Knowledge Base articles
- What does a Conditional Access policy in report-only mode actually enforce?
My tenant has a Conditional Access policy requiring multifactor authentication. It is listed in the portal and it is on. Is it protecting anyone?
- Can Microsoft 365 licence optimization be proven from assignment and usage data alone?
I have 800 users and a licence bill. Can I prove which licences are safe to remove?
- Delegated vs application identity in Microsoft 365 evidence
Whose view of the tenant am I actually reading?
- What does a Microsoft 365 licence assignment actually give a user?
This person has an E3. What can they actually do, and what breaks if I take it away?
- What can Microsoft 365 usage reports actually establish about a user?
Nobody has used this licence in 90 days. Can I prove that?
- How to authenticate PnP.PowerShell with a ClientId
Why does Connect-PnPOnline demand a client id, and what do I register?
- Why does Connect-PnPOnline succeed when the next command returns Unauthorized?
My connection worked. Why does the very next cmdlet say unauthorized?
- PnP PowerShell app-only, certificate or client secret?
Can I use a client secret for unattended PnP PowerShell, or does it have to be a certificate?
- What application permission does PnP PowerShell need to read a SharePoint site?
Which application permission is enough for an unattended script to read a site?
- How to detect classic publishing features on a SharePoint site
Is the classic publishing infrastructure enabled here?
- How to detect a custom master page on a SharePoint site, correctly
Does this site use a master page other than the defaults?
- How to detect Microsoft 365 group-connected SharePoint sites
Is this site connected to a Microsoft 365 group?
- How to enumerate modern pages on a SharePoint site
How many pages of this site are modern, and how many are not?
- How to enumerate SPFx components used on SharePoint pages
Which client-side web parts are actually on the pages of this site?
- How to enumerate SPFx solutions in a SharePoint app catalog
What is installed in this app catalog, and at which versions?
- How to enumerate every site in a SharePoint tenant
What sites exist in this tenant, as far as I can see?
- How to find SharePoint lists with unique permissions
Which lists have broken role inheritance?
- How to get SharePoint site collection administrators
Who administers this SharePoint site?
- How to inspect the alternate CSS of a SharePoint site
Does this site load a custom stylesheet into every page?
- How to inspect locked and archived SharePoint sites
Can anybody change this site at all?
- How to inspect SharePoint site storage and quota
How full is this site, and how much may it grow?
- How to inventory SharePoint agents without pretending you saw the whole tenant
How many agents exist in my organisation, and how would I know?
- When did a person last change this SharePoint site?
When did a person, not a process, last change this site?
- How to read which sources a SharePoint agent was pointed at
Which sites and libraries does this agent actually reference?
- How to read what an Anyone link is allowed to do
Can somebody who was never asked to sign in change the file they opened?
- How to read the default sharing link type of a SharePoint site
What link does the Share button create by default on this site?
- How to read the sensitivity label and classification of a SharePoint site
What does this site record about the kind of content it holds?
- How to read the sharing capability of a SharePoint site
What kind of external sharing does this site permit?
- How to read the organisation default sharing link type
What link does the Share button create when a site has no default of its own?
- How to read who can use a SharePoint agent
I shared an agent with somebody. What did I just give them?
- Why can Get-PnPSiteCollectionAdmin return an empty list with an app-only identity?
My app-only script says a site has no administrators. The portal shows one. Which is right?
- Why does Get-PnPApp report no installed version in the tenant app catalog?
The tenant catalog lists my solutions but InstalledVersion is empty. Why?
- What does "custom script disabled" actually establish in SharePoint Online?
If a site blocks custom script, does that mean no interactive content can run on it?
- What does enabling the Microsoft 365 Brand Center actually publish?
If the brand center site is restricted, are the assets in it restricted too?
Field Guide, published by pH7x Systems
- Migration does not start with a tool
- Know your estate before you choose its future
- What decides the destination
- Making and defending a recommendation
- Building the business case
- Governance before technology
- Versions and lifecycle
- Verify what actually moved
- Cut over without losing the truth
- Decide every service application before the farm is built
- Decide every search dependency before the destination is built
- Decide what the structure becomes before the tooling is chosen
- Permissions
- Classify every site by its evidence of use before it joins a wave
- Inventory and decide every customisation
- Decide every SPFx package before its sites move
- Farm solutions that run with elevated privileges
- Decide every add-in before its model is retired
- Decide every workflow before the attach
- Decide every InfoPath form before it loses its host
- Choose the sign-in the new farm will accept
- Know every integration before it moves
- Upgrade to Subscription Edition by database attach
- Choose SharePoint Online site by site, with every blocker answered
- Keep hybrid only for named features, each with an owner and an exit date
- When not to migrate
- Archive before the first wave, somewhere that outlives the farm
- Decide when each classic site becomes modern, or why it stays classic
- Choose a route for each group of sites, and accept what it leaves behind
- Start the waves only on a readiness record that names what is not yet true
- Choose a pilot that can fail, and let what it measures change the plan
- Size each wave to the people who accept it, and write down what stops the next
- Accept each wave on criteria written before it, signed by the people who use it
- Switch off the old farm in an order you can stop at every step but the last
- Hand over every control with an owner, a reading and a review date
- Measure what changed, one fact at a time, before the project closes
- Write each lesson into what it changes, before the team disperses
- Keep Subscription Edition supported, one update at a time
Support independent engineering knowledge
Knowledge, Analysis, the Field Guide and the tools are free to read and use, and they stay that way. If something here saved you time, you can support the research, writing and tool maintenance behind it. Support is voluntary and unlocks nothing.
Buy me a coffee (opens in a new tab)João Lívio's page on buymeacoffee.com