stats

30-second answer

stats reads an evidence document and reports what it contains and what it covers. It evaluates nothing. Use it between collecting and evaluating, because a report over partial evidence reads exactly like a report over complete evidence unless somebody checks.

m365-governance stats [-h] evidence

What it prints

Run against a shipped fixture:

EVIDENCE
  resource          <unknown>
  type              list
  collected         2026-08-05T14:02:11Z
  collector         spo-collector 0.1.0
  identity          application
  acquisition       collected

COVERAGE
  requested         2  items, permissions
  completed         2  items, permissions

The two halves answer different questions.

EVIDENCE is provenance: when it was collected, what collected it, under what kind of identity, and whether it was observed or is a fixture. A finding without that is an opinion with formatting.

COVERAGE is the honest part. requested is what the collector set out to see; completed is what it finished. When those two differ, conclusions drawn from the gap are bounded rather than exact, and the engine will say so rather than rounding up.

Why it is a separate command

Reading the evidence and deciding what it means are separate acts, and keeping them separate is what lets you inspect the first before accepting the second. An engine that only ever showed you conclusions would be asking to be trusted.

Exit codes

0 in all cases where the document could be read.