What it observes

What one site permits, and its default link.

PowerShell
m365-governance collect sharing \
  --client-id <id> \
  --site-url https://<tenant>.sharepoint.com/sites/<site> \
  --tenant-url https://<tenant>-admin.sharepoint.com \
  --output ./evidence/sharing.json
ModeSiteSharing
Needs--site-url and --tenant-url
Profilesharing
Produces findingsYes

Why it needs the admin centre

Ask for this slice without --tenant-url and the command refuses with the reason rather than a generic error:

Text
collect sharing needs --tenant-url, the admin centre. Sharing settings are
a tenant property about a site.

That is the shape of the data, not a quirk of the tool. The setting lives at the tenant and is expressed about a site.

A fact collected because the one beside it is unreadable without it

anonymous_link_expiry_override is collected because the expiry number beside it cannot be interpreted without it. The site's expiry figure is governed by a Boolean override; with the override off, the number shown for the site is not the number in force.

Collecting the figure alone would have produced evidence that reads as a fact and is not one.

What it does not establish

What has actually been shared. This is configuration: what the site permits. Which links exist and who holds them is a different question and a different read.

What the Engine publishes

Generated from the Engine's capability manifest at1.0.0b6@b4bf9c325233. No value on this panel is maintained by this site.

Answers
what one site permits, and its default link
Collector
PnP PowerShell · mode SiteSharing
Reads
  • Get-PnPWeb
  • Get-PnPSite
  • Get-PnPTenantSite
Least privilege
not established

No source settles the least privilege for this collector, so the Engine states none. An invented permission would be worse than an admitted gap, because somebody would grant it.

Produces
sharepoint ·site
Proven against a tenant
live-validated

Rules that decide from it

  • SPO-SHARE-001A site that allows Anyone links permits access that cannot be attributedconvention
  • SPO-SHARE-002The default sharing link should not be Anyonedocumented-guidance
  • SPO-SHARE-005The default sharing link should not hand out editconvention

Contracts it produces

Every collection writes evidence and an account of itself. The manifest publishes no narrower per-capability list, so this states what it does establish rather than guessing at more.