30-second answer
A profile selects and parameterises rules. It never restates the meaning of
one. Omit --profile and you get the packaged default, which selects every
rule.
The nine shipped profiles
activity capacity classification default modernisation
ownership sharing spfx tenant-sharingEight of them pair with a collection slice, which is why collect prints the
pairing when it finishes:
Evaluate with: m365-governance evaluate --profile profiles/<slice>.yaml --evidence <output>Evaluating a collection against the wrong profile produces a wall of unknown
for facts nobody asked to be collected. That is not hypothetical: pointing the
sites slice at the ownership profile produced 106 unknown results across 53
sites, because sites gathers inventory and not owners.
The default profile has no rules: key, and that is the point
An absent selection means every rule.
The file used to enumerate them, and the enumeration went stale the first time a rule was added: two new rules were written, validated, tested, and then silently filtered out of every evaluation because nobody remembered to list them. The description said "every rule" while the file said two.
A profile that means everything says it by not choosing.
Why there are not more of them
A second profile is created when a concrete rule needs to differ, not before. Two profiles that are almost identical are two files nobody maintains, and the moment a rule is copied to give one profile a different weight, results stop being comparable and the basis gets reviewed twice in two places.
classification has no profile of its own for the same reason: the three
classification rules are the only ones that read that evidence, so a profile
naming them would repeat what the evidence already says.
What a profile may not do
Restate the meaning of a rule. Threshold and severity overrides are an open
decision in docs/ARCHITECTURE.md: a profile must be able to say "high, not
medium, here" without restating the rule, and the syntax for that is not
settled. Until it is, a profile selects.