permissions

What it observes

Every visible list on a site, hidden ones included, with item count and permission inheritance.

m365-governance collect permissions \
  --client-id <id> \
  --site-url https://<tenant>.sharepoint.com/sites/<site> \
  --output ./evidence/lists/

The expensive option

--count-unique-scopes walks the items of each list to count unique permission scopes. It is off by default because it reads every item of every list.

With it off, the count is reported as not-supported, and this is the whole design in one field:

• not-supported is the truth about this run. It says the number was not taken, not that it is zero.
• A rule that needs the number returns unknown.
• unknown is never rounded up to pass.

A collector that reported zero here would have produced a clean report from a cheap run, and the cheapness would have been invisible.

The rules that read this

SPO-LIST-001 and SPO-LIST-002 are both documented-limit: the 100,000 item threshold past which inheritance can no longer be broken, and the 50,000 unique scope ceiling. Those are limits Microsoft publishes, so exceeding them breaks rather than merely departing from advice.

What it does not establish

Who has access. Broken inheritance is a structural fact about a list. The resulting effective permissions are a different and much larger read.