30-second answer

explain prints what an outcome means and, as the help text puts it, what it does not. It reads nothing and needs no evidence.

PowerShell
m365-governance explain [-h] OUTCOME

OUTCOME is one of pass, fail, unknown, not-applicable, invalid-evidence, error, or all.

Why the engine ships this

The six outcomes are not severities and they are not degrees of the same thing. They answer different questions:

  • pass and fail are claims about the resource.
  • not-applicable says the rule had nothing to say here.
  • unknown says the engine could not tell, which is a result and not a failure. It is never rounded up to pass.
  • invalid-evidence says the document did not match its schema, which is a defect in the collector rather than a fact about the resource.
  • error says the engine itself failed.

Reading a governance report without that distinction is how unknown gets counted as compliance. The command exists so nobody has to take the distinction on faith.

Where to go deeper

Unknown versus invalid evidence and outcome, severity and attention in Core Concepts.

Exit codes

0.