ato-source-sharepoint

To collect NIST 800-53 evidence from SharePoint Online for an ATO, use a read-only evidence collector that operates within a pre-configured orchestrator scope. It discovers and emits citations without writing to SharePoint.

Yes, you can extract Microsoft 365 compliance artifacts without modifying SharePoint by enforcing strict read-only operations and ambient authentication. This ensures evidence discovery occurs with no writes to the environment.

SharePoint evidence collection works by interfacing with the ATO artifact collector workflow to contribute citations. The skill discovers evidence via m365 commands and emits SharePoint citations for the orchestrator to compile.

Yes, you need a pre-configured orchestrator scope specifically set to SharePoint to gather M365 ATO evidence. The skill is invoked by the orchestrator during artifact collection and should not be run directly outside this workflow.

A limitation of using a read-only SharePoint collector for ATO compliance is that it strictly enforces non-write behavior, meaning it cannot modify or update any evidence sources. It is strictly for discovering and emitting citations.

The best way to automate NIST 800-53 evidence discovery across OneDrive and M365 is running a scoped artifact collection workflow. This uses ambient authentication and m365 CLI commands to validate, discover, and emit citations.