Every rule
20 rules, each with the kind of claim it makes. A rule is here because it exists; whether the evidence behind it has been read from a real tenant is a different question, answered on what we can establish.
| Rule | Question | Basis | Severity |
|---|---|---|---|
SPO-ACTIVITY-001 | No person has changed anything on this site for over a year | convention | low |
SPO-CLASS-001 | This site carries no sensitivity label and no classification | documented-guidance | low |
SPO-CLASS-002 | This site carries a sensitivity label that could not be resolved to a name | convention | low |
SPO-CLASS-003 | This group-connected site carries no sensitivity label | convention | medium |
SPO-CLASS-004 | A classification string is doing a label's job | documented-guidance | low |
SPO-LIST-001 | A list or library past 100,000 items can no longer have its permission inheritance broken | documented-limit | medium |
SPO-LIST-002 | A list or library may not hold more than 50,000 unique permission scopes | documented-limit | high |
SPO-LIST-003 | A list or library above 5,000 unique permission scopes is past the recommended limit | documented-guidance | low |
SPO-MODERN-001 | The classic publishing infrastructure is enabled on this site | documented-guidance | low |
SPO-MODERN-003 | The site uses a master page other than the ones SharePoint provides | convention | low |
SPO-MODERN-004 | The site loads an alternate stylesheet into every page | convention | low |
SPO-SHARE-001 | A site that allows Anyone links permits access that cannot be attributed | convention | medium |
SPO-SHARE-002 | The default sharing link should not be Anyone | documented-guidance | medium |
SPO-SHARE-003 | The organisation default sharing link should not be Anyone | documented-guidance | medium |
SPO-SHARE-004 | Anyone links should not be able to change what they open | documented-guidance | medium |
SPO-SHARE-005 | The default sharing link should not hand out edit | convention | medium |
SPO-SITE-001 | A site should have at least two owners | convention | medium |
SPO-SITE-002 | A site should have at least one administrator who is a person | convention | low |
SPO-SITE-003 | A site above 90 per cent of its storage quota is close to stopping | convention | medium |
SPO-SPFX-001 | A solution is installed at an older version than the catalog holds | convention | low |
What each basis type claims
- requirement
- Microsoft requires it.
- documented-limit
- Microsoft documents a limit and this reads it.
- documented-guidance
- Microsoft recommends it; the alternative remains permitted.
- convention
- Ours. Microsoft publishes no position, and the rule says so.
Generated from capability-manifest/1.0.0 at1.0.0b6@b4bf9c325233, contract1.0.0b6. Every fact on this page is the Engine's; this site publishes it and does not maintain it.