tenant-sharing

What it observes

What the organisation permits, which every site inherits by default.

m365-governance collect tenant-sharing \
  --client-id <id> \
  --tenant-url https://<tenant>-admin.sharepoint.com \
  --output ./evidence/tenant.json

Why it is separate from sharing

Two levels, read together. A site that sets no default of its own inherits the tenant's, so a site level reading alone cannot tell you what a user will actually get.

SharePoint enforces that a site cannot be more permissive than the tenant, so both values are collected for context rather than for a rule about one exceeding the other. Such a rule could never fire, and shipping it would be shipping a check that passes by construction.

Microsoft publishes two representations of these settings

The organisation's sharing settings exist behind two separately versioned administration surfaces, and this collector reads one of them:

Both carry the sharing capability, the domain restriction mode, the allowed and blocked domain lists, and whether external users may reshare.

Two API families maintained separately, describing one organisation. That makes a genuine comparison possible, and it has to be made on the claims both surfaces actually establish, never on the union of their fields. A property present in one and absent from the other is not a disagreement.

The comparison has not been made, and the reason is nameable rather than vague: SharePointTenantSettings.Read.All has not been granted to the identity that runs these reads. That is not observable with current authority, and it is a different statement from there is no second source.

What it does not establish

That every site behaves this way. It establishes the ceiling and the default. What a particular site does within that ceiling is sharing.