How far each capability has been proved
Two questions are asked of every capability and neither answers the other. Live validation asks whether it reads and represents Microsoft 365 correctly. Product path assurance, below, asks whether evidence from it travelled the whole product path without gaining certainty on the way.
Operator
- 0End-to-end verified
- 10Partially verified
- 5Not yet verified
- End-to-end verified
- Evidence from this capability travelled the whole product path and an identified consumer opened the artefact it produced.
- Partially verified
- A real tenant was read and the evidence was produced. The rest of the path has not been verified for this capability.
- Not yet verified
- An acquisition was attempted and did not establish a positive read. What it did establish is recorded rather than rounded up.
Auditor
| Capability | acquisition | evidence | assessment | bundle | consumer |
|---|---|---|---|---|---|
activity | proven | proven | proven | not-attempted | not-attempted |
agents | proven | proven | not-applicable | not-attempted | not-attempted |
brand-center | not-attempted | not-attempted | not-attempted | not-attempted | not-attempted |
classification | proven | proven | proven | not-attempted | not-attempted |
conditional-access | attempted | not-attempted | not-attempted | not-attempted | not-attempted |
customization | not-attempted | not-attempted | not-attempted | not-attempted | not-attempted |
forwarding | not-attempted | not-attempted | not-attempted | not-attempted | not-attempted |
licensing | proven | proven | not-applicable | not-attempted | not-attempted |
modernity | proven | proven | proven | not-attempted | not-attempted |
owners | proven | proven | proven | not-attempted | not-attempted |
permissions | proven | proven | proven | not-attempted | not-attempted |
sharing | proven | proven | proven | not-attempted | not-attempted |
sites | proven | proven | not-attempted | not-attempted | not-attempted |
spfx | refused | not-attempted | not-attempted | not-attempted | not-attempted |
tenant-sharing | proven | proven | not-attempted | not-attempted | not-attempted |
Engineering
activity· when a person last changed something on one site- Product path
- positive-acquisition-observed
- Live validation
- full
- Permissions
- not-established
- Reads
- Get-PnPWeb · Get-PnPTenantSite
agents· the Copilot agents in one site, and the sources each declares- Product path
- positive-acquisition-observed
- Live validation
- full
- Permissions
- Sites.Read.All
- Reads
- Get-PnPWeb · Get-PnPCopilotAgent
brand-center· the organisation asset libraries a brand centre is built on, and the boundary its assets are published across- Product path
- not-live-tested
- Live validation
- none
- Permissions
- Sites.FullControl.All
- Reads
- Get-PnPOrgAssetsLibrary · Get-PnPTenantCdnEnabled -CdnType Public|Private · Get-PnPTenantCdnOrigin -CdnType Public|Private · Get-PnPTenantCdnPolicies -CdnType Public
classification· what a site records about the kind of content it holds- Product path
- positive-acquisition-observed
- Live validation
- full
- Permissions
- Sites.Read.All
- Reads
- Get-PnPWeb · Get-PnPSite
conditional-access· the Conditional Access policies, named locations and Security Defaults state of one tenant- Product path
- acquisition-attempted
- Live validation
- provider-only
- Permissions
- Policy.Read.All
- Reads
- GET /v1.0/identity/conditionalAccess/policies · GET /v1.0/identity/conditionalAccess/namedLocations · GET /v1.0/policies/identitySecurityDefaultsEnforcementPolicy
customization· the surfaces by which executable content or customization can reach a page on one site- Product path
- not-live-tested
- Live validation
- none
- Permissions
- Sites.Read.All
- Reads
- Get-PnPWeb -Includes EffectiveBasePermissions · Get-PnPFeature -Scope Web · Get-PnPList -Identity SitePages
forwarding· whether mail can leave this organisation automatically, and which of the three controls that govern it are in which position- Product path
- not-live-tested
- Live validation
- none
- Permissions
- Exchange.ManageAsApp
- Reads
- Get-HostedOutboundSpamFilterPolicy · Get-RemoteDomain
licensing· what is assigned in one tenant, and whether the usage reports are permitted to name the people who hold it- Product path
- positive-acquisition-observed
- Live validation
- partial
- Permissions
- Organization.Read.All, User.Read.All, Reports.Read.All, ReportSettings.Read.All
- Reads
- Get-MgSubscribedSku · Get-MgUser -Property assignedLicenses · GET /beta/admin/reportSettings · GET /v1.0/reports/getOffice365ActiveUserDetail
modernity· how one site is built: template, branding, publishing- Product path
- positive-acquisition-observed
- Live validation
- full
- Permissions
- Sites.Read.All
- Reads
- Get-PnPWeb · Get-PnPList · Get-PnPFeature · Get-PnPPage
owners· who administers one site- Product path
- positive-acquisition-observed
- Live validation
- full
- Permissions
- Sites.Read.All
- Reads
- Get-PnPWeb · Get-PnPSiteCollectionAdmin
permissions· every visible list on a site, and its inheritance- Product path
- positive-acquisition-observed
- Live validation
- full
- Permissions
- Sites.Read.All
- Reads
- Get-PnPList · Get-PnPListItem
sharing· what one site permits, and its default link- Product path
- positive-acquisition-observed
- Live validation
- full
- Permissions
- not-established
- Reads
- Get-PnPWeb · Get-PnPSite · Get-PnPTenantSite
sites· every site this identity can enumerate- Product path
- positive-acquisition-observed
- Live validation
- full
- Permissions
- not-established
- Reads
- Get-PnPTenantSite
spfx· a site's app catalog: which solutions lag their version- Product path
- acquisition-attempted
- Live validation
- negative-only
- Permissions
- Sites.Read.All
- Reads
- Get-PnPApp
tenant-sharing· what the organisation permits, which every site inherits by default- Product path
- positive-acquisition-observed
- Live validation
- full
- Permissions
- not-established
- Reads
- Get-PnPTenant
In scope today
A question is counted here only when the capability that supplies its evidence has read a real tenant. Implemented is not established: a collector proved only by offline tests has been proved to behave as somebody believed the API behaves, and a collector proved only by being refused has proved nothing about what it returns when it is permitted.
| Workload | Questions established |
|---|---|
sharepoint | 19 |
19 questions currently satisfy the publication criteria at 1.0.0b9@eea3c5e9aa95.
The number never appears without the criterion. A count detached from what it counts becomes a score, and a score is the one thing this product does not publish.
The publication criteria
A question appears above only when all of these hold. The page is derived from the evidence chain, so it is not possible to publish a question that does not satisfy them: this page is a check on the product, not a description of it.
- the rule declares its criteria, and the basis type is published;
- the evidence it requires is declared;
- the capability supplying that evidence has a positive live read against a real tenant;
- a denial, an unsupported surface or an absent licence does not collapse into an empty estate;
- the answer is reproducible from the evidence;
- the limitations are published, including what a pass leaves unresolved;
- a third party can verify the assessment without pH7x Systems;
- the sources the rule rests on are identified.
Criteria 1, 2, 3, 6 and 8 are read from the manifest for every question on this page. Criteria 4, 5 and 7 hold by construction and are proved by the Engine's own gates rather than re-checked here: stated so that nobody reads this list as eight independent measurements.
Implemented, and not counted
These exist in the product and are excluded from the number above. The reason is the Engine's own sentence, not ours.
brand-center: not live-validatedconditional-access: provider live-validated, slice not live-validatedcustomization: not live-validatedforwarding: not live-validatedlicensing: partially live-validated, assignment, report identifiability and one usage report were observed against a real directory; the report returned rows and named nobody, and dependency evidence is collected by nothingspfx: negative path validated, both scopes observed: a tenant catalog of ten solutions and a site catalog of one. No solution in either was behind its catalog version, so the finding branch has not been produced by a real catalogCA-RECOVERY-001: no capability with a proven live read supplies its evidenceCA-SCOPE-001: no capability with a proven live read supplies its evidenceCA-STATE-001: no capability with a proven live read supplies its evidenceEXO-FORWARD-001: no capability with a proven live read supplies its evidenceEXO-FORWARD-002: no capability with a proven live read supplies its evidenceSPO-SCRIPT-001: no capability with a proven live read supplies its evidenceSPO-SPFX-001: no capability with a proven live read supplies its evidence
Not covered
We publish no governance questions for these, and nothing here is a commitment to add them.
Exchange · Teams · Intune · Purview · Defender
How outcomes are worded
The Engine's contract values are the authority. This site translates them for reading and never redefines one; the table is published so a reader can always recover the value behind the wording.
| Contract value | Public wording |
|---|---|
pass | established |
fail | departure from the stated criteria |
unknown | could not be established |
not-applicable | not applicable |
invalid-evidence | evidence not usable |
Reading "could not be established"
This is not a failure. It means the available evidence does not support a conclusion.
A tool that answers it is refusing to invent an answer. On some collectors it is the most common outcome, and that is the product working: a run that returned green everywhere would be the result worth distrusting. It is also the answer with the most information in it, because it names what would have to be read to decide.
What is not established about continuity
Individual assessments are tamper-evident. Complete continuity across multiple assessments is not established.
A digest detects alteration. It does not detect omission: it proves a document was not changed, and it cannot prove that none was removed. Those are different guarantees, and the difference is stated here rather than left for somebody to discover.
Generated from capability-manifest/1.0.0 at 1.0.0b9@eea3c5e9aa95, contract 1.0.0b9. Every fact on this page is the Engine's; this site publishes it and does not maintain it.