What this is, exactly
An assessment built from the fixtures the engine ships. There is no tenant behind it and no credential was involved: `contoso.sharepoint.com` is invented, and the findings are the ones those fixtures produce. It is here so that what arrives is a document you have read rather than a description you were given.
The report
Rendered by the engine, not written here. Read the second line before the table: it says what the run does not establish.
# Governance report
- 3 resources observed
by kind of resource, which is not an outcome:
content 1
kind not established (`unknown`) 2
> **Run coverage: not established.** 3 resources are stored. The total number the identity was expected to reach was not recorded, so this run does not establish complete coverage.
> **Identity: delegated.** These runs saw what one person sees. Nothing here may be read as a tenant-wide statement.
## Summary
4 rule evaluations across 3 resources.
| Outcome | Count |
|---|---|
| Fail | 0 |
| Unknown | 2 |
| Pass | 2 |
| Not applicable | 0 |
Undecided is not compliance: missing evidence is a fact about collection, not about the resource.
## Findings
### Documents · kind: content
- **Unknown** · SPO-LIST-002 v1.0 · documented-limit
The scope count does not settle this list's position relative to the 50,000 limit: either it was not counted, or counting stopped before it could. The evidence beside this finding says which. This is not a pass.
- **Unknown** · SPO-LIST-003 v1.0 · documented-guidance
The scope count does not settle this list's position relative to the recommended 5,000: either it was not counted, or counting stopped before it could. The evidence beside this finding says which. This is not a pass.
Checking it without us
The assessment carries the evidence it was decided from and a digest over all of it. Anyone you send it to can confirm nothing moved, with software that is open source and needs no licence, no account and no contact with us.
m365-governance verify assessment.json0fbfcae4b66a8fd69e0454dcd94447c87474e150542f663dd0936d22198d85e0
tenant contoso.sharepoint.com
identity multiple: application, delegated
acquired collected
created 2026-08-08T18:00:00Z
resources 3
evidence 3 documents
That is the property the method rests on, and it is why an assessment is worth showing to somebody who does not trust you yet.
The assessment itself
The document, as JSON, exactly as it would be handed over: the runs, the evidence they were decided from, the versions that decided them, and the digests.
{
"$schema": "https://ph7x.com/schemas/m365-governance/assessment/4.1.0",
"canonical": {
"run_set": {
"$schema": "https://ph7x.com/schemas/m365-governance/run-set/4.1.0",
"resources": 3,
"by_class": {
"content": 1,
"unknown": 2
},
"set_aside": 0,
"counts": {
"pass": 2,
"fail": 0,
"unknown": 2,
"not-applicable": 0,
"invalid-evidence": 0,
"error": 0
},
"run_coverage": {
"state": "not-established",
"observed": 3,
"expected": null,
"detail": "3 resources are stored. The total number the identity was expected to reach was not recorded, so this run does not establish complete coverage."
},
"runs": [
{
"$schema": "https://ph7x.com/schemas/m365-governance/run/4.1.0",
"provenance": {
"collected_at": "2026-08-05T14:02:11Z",
"collector": "spo-collector",
"collector_version": "0.1.0",
"source_system": "SharePoint Online",
"source_api": "PnP.PowerShell / CSOM",
"tenant": {
"id": null,
"host": "contoso.sharepoint.com",
"how": "requested"
},
"identity_kind": "application",
"acquisition": "collected",
"scopes": [
"Sites.Read.All"
]
},
"coverage": {
"requested": [
"items",
"permissions"
],
"completed": [
"items",
"permissions"
],
"unavailable": {}
},
"resource": {
"workload": "sharepoint",
"type": "list",
"native_id": "contoso,list,documents-c",
"tenant": {
"id": null,
"host": "contoso.sharepoint.com"
},
"scope": "container",
"parent": {
"workload": "sharepoint",
"type": "site",
"native_id": "contoso,site,documents-host"
},
"display_name": "Documents",
"url": "https://contoso.sharepoint.com/sites/Finance/Shared%20Documents"
},
"resource_class": "content",
"class_reason": "the product marks it as none of catalog, system or application",
"set_aside": false,
"rule_source": "shipped with this version",
"counts": {
"pass": 1,
"fail": 0,
"unknown": 2,
"not-applicable": 0,
"invalid-evidence": 0,
"error": 0
},
"results": [
{
"rule_id": "SPO-LIST-001",
"title": "A list or library past 100,000 items can no longer have its permission inheritance broken",
"rule_version": "2.0",
"schema_version": "1.0",
"resource": {
"workload": "sharepoint",
"type": "list",
"native_id": "contoso,list,documents-c"
},
"outcome": "pass",
"message": "The list holds 4200 items and inherits its permissions, within the 100,000 boundary at which inheritance can no longer be broken.",
"basis": "documented-limit",
"severity": "medium",
"evidence_used": [
{
"path": "items.count",
"state": "observed",
"value": 4200,
"lower_bound": null,
"upper_bound": null,
"detail": null
},
{
"path": "permissions.inheritance_broken",
"state": "observed",
"value": false,
"lower_bound": null,
"upper_bound": null,
"detail": null
}
],
"passes_without_resolving": "A list holding 99,000 items and growing passes this rule today and loses the ability permanently within weeks, without anything in the report changing to warn about it. The rule measures a position, not a trajectory, and the boundary it describes is the one place where being close to a limit matters more than being past it: once crossed, the option does not come back. Every pass here means \"not yet\", never \"safe\".",
"sources": [
{
"url": "https://learn.microsoft.com/office365/servicedescriptions/sharepoint-online-service-description/sharepoint-online-limits",
"title": "SharePoint limits, Items in lists and libraries",
"publisher": "Microsoft",
"checked_at": "2026-08-05"
},
{
"url": "https://learn.microsoft.com/sharepoint/manage-permission-scope",
"title": "Manage Permission Scopes in SharePoint",
"publisher": "Microsoft",
"checked_at": "2026-08-05"
}
],
"remediation": "Microsoft's guidance is preventive, not corrective: \"share large folders before they hit 100,000 items\". For a container already past the limit, reducing the count does not restore the ability in every case, and the supported route is to restructure the content across containers that stay below it. Decide whether this container will ever need unique permissions before restructuring, because if the answer is no, no action is required.",
"message_degraded": false,
"engine_detail": "",
"attention": {
"state": "review",
"rank": 4,
"because": [
"it passed, and the rule records something the pass does not settle"
]
}
},
{
"rule_id": "SPO-LIST-002",
"title": "A list or library may not hold more than 50,000 unique permission scopes",
"rule_version": "1.0",
"schema_version": "1.0",
"resource": {
"workload": "sharepoint",
"type": "list",
"native_id": "contoso,list,documents-c"
},
"outcome": "unknown",
"message": "The scope count does not settle this list's position relative to the 50,000 limit: either it was not counted, or counting stopped before it could. The evidence beside this finding says which. This is not a pass.",
"basis": "documented-limit",
"severity": "high",
"evidence_used": [
{
"path": "permissions.unique_scope_count",
"state": "missing",
"value": null,
"lower_bound": null,
"upper_bound": null,
"detail": "not present in the evidence"
}
],
"passes_without_resolving": "A list at 49,000 scopes passes and is one sharing operation away from the ceiling, and a list at 6,000 passes this rule while sitting well above the number Microsoft recommends for performance. This rule measures only the supported ceiling, and passing it says nothing about whether the list is usable.",
"sources": [
{
"url": "https://learn.microsoft.com/office365/servicedescriptions/sharepoint-online-service-description/sharepoint-online-limits",
"title": "SharePoint limits, Unique security scopes per list or library",
"publisher": "Microsoft",
"checked_at": "2026-08-06"
},
{
"url": "https://learn.microsoft.com/sharepoint/manage-permission-scope",
"title": "Manage Permission Scopes in SharePoint",
"publisher": "Microsoft",
"checked_at": "2026-08-06"
}
],
"remediation": "Restructure the content so that fewer containers carry their own permissions. A folder shared with three people is one scope; three files shared individually are three. Where a list has grown past the ceiling, the supported route is to split the content across containers rather than to remove permissions one by one, which is slow and rarely finishes.",
"message_degraded": false,
"engine_detail": "",
"attention": {
"state": "observe",
"rank": 3,
"because": [
"the evidence needed to decide this was not available"
]
}
},
{
"rule_id": "SPO-LIST-003",
"title": "A list or library above 5,000 unique permission scopes is past the recommended limit",
"rule_version": "1.0",
"schema_version": "1.0",
"resource": {
"workload": "sharepoint",
"type": "list",
"native_id": "contoso,list,documents-c"
},
"outcome": "unknown",
"message": "The scope count does not settle this list's position relative to the recommended 5,000: either it was not counted, or counting stopped before it could. The evidence beside this finding says which. This is not a pass.",
"basis": "documented-guidance",
"severity": "low",
"evidence_used": [
{
"path": "permissions.unique_scope_count",
"state": "missing",
"value": null,
"lower_bound": null,
"upper_bound": null,
"detail": "not present in the evidence"
}
],
"passes_without_resolving": "A list at 4,999 scopes passes, and if its access control lists are large it may already be slower than a list at 8,000 with small ones. Microsoft says so explicitly. The count is a proxy for a cost this rule cannot measure, and a pass here is not a statement that the list performs well.",
"sources": [
{
"url": "https://learn.microsoft.com/office365/servicedescriptions/sharepoint-online-service-description/sharepoint-online-limits",
"title": "SharePoint limits, Unique security scopes per list or library",
"publisher": "Microsoft",
"checked_at": "2026-08-06"
},
{
"url": "https://learn.microsoft.com/sharepoint/manage-permission-scope",
"title": "Manage Permission Scopes in SharePoint",
"publisher": "Microsoft",
"checked_at": "2026-08-06"
}
],
"remediation": "Treat it as a design question rather than a cleanup task. Microsoft's own advice is to design lists to have as few unique permissions as possible, and the cheapest version of that is usually to grant access at a folder rather than at each file inside it.",
"message_degraded": false,
"engine_detail": "",
"attention": {
"state": "observe",
"rank": 3,
"because": [
"the evidence needed to decide this was not available"
]
}
}
],
"attention": {
"state": "observe",
"rank": 3,
"because": [
"2 finding(s) reached no answer"
],
"counts": {
"act": 0,
"review": 1,
"observe": 2,
"none": 0,
"not-evaluated": 0
},
"unobserved": []
}
},
{
"$schema": "https://ph7x.com/schemas/m365-governance/run/4.1.0",
"provenance": {
"collected_at": "2026-08-08T18:00:00Z",
"collector": "spo-collector",
"collector_version": "0.3.0",
"source_system": "SharePoint Online",
"source_api": "PnP.PowerShell / CSOM",
"tenant": {
"id": null,
"host": "contoso.sharepoint.com",
"how": "requested"
},
"identity_kind": "delegated",
"acquisition": "collected",
"scopes": [
"AllSites.Read"
]
},
"coverage": {
"requested": [
"agents",
"enumeration"
],
"completed": [
"agents"
],
"unavailable": {
"enumeration": {
"state": "partial",
"detail": "Agents are files, so this is what the running identity can see in this site collection. A site with no agents and a site this identity cannot open return the same empty result."
}
}
},
"resource": {
"workload": "sharepoint",
"type": "site",
"native_id": "contoso,site,finance",
"tenant": {
"id": null,
"host": "contoso.sharepoint.com"
},
"scope": "collection",
"parent": {
"workload": "sharepoint",
"type": "tenant",
"native_id": "contoso.sharepoint.com"
},
"display_name": "Finance",
"url": "https://contoso.sharepoint.com/sites/finance"
},
"resource_class": "unknown",
"class_reason": "only lists are classified",
"set_aside": false,
"rule_source": "shipped with this version",
"counts": {
"pass": 0,
"fail": 0,
"unknown": 0,
"not-applicable": 0,
"invalid-evidence": 0,
"error": 0
},
"results": [],
"attention": {
"state": "observe",
"rank": 3,
"because": [
"1 requested area(s) were not read: enumeration"
],
"counts": {
"act": 0,
"review": 0,
"observe": 0,
"none": 0,
"not-evaluated": 0
},
"unobserved": [
"enumeration"
]
}
},
{
"$schema": "https://ph7x.com/schemas/m365-governance/run/4.1.0",
"provenance": {
"collected_at": "2026-08-06T16:00:00Z",
"collector": "spo-collector",
"collector_version": "0.3.0",
"source_system": "SharePoint Online",
"source_api": "PnP.PowerShell / CSOM",
"tenant": {
"id": null,
"host": "contoso.sharepoint.com",
"how": "requested"
},
"identity_kind": "delegated",
"acquisition": "collected",
"scopes": [
"AllSites.Read"
]
},
"coverage": {
"requested": [
"spfx"
],
"completed": [
"spfx"
],
"unavailable": {}
},
"resource": {
"workload": "sharepoint",
"type": "site",
"native_id": "contoso,site,spfx-ok",
"tenant": {
"id": null,
"host": "contoso.sharepoint.com"
},
"scope": "collection",
"parent": {
"workload": "sharepoint",
"type": "tenant",
"native_id": "contoso.sharepoint.com"
},
"display_name": "Training",
"url": "https://contoso.sharepoint.com/sites/spfx-ok"
},
"resource_class": "unknown",
"class_reason": "only lists are classified",
"set_aside": false,
"rule_source": "shipped with this version",
"counts": {
"pass": 1,
"fail": 0,
"unknown": 0,
"not-applicable": 0,
"invalid-evidence": 0,
"error": 0
},
"results": [
{
"rule_id": "SPO-SPFX-001",
"title": "A solution is installed at an older version than the catalog holds",
"rule_version": "1.0",
"schema_version": "1.0",
"resource": {
"workload": "sharepoint",
"type": "site",
"native_id": "contoso,site,spfx-ok"
},
"outcome": "pass",
"message": "Every solution in this catalog is installed at the version the catalog holds.",
"basis": "convention",
"severity": "low",
"evidence_used": [
{
"path": "spfx.upgradable_count",
"state": "observed",
"value": 0,
"lower_bound": null,
"upper_bound": null,
"detail": null
}
],
"passes_without_resolving": "A catalog where every solution is current says nothing about whether any of them still works, is maintained by anybody, or should be there at all. This rule compares two version numbers.",
"sources": [],
"remediation": "Find out why before upgrading anything. A package that was uploaded and never claimed is sometimes an oversight and sometimes a rollback that nobody wrote down.",
"message_degraded": false,
"engine_detail": "",
"attention": {
"state": "review",
"rank": 4,
"because": [
"it passed, and the rule records something the pass does not settle"
]
}
}
],
"attention": {
"state": "review",
"rank": 4,
"because": [
"1 finding(s) were decided and are worth weighing"
],
"counts": {
"act": 0,
"review": 1,
"observe": 0,
"none": 0,
"not-evaluated": 0
},
"unobserved": []
}
}
]
},
"evidence": [
{
"$schema": "https://ph7x.com/schemas/m365-governance/evidence/3.1.0",
"provenance": {
"collected_at": "2026-08-05T14:02:11Z",
"collector": "spo-collector",
"collector_version": "0.1.0",
"source_system": "SharePoint Online",
"source_api": "PnP.PowerShell / CSOM",
"tenant": {
"id": null,
"host": "contoso.sharepoint.com",
"how": "requested"
},
"identity_kind": "application",
"acquisition": "collected",
"scopes": [
"Sites.Read.All"
]
},
"coverage": {
"requested": [
"items",
"permissions"
],
"completed": [
"items",
"permissions"
],
"unavailable": {}
},
"resource": {
"workload": "sharepoint",
"type": "list",
"native_id": "contoso,list,documents-c",
"tenant": {
"id": null,
"host": "contoso.sharepoint.com"
},
"scope": "container",
"parent": {
"workload": "sharepoint",
"type": "site",
"native_id": "contoso,site,documents-host"
},
"display_name": "Documents",
"url": "https://contoso.sharepoint.com/sites/Finance/Shared%20Documents"
},
"facts": {
"items": {
"count": {
"state": "observed",
"value": 4200,
"raw": {
"field": "ItemCount",
"value": 4200
}
}
},
"permissions": {
"inheritance_broken": {
"state": "observed",
"value": false,
"raw": {
"field": "hasUniqueRoleAssignments",
"value": false
}
}
},
"list": {
"is_catalog": {
"state": "observed",
"value": false,
"raw": {
"field": "IsCatalog",
"value": false
}
},
"is_system": {
"state": "observed",
"value": false,
"raw": {
"field": "IsSystemList",
"value": false
}
},
"is_application": {
"state": "observed",
"value": false,
"raw": {
"field": "IsApplicationList",
"value": false
}
},
"hidden": {
"state": "observed",
"value": false,
"raw": {
"field": "Hidden",
"value": false
}
},
"base_template": {
"state": "observed",
"value": 101,
"raw": {
"field": "BaseTemplate",
"value": 101
}
}
}
}
},
{
"$schema": "https://ph7x.com/schemas/m365-governance/evidence/3.1.0",
"provenance": {
"collected_at": "2026-08-08T18:00:00Z",
"collector": "spo-collector",
"collector_version": "0.3.0",
"source_system": "SharePoint Online",
"source_api": "PnP.PowerShell / CSOM",
"tenant": {
"id": null,
"host": "contoso.sharepoint.com",
"how": "requested"
},
"identity_kind": "delegated",
"acquisition": "collected",
"scopes": [
"AllSites.Read"
]
},
"coverage": {
"requested": [
"agents",
"enumeration"
],
"completed": [
"agents"
],
"unavailable": {
"enumeration": {
"state": "partial",
"detail": "Agents are files, so this is what the running identity can see in this site collection. A site with no agents and a site this identity cannot open return the same empty result."
}
}
},
"resource": {
"workload": "sharepoint",
"type": "site",
"native_id": "contoso,site,finance",
"tenant": {
"id": null,
"host": "contoso.sharepoint.com"
},
"scope": "collection",
"parent": {
"workload": "sharepoint",
"type": "tenant",
"native_id": "contoso.sharepoint.com"
},
"display_name": "Finance",
"url": "https://contoso.sharepoint.com/sites/finance"
},
"facts": {
"agents": {
"population": {
"state": "observed",
"value": "sharepoint-site-assets-agent-files",
"raw": {
"field": "Get-PnPCopilotAgent (.agent files in this site's Site Assets)",
"value": "sharepoint-site-assets-agent-files"
}
},
"acquisition_method": {
"state": "observed",
"value": "enumerated",
"raw": {
"field": "Get-PnPCopilotAgent",
"value": "enumerated"
}
},
"populations_not_observed": {
"state": "observed",
"value": [
"copilot-agent-builder",
"copilot-studio"
],
"raw": {
"field": "not reachable from a SharePoint site read",
"value": [
"copilot-agent-builder",
"copilot-studio"
]
}
},
"inventory": {
"state": "observed",
"value": [
{
"file": "/sites/finance/SiteAssets/Budget questions.agent",
"type": "Site",
"schema_version": "1.0",
"name": "Budget questions",
"description": "Answers questions about the quarterly budget files.",
"has_instructions": true,
"source_count": 2,
"sources": [
{
"url": "https://contoso.sharepoint.com/sites/finance/Shared Documents/Budget",
"name": "Budget",
"type": "Folder",
"site_id": "1f1d1a1c-0000-4000-8000-00000000ab01",
"web_id": "1f1d1a1c-0000-4000-8000-00000000ab02",
"list_id": "1f1d1a1c-0000-4000-8000-00000000ab03",
"unique_id": "1f1d1a1c-0000-4000-8000-00000000ab04",
"named_by": "url"
},
{
"url": "https://contoso.sharepoint.com/sites/finance/Shared Documents/Forecast.xlsx",
"name": "Forecast.xlsx",
"type": "File",
"site_id": "1f1d1a1c-0000-4000-8000-00000000ab01",
"web_id": "1f1d1a1c-0000-4000-8000-00000000ab02",
"list_id": "1f1d1a1c-0000-4000-8000-00000000ab03",
"unique_id": "1f1d1a1c-0000-4000-8000-00000000ab05",
"named_by": "id"
}
]
},
{
"file": "/sites/finance/SiteAssets/Invoices.agent",
"type": "DocumentLibrary",
"schema_version": "1.0",
"name": "Invoices",
"description": "",
"has_instructions": false,
"source_count": 0,
"sources": []
}
],
"raw": {
"field": "Get-PnPCopilotAgent",
"value": "2 agents"
}
},
"count": {
"state": "observed",
"value": 2,
"raw": {
"field": "Get-PnPCopilotAgent",
"value": 2
}
},
"source_count": {
"state": "observed",
"value": 2,
"raw": {
"field": "Get-PnPCopilotAgent",
"value": 2
}
}
}
}
},
{
"$schema": "https://ph7x.com/schemas/m365-governance/evidence/3.1.0",
"provenance": {
"collected_at": "2026-08-06T16:00:00Z",
"collector": "spo-collector",
"collector_version": "0.3.0",
"source_system": "SharePoint Online",
"source_api": "PnP.PowerShell / CSOM",
"tenant": {
"id": null,
"host": "contoso.sharepoint.com",
"how": "requested"
},
"identity_kind": "delegated",
"acquisition": "collected",
"scopes": [
"AllSites.Read"
]
},
"coverage": {
"requested": [
"spfx"
],
"completed": [
"spfx"
],
"unavailable": {}
},
"resource": {
"workload": "sharepoint",
"type": "site",
"native_id": "contoso,site,spfx-ok",
"tenant": {
"id": null,
"host": "contoso.sharepoint.com"
},
"scope": "collection",
"parent": {
"workload": "sharepoint",
"type": "tenant",
"native_id": "contoso.sharepoint.com"
},
"display_name": "Training",
"url": "https://contoso.sharepoint.com/sites/spfx-ok"
},
"facts": {
"spfx": {
"catalog_scope": {
"state": "observed",
"value": "Site",
"raw": {
"field": "Get-PnPApp -Scope",
"value": "Site"
}
},
"solutions": {
"state": "observed",
"value": [
{
"id": "9a131334-3761-4a3c-a892-e9213a74cb7e",
"title": "rater-client-side-solution",
"catalog_version": "1.0.0.0",
"installed_version": "1.0.0.0",
"deployed": true,
"can_upgrade": false,
"client_side": true
}
],
"raw": {
"field": "AppMetadata",
"value": [
{
"id": "9a131334-3761-4a3c-a892-e9213a74cb7e",
"title": "rater-client-side-solution",
"catalog_version": "1.0.0.0",
"installed_version": "1.0.0.0",
"deployed": true,
"can_upgrade": false,
"client_side": true
}
]
}
},
"solution_count": {
"state": "observed",
"value": 1,
"raw": {
"field": "AppMetadata",
"value": 1
}
},
"upgradable_count": {
"state": "observed",
"value": 0,
"raw": {
"field": "AppCatalogVersion vs InstalledVersion",
"value": 0
}
}
}
}
}
],
"versions": {
"engine": "1.0.0b6",
"rules": {
"SPO-LIST-001": "2.0",
"SPO-LIST-002": "1.0",
"SPO-LIST-003": "1.0",
"SPO-SPFX-001": "1.0"
},
"collectors": {
"spo-collector": "0.3.0"
}
},
"manifest": {
"created_at": "2026-08-08T18:00:00Z",
"tenant": {
"id": null,
"host": "contoso.sharepoint.com"
},
"identity": {
"summary": "multiple",
"kinds": [
"application",
"delegated"
]
},
"acquisition": {
"summary": "single",
"kinds": [
"collected"
]
},
"assessment_id": "0fbfcae4b66a8fd69e0454dcd94447c87474e150542f663dd0936d22198d85e0"
},
"hashes": {
"algorithm": "sha256",
"canonical_parts": {
"run_set": "d8fc0d05f92e2fa4b694c42094f695ed21e36b2a7381b85f051142913cd4deec",
"evidence": "5cd93ec44b0fcb9f560d15d744f513c21a741bf5be46a337dc10d548995933d6",
"versions": "2c570ddafb24e2aeede070a87dcafd69d71db1b580f06fb28a36fdaf50c26ae0",
"manifest": "49ad1f98ad541bca0880e3b46274feb0fbb2c3a1a90770fc09c7d520472c4608"
},
"canonical_hash": "0fbfcae4b66a8fd69e0454dcd94447c87474e150542f663dd0936d22198d85e0"
}
}
}Tell us which tenant, and what you are trying to be able to show.