evaluate

30-second answer

evaluate runs rules against an evidence document and renders a report. It is the command for reading a result yourself. When somebody else has to check the result without this engine, use assess.

m365-governance evaluate [-h] [--rules RULES] --evidence EVIDENCE
                         [--profile PROFILE]
                         [--format {markdown,json,html}]
                         [--fail-on {never,fail,unresolved}]

One file or a directory, and why the shape is fixed

Point --evidence at a file and you get one run. Point it at a directory and you get a run set, even if the directory holds exactly one document.

That is deliberate. A directory with one document today and three tomorrow must not change the shape of what a pipeline parses. The set is built once, before any format sees it, which is also where two documents about the same resource are refused rather than quietly merged.

Options

--rules is a directory of rule files. Omit it to use the rules that shipped with this version. Supplying one replaces the packaged rules entirely rather than adding to them.

--profile is a profile file. Omit it to use the packaged default, which selects every rule.

--format is markdown, json or html. The three are renderings of the same run and agree with each other; none of them is a summary of another.

--fail-on decides whether a negative result is an error for the caller. never is the default. fail exits non-zero when any rule failed. unresolved also counts unknown, invalid-evidence and error.

unresolved is the setting for a pipeline that must not pass on evidence it could not read. It treats "we could not tell" as something a human still owes an answer to, rather than as a pass.

What a report opens with

Provenance first, then attention, then the findings:

# Governance report: App Packages

- Resource: `<unknown>` (list)
- Collected: 2026-08-05T14:02:11Z by `spo-collector` 0.1.0
- Source: SharePoint Online via PnP.PowerShell / CSOM
- Rules: shipped with this version
- Identity: application, scopes: Sites.Read.All

## Attention

**Something here is outside what the vendor documents.**

Rules: shipped with this version is the line that tells a reader the report was produced against the packaged rules and not a local directory somebody edited.

Exit codes

0 ran, and either nothing was negative or --fail-on did not ask. 1 ran, and --fail-on was met. 2 refused: the evidence did not match the schema, which is a defect in the collector rather than a finding about the resource.