Explore the technical library.
Search the published questions or choose a subject. Every answer explains what the evidence establishes and where it stops.
34 answers
- Conditional Access and sign-inWhat does a Conditional Access policy in report-only mode actually enforce?Read the answer
- Inactive and archived sitesHow to inspect locked and archived SharePoint sitesRead the answer
- Inactive and archived sitesWhen did a person last change this SharePoint site?Read the answer
- Copilot agentsHow to inventory SharePoint agents without pretending you saw the whole tenantRead the answer
- Copilot agentsHow to read which sources a SharePoint agent was pointed atRead the answer
- Copilot agentsHow to read who can use a SharePoint agentRead the answer
- Sensitivity labelsHow to detect Microsoft 365 group-connected SharePoint sitesRead the answer
- Sensitivity labelsHow to read the sensitivity label and classification of a SharePoint siteRead the answer
- Licences and what they cost to proveCan Microsoft 365 licence optimization be proven from assignment and usage data alone?Read the answer
- Licences and what they cost to proveWhat does a Microsoft 365 licence assignment actually give a user?Read the answer
- Licences and what they cost to proveWhat can Microsoft 365 usage reports actually establish about a user?Read the answer
- PermissionsHow to find SharePoint lists with unique permissionsRead the answer
- Classic and modern sitesHow to detect classic publishing features on a SharePoint siteRead the answer
- Classic and modern sitesHow to detect a custom master page on a SharePoint site, correctlyRead the answer
- Classic and modern sitesHow to enumerate modern pages on a SharePoint siteRead the answer
- Classic and modern sitesHow to inspect the alternate CSS of a SharePoint siteRead the answer
- Classic and modern sitesWhat does enabling the Microsoft 365 Brand Center actually publish?Read the answer
- Connecting and identityDelegated vs application identity in Microsoft 365 evidenceRead the answer
- Connecting and identityHow to authenticate PnP.PowerShell with a ClientIdRead the answer
- Connecting and identityWhy does Connect-PnPOnline succeed when the next command returns Unauthorized?Read the answer
- Connecting and identityPnP PowerShell app-only, certificate or client secret?Read the answer
- Connecting and identityWhat application permission does PnP PowerShell need to read a SharePoint site?Read the answer
- Connecting and identityWhy can Get-PnPSiteCollectionAdmin return an empty list with an app-only identity?Read the answer
- Custom scriptWhat does "custom script disabled" actually establish in SharePoint Online?Read the answer
- Sharing and external accessHow to read what an Anyone link is allowed to doRead the answer
- Sharing and external accessHow to read the default sharing link type of a SharePoint siteRead the answer
- Sharing and external accessHow to read the sharing capability of a SharePoint siteRead the answer
- Sharing and external accessHow to read the organisation default sharing link typeRead the answer
- Sites, owners and storageHow to enumerate every site in a SharePoint tenantRead the answer
- Sites, owners and storageHow to get SharePoint site collection administratorsRead the answer
- Sites, owners and storageHow to inspect SharePoint site storage and quotaRead the answer
- SPFx and custom codeHow to enumerate SPFx components used on SharePoint pagesRead the answer
- SPFx and custom codeHow to enumerate SPFx solutions in a SharePoint app catalogRead the answer
- SPFx and custom codeWhy does Get-PnPApp report no installed version in the tenant app catalog?Read the answer
No matching answers. Try another term or choose all subjects.
What Governance as Code is
Governance as Code means the judgement is a file, not an opinion. A rule states what it requires and on what basis it requires it. A collector observes the tenant read-only and preserves what it saw, when, and under which identity. An Assessment carries the conclusion together with the material needed to check it.
This Knowledge explains how each of those judgements was established. It is not a second rule engine, and it never evaluates a tenant: it documents the evidence path that the Engine already publishes.
Where to begin
Three entry paths. They are ordered by what you arrived to do, not by where an article sits in the tree.
I need the command
Go straight to the workload. Each article opens with the exact command, the output it returns, and the reading of that output, before any explanation.
Enumerate every site in a tenant →I need to trust the result
Start with provenance. What must travel with a finding, why identity kind is not a detail, and why a count can be a lower bound rather than a number.
How provenance changes a finding →I am deciding whether to adopt this
Read the engine's own contract: what a rule may claim, which bases are normative, and what an Assessment declares about itself.
Governance as Code →What is covered
Each area is as deep as its verified paths, and no deeper. The full list of articles opens from Browse this section.
Governance as Code
What report-only mode enforces
34 answers
What Knowledge is, and is not
Knowledge owns verified answers about Microsoft 365, written as if this product did not exist. It is the only place on this site that does.
What does not belong here, and where each lives instead:
- The product itself Microsoft 365 Governance as Code · Product
- How the product works Documentation · Product
- A migration method Field Guide · Practice
- Engineering arguments and lessons Analysis · Practice
Recently verified
When the evidence path was last confirmed against a live tenant, not when the text was last edited.
- Can Microsoft 365 licence optimization be proven from assignment and usage data alone?
- What does a Conditional Access policy in report-only mode actually enforce?
- What does "custom script disabled" actually establish in SharePoint Online?
- What does a Microsoft 365 licence assignment actually give a user?
- What can Microsoft 365 usage reports actually establish about a user?
- How to inventory SharePoint agents without pretending you saw the whole tenant
When an article is not enough
An article answers one question against one evidence path. These do not.
Field Guide
A chapter, not an answer. Where a decision has to be taken across a whole tenant and the trade-offs matter more than the command.
SharePoint Compass
Advisory. You answer questions about your own environment and it gives an indicative reading. It collects nothing and produces no finding.
The Engine
The only thing here that observes a tenant, evaluates rules and produces an Assessment. Everything else explains it.