30-second answer

Five commands, all offline, against evidence that ships with the package. No tenant, no app registration, no PowerShell.

PowerShell
pipx install m365-governance-as-code==1.0.0b6   # see Install: pipx first, then ensurepath
m365-governance doctor
m365-governance list-rules
m365-governance show-rule SPO-LIST-001
m365-governance evaluate --evidence <a-fixture.json>

Run these two before anything else

show-rule first. It prints the whole claim: the basis, the rationale behind the severity, the evidence the rule cannot decide without, the source, and how the rule can pass while the problem survives.

explain unknown second. The project rests on six words being different from each other, and the difference between "we could not read this" and "this is fine" is the whole of it.

PowerShell
m365-governance explain unknown

What list-rules tells you

Text
ID                VERSION  BASIS                SEVERITY  APPLIES TO  TITLE
SPO-LIST-002      v1.0     documented-limit     high      list        ...
SPO-SHARE-002     v1.0     documented-guidance  medium    site        ...

Strongest claim first. documented-limit is a boundary the product imposes; documented-guidance is advice the organisation may have decided against on purpose. See basis.

Evaluate

You need a file to point at. The packaged fixtures are here:

Bash
python -c "import m365_governance, pathlib; print(pathlib.Path(m365_governance.__file__).parent / 'data' / 'fixtures')"

sharepoint/list-over-limit.json under that directory is a good first one: it produces one failure and two unknown results, which is the report worth learning to read.

PowerShell
m365-governance evaluate --evidence <fixtures>/sharepoint/list-over-limit.json --format markdown

Read the report from the top: provenance, attention, then the line that says how many rules produced an answer. Two of three coming back unknown is not two thirds compliance.

How to read a report walks the whole document.

One file or a directory

A file gives one run. A directory gives a run set, even with one document in it, so a pipeline parsing the output does not change shape when a second document appears.

When you are ready for a real tenant

You need an Entra ID app registration and its client id, PowerShell 7 and PnP.PowerShell. Start with --dry-run, which prints the command and reaches no tenant:

PowerShell
m365-governance collect sites \
  --client-id <id> \
  --tenant-url https://<tenant>-admin.sharepoint.com \
  --output ./evidence/ \
  --dry-run

Then read what every collector guarantees before running it for real.