sites

What it observes

Every site this identity can enumerate. One evidence document per site.

m365-governance collect sites \
  --client-id <id> \
  --tenant-url https://<tenant>-admin.sharepoint.com \
  --output ./evidence/

The facts

Template, lock state, storage used and quota, and when content was last modified.

The limit that shapes this collector

Everything here comes off the enumeration path, which Microsoft documents as not populating twenty two named site properties. Every property this collector maps is chosen from outside that list.

That is a deliberate constraint rather than an accident of what was easy. A property the enumeration path leaves empty would be collected as a real value and be wrong, and nothing downstream could tell. The audit that established which properties are safe is docs/COLLECTION-PATH-AUDIT.md in the repository; storage figures agreed with the identity path on all five sandbox sites, which is what confirmed the mapping.

What it does not establish

The scope of the word "enumerate". A site absent from this inventory is a site this identity could not see, not a site that does not exist. Reading the absence as non existence is how a governance report understates an estate.