the service says owns the application, and the directory the sign-in was issued in. When either is not known the fact is [missing], and it is not guessed.
What is left out is what the applications read leaves out, for the same reason: no secret, no hint, no certificate bytes and no thumbprint. What a service principal was granted is not read.
m365g entra serviceprincipal list --tenant-url https://contoso-admin.sharepoint.com --evidence-out ./evidence/service-principalsThree of the eight service principals in the view, produced from documents written for this page. Where service-principal-object-id-0001, application-id-0001 and organisation-id-of-this-directory stand, a run prints the directory's own identifiers.
Payroll Export
service-principal · service-principal-object-id-0001
service_principal.account_enabled true
service_principal.app_id application-id-0001
service_principal.certificates 0
service_principal.credentials 0 entries
service_principal.kind Application
service_principal.owned_by_this_directory true
service_principal.owner_organisation_id organisation-id-of-this-directory
service_principal.secrets 0
Intranet Sync
service-principal · service-principal-object-id-0002
service_principal.account_enabled false
service_principal.app_id application-id-0002
service_principal.certificates 0
service_principal.credentials 0 entries
service_principal.kind Application
service_principal.owned_by_this_directory true
service_principal.owner_organisation_id organisation-id-of-this-directory
service_principal.secrets 0
A vendor's connector
service-principal · service-principal-object-id-0006
service_principal.account_enabled true
service_principal.app_id application-id-0101
service_principal.certificates 0
service_principal.credentials 0 entries
service_principal.kind Application
service_principal.owned_by_this_directory false
service_principal.owner_organisation_id organisation-id-of-another-organisation
service_principal.secrets 0service_principal.app_id is the same value on a registration and on its service principal. Application governance joins the two on it.
entra group list
Published, tenant-verified
This read has read one directory. That is what the label above stands on, and the Engine's record of the read lists what it did not cover. No group refused its owners or its members, so the document a refusal writes is proved against a stand-in only. It was one page of groups and one page for each relationship, so paging is proved against a stand-in only. Some connected sites did not say who administers them, so for those the second surface, the claim on the site itself, could not be compared. Whether a named site administrator is also one of a group's owners was not read: no identity is kept, which is why the ownership inspection reports a range. And it was one directory at one moment, which establishes nothing about how another answers.
It lists every Microsoft 365 group in the directory, and for each how many owners and how many members it has, by the kind of object each is. The permission recorded for it is GroupMember.Read.All.
Counts by kind, and no identity. For owners and members only an identifier is asked for, and neither the identifier nor a name is written: what is kept is how many are users and how many are other objects. The group's own name is kept, because a group is a workspace and not a person, and an operator told that a workspace has one owner needs to know which.
m365g entra group list --tenant-url https://contoso-admin.sharepoint.com --evidence-out ./evidence/groupsTwo of the four groups in the view, and the tenant document that carries the count, produced from documents written for this page. Where group-id-0001 stands, a run prints the directory's own identifier.
Project Falcon
group · group-id-0001
group.created_at 2025-02-01T09:00:00Z
group.is_team true
group.members 9
group.owners 2
group.user_members 9
group.user_owners 2
group.visibility Private
Intranet Home
group · group-id-0002
group.created_at 2025-02-01T09:00:00Z
group.is_team false
group.members 240
group.owners 3
group.user_members 238
group.user_owners 3
group.visibility Public
contoso.sharepoint.com
tenant · contoso.sharepoint.com
groups.acquisition_method enumerated
groups.count 4
groups.population entra-microsoft-365-groupsgroup.ownersandgroup.user_ownersare two counts. The first is every owner, the second the owners that are users. They differ when an owner is another kind of object.- A read that ended early publishes no count. Two owners read before a refusal is at least two owners, and the fact carries the state instead of a number that could be read as the whole.
- An owner being listed is not somebody being responsible. The account may be disabled or belong to somebody who left, and neither is read here.
- Only Microsoft 365 groups are asked for. Owners of distribution groups, of groups created in Exchange and of groups synchronised from on-premises are not available from this surface.
The groups with the fewest owners that are users, first. --sort group.user_owners orders the view on that count. Numbers come first, then the tenant document, which has no such column, then the group whose owners were refused: it is last because its count is not known, and not because it is high. The title of each block and the one line it was ordered on:
m365g entra group list --sort group.user_owners --tenant-url https://contoso-admin.sharepoint.comRegional Leads
group.user_owners 1
Project Falcon
group.user_owners 2
Intranet Home
group.user_owners 3
contoso.sharepoint.com
Old Campaigns
group.user_owners [permission-denied] 0 owners were read before the read ended: authenticated and not permitted to read groups/group-id-0004/owners?$select=id&$top=999. Least privilege for this surface is GroupMember.Read.All, and a delegated identity additionally needs a directory role such as Global Reader or Directory Readers. The ownership inspection shows these counts beside each site's administrators.
teams team list
m365g teams team list is the groups read, shown through --where group.is_team=true. It is one collector under a second command: there is no second read, no second collection and no further permission. A team is a Microsoft 365 group provisioned as one, and that mark is the group.is_team fact the read already keeps.
So the command has no state of its own. The Engine's reference records none for it, which is the label in the table above. It stands on the groups read, and that read's state, taken from the same reference, is Published, tenant-verified What the read's record did not cover is listed in the section above and holds here unchanged.
m365g teams team list --tenant-url https://contoso-admin.sharepoint.comThe two teams among the four groups written for this page. The line after them counts five resources because the tenant document is one of them:
Project Falcon
group · group-id-0001
group.created_at 2025-02-01T09:00:00Z
group.is_team true
group.members 9
group.owners 2
group.user_members 9
group.user_owners 2
group.visibility Private
Regional Leads
group · group-id-0005
group.created_at 2025-02-01T09:00:00Z
group.is_team true
group.members 12
group.owners 1
group.user_members 12
group.user_owners 1
group.visibility Private2 of 5 resources shown. The filter chose what is shown: every resource was read.- Every group is read, and every group is kept. With
--evidence-outthe directory holds all the groups and the tenant document, not only the teams. - A team's owners are the group's owners. The counts are the ones the group read made. Nothing is read from Microsoft Teams itself: no channels, no membership of a channel, no settings of the team.
- A group whose mark was not observed is not shown as a team and not shown as anything else. It is found by its state, in brackets.
Keeping what was read
Each of the ten prints a view and keeps nothing unless --evidence-out names a directory. The inspections on the external access, ownership and application governance pages read the directories kept above.