Every rule
26 rules, each with the kind of claim it makes. A rule is here because it exists; whether the evidence behind it has been read from a real tenant is a different question, answered on what we can establish.
- 21SharePoint
- 3Identity
- 2Exchange
Showing all 26 rules
CA-RECOVERY-001A policy applying to everyone with nothing excluded has no way back in
A pass does not settle AN EXCLUSION IS NOT A RECOVERY PATH.
CA-SCOPE-001A policy scoped to all users does not cover workload identities
A pass does not settle A PASS HERE IS NARROW AND SAYS ALMOST NOTHING.
CA-STATE-001The policy is in report-only mode and enforces nothing
A pass does not settle A POLICY THAT IS NOT REPORT-ONLY MAY STILL ENFORCE NOTHING.
EXO-FORWARD-001Automatic forwarding is set to a value whose behaviour is not in the value
A pass does not settle A PASS SAYS THE VALUE IS READABLE AND NOT THAT MAIL CANNOT LEAVE.
EXO-FORWARD-002A remote domain permits automatic forwarding
A pass does not settle A PASS DOES NOT MEAN MAIL CANNOT LEAVE AUTOMATICALLY.
SPO-ACTIVITY-001No person has changed anything on this site for over a year
A pass does not settle Somebody correcting one typo resets this to zero.
SPO-CLASS-001This site carries no sensitivity label and no classification
A pass does not settle Any label passes.
SPO-CLASS-002This site carries a sensitivity label that could not be resolved to a name
A pass does not settle A resolved name passes, and a name is a word.
SPO-CLASS-003This group-connected site carries no sensitivity label
A pass does not settle Any label passes, including one configured to set nothing.
SPO-CLASS-004A classification string is doing a label's job
A pass does not settle Any label passes.
SPO-LIST-001A list or library past 100,000 items can no longer have its permission inheritance broken
A pass does not settle A list holding 99,000 items and growing passes this rule today and loses the ability permanently within weeks, without anything in the report changing to warn about it.
SPO-LIST-002A list or library may not hold more than 50,000 unique permission scopes
A pass does not settle A list at 49,000 scopes passes and is one sharing operation away from the ceiling, and a list at 6,000 passes this rule while sitting well above the number Microsoft recommends for performance.
SPO-LIST-003A list or library above 5,000 unique permission scopes is past the recommended limit
A pass does not settle A list at 4,999 scopes passes, and if its access control lists are large it may already be slower than a list at 8,000 with small ones.
SPO-MODERN-001The classic publishing infrastructure is enabled on this site
A pass does not settle A site that never had the publishing feature can still be entirely classic: classic pages, classic web parts, and a custom master page all exist without it.
SPO-MODERN-003The site uses a master page other than the ones SharePoint provides
A pass does not settle A site on seattle.master can be as classic as any other: classic pages, classic web parts, alternate CSS and script editor web parts all survive a default master page.
SPO-MODERN-004The site loads an alternate stylesheet into every page
A pass does not settle An empty setting says nothing about how the site is styled.
SPO-SCRIPT-001The site permits custom script
A pass does not settle BLOCKED IS NOT INERT, AND THIS IS THE MISREADING THE CONTROL INVITES.
SPO-SHARE-001A site that allows Anyone links permits access that cannot be attributed
A pass does not settle A site with Anyone links turned off today may hold documents shared that way last year, and those links keep working.
SPO-SHARE-002The default sharing link should not be Anyone
A pass does not settle A default of Specific people means nothing about what people actually choose.
SPO-SHARE-003The organisation default sharing link should not be Anyone
A pass does not settle A safe organisation default says nothing about individual sites.
SPO-SHARE-004Anyone links should not be able to change what they open
A pass does not settle View-only is still unauthenticated read.
SPO-SHARE-005The default sharing link should not hand out edit
A pass does not settle A view default stops nobody from choosing edit on purpose.
SPO-SITE-001A site should have at least two owners
A pass does not settle Two owners who are dormant, who have left, or who do not know they own the site satisfy this rule completely.
SPO-SITE-002A site should have at least one administrator who is a person
A pass does not settle One named administrator who has left the organisation, changed role, or never knew they were named satisfies this rule completely.
SPO-SITE-003A site above 90 per cent of its storage quota is close to stopping
A pass does not settle A site at 40 per cent that doubles every month passes this rule twice before it fails it.
SPO-SPFX-001A solution is installed at an older version than the catalog holds
A pass does not settle A catalog where every solution is current says nothing about whether any of them still works, is maintained by anybody, or should be there at all.
What each basis type claims
- requirement
- Microsoft requires it.
- documented-limit
- Microsoft documents a limit and this reads it.
- documented-guidance
- Microsoft recommends it; the alternative remains permitted.
- convention
- Ours. Microsoft publishes no position, and the rule says so.
Generated from capability-manifest/1.0.0 at 1.0.0b9@eea3c5e9aa95, contract 1.0.0b9. Every fact on this page is the Engine's; this site publishes it and does not maintain it.
SPO-LIST-001fail
A list or library past 100,000 items can no longer have its permission inheritance broken
- items.count
- 148000
- permissions.inheritance_broken
- false
Basis
documented-limit
Conclusion
The list holds 148000 items, above Microsoft's documented limit of 100,000, and still inherits its permissions. Inheritance can no longer be broken on this list, so it cannot be given unique permissions later.
A pass would not have settled
A list holding 99,000 items and growing passes this rule today and loses the ability permanently within weeks, without anything in the report changing to warn about it. The rule measures a position, not a trajectory, and the boundary it describes is the one place where being close to a limit matters more than being past it: once crossed, the option does not come back. Every pass here means "not yet", never "safe".
A rule result explained, read in full
A rule result explained
Produced by the Engine at revision eea3c5e9, from the fixture list-over-limit.json. Nothing on this page is typed by hand: change the fixture and this section changes with it.
What was checked
- Resource
contoso,list,archive(list)- Rule
SPO-LIST-001v2.0- Question
- A list or library past 100,000 items can no longer have its permission inheritance broken
- Schema
- 1.0
What the Engine observed
items.countobserved148000permissions.inheritance_brokenobservedfalse
Coverage requested items, permissions; completed items, permissions; nothing was unavailable.
What the Engine concluded
fail
The list holds 148000 items, above Microsoft's documented limit of 100,000, and still inherits its permissions. Inheritance can no longer be broken on this list, so it cannot be given unique permissions later.
The Engine's own words, in English
Basis: documented-limit, a boundary the product imposes, which is why this can be stated as a fact rather than a preference. Severity medium is how much it matters, not how much attention it deserves; they are different questions.
The full reading: how it was established, what it does not prove, and what to do next
What this does not prove
A list holding 99,000 items and growing passes this rule today and loses the ability permanently within weeks, without anything in the report changing to warn about it. The rule measures a position, not a trajectory, and the boundary it describes is the one place where being close to a limit matters more than being past it: once crossed, the option does not come back. Every pass here means "not yet", never "safe".
The Engine's own words, in English
What you can do next
Microsoft's guidance is preventive, not corrective: "share large folders before they hit 100,000 items". For a container already past the limit, reducing the count does not restore the ability in every case, and the supported route is to restructure the content across containers that stay below it. Decide whether this container will ever need unique permissions before restructuring, because if the answer is no, no action is required.
The Engine's own words, in English
What this example represents
- Collected
- 2026-08-05T14:02:11Z
- Collector
- spo-collector 0.1.0
- Source
- SharePoint Online · PnP.PowerShell / CSOM
- Identity
- application, scopes Sites.Read.All
- Tenant
- contoso.sharepoint.com
A fixture that ships with the Engine, not a tenant that was read. The host, the timestamp and the identity below belong to the simulated document. What is real is the result: the Engine produced it from this evidence, at the revision above.
Where it lives in an Assessment
Assessment
├── canonical
│ ├── manifest
│ ├── RunSet ← the Run above is one of these
│ ├── evidence
│ ├── versions
│ └── hashes
└── derived
└── reportsCanonical content is archived and verified; reports are regenerated from it. The assessment_id derives from the canonical digests, so an Assessment that changed is a different Assessment. A Comparison references two of them and never embeds or mutates either.
- Evidencewhat the collector observed
- Rulethe versioned statement that interprets specific evidence paths
- Resultone rule applied to one resource
- Runall applicable rule results for one resource
- RunSetthe tenant-scale collection of runs
- Assessmentthe verifiable package a customer archives, opens and compares
A result is not an Assessment. It is one conclusion inside one Run, inside a RunSet carried by an Assessment.
The result as the Engine wrote it
{
"rule_id": "SPO-LIST-001",
"title": "A list or library past 100,000 items can no longer have its permission inheritance broken",
"rule_version": "2.0",
"schema_version": "1.0",
"resource": {
"workload": "sharepoint",
"type": "list",
"native_id": "contoso,list,archive"
},
"outcome": "fail",
"message": "The list holds 148000 items, above Microsoft's documented limit of 100,000, and still inherits its permissions. Inheritance can no longer be broken on this list, so it cannot be given unique permissions later.",
"basis": "documented-limit",
"severity": "medium",
"evidence_used": [
{
"path": "items.count",
"state": "observed",
"value": 148000,
"lower_bound": null,
"upper_bound": null,
"detail": null
},
{
"path": "permissions.inheritance_broken",
"state": "observed",
"value": false,
"lower_bound": null,
"upper_bound": null,
"detail": null
}
],
"passes_without_resolving": "A list holding 99,000 items and growing passes this rule today and loses the ability permanently within weeks, without anything in the report changing to warn about it. The rule measures a position, not a trajectory, and the boundary it describes is the one place where being close to a limit matters more than being past it: once crossed, the option does not come back. Every pass here means \"not yet\", never \"safe\".",
"sources": [
{
"url": "https://learn.microsoft.com/office365/servicedescriptions/sharepoint-online-service-description/sharepoint-online-limits",
"title": "SharePoint limits, Items in lists and libraries",
"publisher": "Microsoft",
"checked_at": "2026-08-05"
},
{
"url": "https://learn.microsoft.com/sharepoint/manage-permission-scope",
"title": "Manage Permission Scopes in SharePoint",
"publisher": "Microsoft",
"checked_at": "2026-08-05"
}
],
"remediation": "Microsoft's guidance is preventive, not corrective: \"share large folders before they hit 100,000 items\". For a container already past the limit, reducing the count does not restore the ability in every case, and the supported route is to restructure the content across containers that stay below it. Decide whether this container will ever need unique permissions before restructuring, because if the answer is no, no action is required.",
"message_degraded": false,
"engine_detail": "",
"attention": {
"state": "act",
"rank": 0,
"because": [
"the rule failed against a documented-limit, which the vendor documents"
]
}
}