ato-source-sharepoint

ATO evidence collection from SharePoint Online uses read-only commands to discover and download files, ensuring source data remains unmodified. It operates with ambient authentication to avoid credential handling and emits structured citation batches for downstream compliance workflows.

Yes, compliance artifact gathering from Microsoft 365 and OneDrive supports strict read-only access. It uses non-writing m365 spo commands like get, list, and download to retrieve evidence files safely without altering any source documents.

A SharePoint citations JSON batch is a structured file emitted during ATO evidence collection. It maps downloaded evidence files to their SharePoint sources, providing an auditable citation record that downstream orchestrator processes use for compliance validation.

SharePoint scope for ATO evidence discovery is configured within the orchestrator. Once enabled, the collection process validates the scope, prompts for confirmation, discovers relevant sites and folders, and downloads evidence files using ambient authentication.

No, SharePoint evidence collection uses ambient authentication to avoid credential handling entirely. This approach ensures safe, auditable collection in assurance workflows by leveraging existing authentication context rather than requiring manual credential entry.

Read-only ATO evidence discovery is limited to non-writing m365 spo commands and cannot modify source data. It must be invoked indirectly by the orchestrator when SharePoint scope is configured, and does not support direct invocation or credential-based authentication.