tenant-sharing | pH7x Systems®

What it observes

What the organisation permits, which every site inherits by default.

PowerShell

m365-governance collect tenant-sharing \
  --client-id <id> \
  --tenant-url https://<tenant>-admin.sharepoint.com \
  --output ./evidence/tenant.json


Mode	`TenantSharing`
Needs	`--tenant-url`. No `--site-url`
Profile	`tenant-sharing`
Produces findings	Yes

Why it is separate from `sharing`

Two levels, read together. A site that sets no default of its own inherits the tenant's, so a site level reading alone cannot tell you what a user will actually get.

SharePoint enforces that a site cannot be more permissive than the tenant, so both values are collected for context rather than for a rule about one exceeding the other. Such a rule could never fire, and shipping it would be shipping a check that passes by construction.

What it does not establish

That every site behaves this way. It establishes the ceiling and the default. What a particular site does within that ceiling is sharing.

Generated from the Engine's capability manifest at1.0.0b6@b4bf9c325233. No value on this panel is maintained by this site.

Answers: what the organisation permits, which every site inherits by default
Collector: PnP PowerShell · mode TenantSharing
Reads: Get-PnPTenant
Least privilege: not established
No source settles the least privilege for this collector, so the Engine states none. An invented permission would be worse than an admitted gap, because somebody would grant it.
Produces: sharepoint ·tenant
Proven against a tenant: live-validated

Rules that decide from it

SPO-SHARE-003The organisation default sharing link should not be Anyonedocumented-guidance
SPO-SHARE-004Anyone links should not be able to change what they opendocumented-guidance

Contracts it produces

Every collection writes evidence and an account of itself. The manifest publishes no narrower per-capability list, so this states what it does establish rather than guessing at more.