activity

What it observes

When a person last changed something on one site, and whether the site is in a state where nobody could.

m365-governance collect activity \
  --client-id <id> \
  --site-url https://<tenant>.sharepoint.com/sites/<site> \
  --tenant-url https://<tenant>-admin.sharepoint.com \
  --output ./evidence/activity.json

The one decision this collector exists for

It reads LastItemUserModifiedDate, not LastItemModifiedDate.

On a real tenant every site had been touched that same day by a system process, and two of three had gone over a year without a person. The naive property makes every site look alive. That difference is the whole reason the module exists, and it is why an inactivity finding from this engine is worth reading.

Why the lock state travels with the date

A site nobody has touched because it is locked is not the same as a site nobody wants. Collecting whether the site is in a state where nobody could change it keeps a rule from reporting enforced read only as abandonment.

What it does not establish

That the content is unwanted. A last human write date is a fact about writes. Whether anybody is reading, and whether the site still matters, is not observable from here.