run

30-second answer

m365-governance run

It plans, collects what the target can reach, evaluates the evidence and writes the report.

Why it exists

A tenant assessed end to end was ten collect commands and then an evaluate, and the person running them had to know what a slice is before obtaining a first result. Choosing among ten is a decision this engine can make from the target it was given, and asking somebody to make it before they have seen a single finding is asking them to learn the architecture in order to use the tool.

It says what it will not do, before it does anything

Plan: 10 of 11 collections

  run      sites            every site this identity can enumerate
  run      owners           who administers one site
  …

  not run  conditional-access  reads Microsoft Graph, and this engine never
                              acquires a token: set one to include it

  A collection that was not attempted is not a resource that is not
  there. Nothing below reads these, and no rule over the evidence
  can recover what they would have said.

Every collection appears with a verdict, including the ones that will not happen. A run that quietly skipped half its slices would produce a report that looks complete to the only person who could tell that it is not. It is the same reason unknown is never a pass.

The plan also refuses what this machine cannot do. Without PowerShell 7 it plans nothing and says so, rather than promising ten collections it would refuse a moment later.

--dry-run prints the plan and reaches no tenant.

A collection that fails does not end the run

Six of fifty-three sites refusing a collector is a fact about coverage, not a reason to produce nothing. Each collection carries its own manifest saying whether it was completed, partial, failed or cancelled, and the report is built over what was actually gathered.

What it does not do

It decides nothing a rule decides, it merges no evidence, and it does not make a slice apply to a target it does not apply to. Every step in it is a command that exists on its own: collect for the parts, evaluate for the reading, assess for a document somebody else can check.