What it observes

Who administers one site.

PowerShell
m365-governance collect owners \
  --client-id <id> \
  --site-url https://<tenant>.sharepoint.com/sites/<site> \
  --output ./evidence/owners.json
ModeSiteOwners
Needs--site-url
Profileownership
Produces findingsYes

The limit, and why it is stated rather than worked around

Group expansion is not attempted. A group owner is one principal and may be forty people.

So the evidence carries expansion_complete = false and a minimum_count rather than a count it cannot prove. A rule about "at least two administrators" reads that as a lower bound and answers accordingly, which may be unknown where a naive count would have said pass.

Why this is the right behaviour, and how a bound differs from a number, is in incomplete evidence and lower bounds.

When the read fails

The collector returns an absent fact with a resolved state and the underlying message, rather than an empty list. An empty owners list and an owners list that could not be read are different facts, and only one of them is a governance problem.

What the Engine publishes

Generated from the Engine's capability manifest at1.0.0b6@b4bf9c325233. No value on this panel is maintained by this site.

Answers
who administers one site
Collector
PnP PowerShell · mode SiteOwners
Reads
  • Get-PnPWeb
  • Get-PnPSiteCollectionAdmin
Least privilege
not established

No source settles the least privilege for this collector, so the Engine states none. An invented permission would be worse than an admitted gap, because somebody would grant it.

Produces
sharepoint ·site
Proven against a tenant
live-validated

Rules that decide from it

  • SPO-SITE-001A site should have at least two ownersconvention
  • SPO-SITE-002A site should have at least one administrator who is a personconvention

Contracts it produces

Every collection writes evidence and an account of itself. The manifest publishes no narrower per-capability list, so this states what it does establish rather than guessing at more.