Glossary

An access review is a report in the deprecated Access feature that shows who has access to content, for owners to approve. Reviews replace it, and Access shuts down on 31 December 2026.

Access reviews cover Teams, SharePoint site collections, Microsoft 365 groups, Viva Engage communities, Power Apps, flows and Power BI workspaces. Each one lists the users and groups with access, and the reviewers approve that access or remove it.

An add-on module extends Rencore Governance with a group of connectors. Apps, Automation & BI and AI & Agents are the two add-on modules, optional on the Premium and Enterprise Plans.

Rencore Governance has three modules. Digital Workplace is included in every Plan. Add-ons, such as Files & Folders and Custom Metadata, extend a Plan with capabilities instead of connectors.

An admin center is the web portal where administrators manage one Microsoft service, such as the Microsoft 365 admin center, the Teams admin center or the Microsoft Entra admin center.

Several Rencore Governance setup steps happen in a Microsoft admin center, not in Rencore Governance itself. Each admin center needs an account with the matching admin role.

The admin consent workflow lets users who cannot consent to an app request it. Microsoft Entra ID sends the request to designated reviewers, who approve or deny it.

When the workflow is turned on in your tenant, only administrators can give access to apps. Users who sign in to Rencore Governance for the first time can then see a consent prompt instead of the app.

The admin portal is the internal back end that authorized Rencore personnel use to operate Rencore Governance. It shows metadata only and has no insight into the customer data from your tenant.

It shows, for example, the users of a Workspace, scan job history, the number of connectors, and the names and descriptions of policies, reports and automations.

Agent authentication decides whether users must sign in to chat with a Copilot Studio agent. With No authentication, anyone who has the link can use the agent.

Copilot Studio offers three options: No authentication, Authenticate with Microsoft and Authenticate manually. An agent without authentication can only reach public information, but anyone with the link can chat with it.

An AI agent is an assistant that answers questions or carries out tasks for users, often with access to company data. Rencore Governance inventories agents and flags risky ones with policies.

Rencore Governance inventories Copilot Studio agents, SharePoint agents and, in preview, Microsoft Foundry agents and ChatGPT Enterprise agents. Policies flag risky agents, such as agents without an owner, and automations can quarantine, reassign or delete them.

Anonymized user data is user information that Microsoft 365 replaces with de- identified names in its usage reports. Rencore Governance shows these anonymized values on objects built from those reports.

Microsoft turned this on by default for all tenants on September 1, 2021. It affects objects such as user activity and Teams usage reports. A Global administrator can turn it off in the Microsoft 365 admin center.

An app registration is the global definition of an application in Microsoft Entra ID. It holds the app's identity, its credentials and the API permissions it requests.

Power BI, Copilot Studio, Azure and Microsoft Foundry connect through an Entra ID app that you register in your own tenant. You enter its tenant ID, client ID and client secret in Rencore Governance when you give consent.

Application and delegated permissions are the two kinds of Microsoft permissions Rencore Governance asks for. Application permissions read your tenant without a signed-in user, and delegated permissions act for a signed-in user.

An application permission is also called app-only. A delegated permission reaches only data the signed-in user can access. Almost every connector uses application permissions.

An approval is a decision Rencore Governance asks a person to make before it goes ahead. Approvers decide on the Approvals page of the Rencore Teams App.

Approvals come from two sources: provisioning requests for a new workspace from a template that requires approval, and automations that route a decision to someone, for example before a team is archived or deleted.

Archiving puts a Team or SharePoint site into a read-only state when it is no longer in active use, without deleting it. Rencore Governance archives through actions and automations.

The Archive or unarchive a Team action switches the Microsoft Teams archive mode, and Archive a Site and Unarchive a Site do the same for SharePoint sites. Automations such as Archive unused teams run these actions on inactive workspaces.

The audit log records the actions performed in a Rencore Governance Workspace, with who did it and when. Owners, and custom roles with the View Audit Log permission, can open it.

It records actions such as creating or deleting a policy, adding a user or updating a dashboard, and also system actions, page views and system access. Entries are kept for one year on the Premium Plan and without a time limit on the Enterprise Plan.

An automation is a workflow Rencore Governance runs on inventory objects when a trigger fires. It has one trigger and one or more steps, and each step runs an action.

Actions include sending an email, archiving a Team or calling a webhook. Steps can also hold conditions, branches and approvals.

An automation action is a single operation an automation step performs, such as sending an email or archiving a Team. The actions available depend on the connector of the objects.

Other actions post to a Teams channel, remove a user from a group, or call an external system with Send HTTP request, Trigger webhook or Trigger Azure Function.

An automation batch is the group of automation runs that started from the same trigger at the same time. Opening a batch shows each run with its result.

The Automation Batch Page lists the batches of an automation by date, grouped by the GroupId property, which usually holds the timestamp of the trigger. A batch is where you start when an automation fails.

An automation threshold, or threshold limit, caps how many objects an automation processes in one day. It is a percentage or a number of objects.

It applies to automations triggered on a policy violation or on a schedule. New custom automations start at 20%. When the limit is reached, the automation stops processing new objects for that day, and the Thresholds in Automation notification goes out.

An autonomous agent is a Copilot Studio agent that an event trigger, such as an email or a schedule, starts without a user chatting with it.

The Copilot Studio connector of Rencore Governance lists the triggers that start each agent as their own inventory object, Trigger. The segment Autonomous Agents shows agents that have an external trigger, such as an email or a recurrence.

Beta features are early versions of Rencore Governance functionality that might later be released to all users. They are used at your own risk and can change or be removed without prior notice.

An Owner turns them on per Workspace: first set the Preview Mode to Beta in the Workspace Settings, then select the beta features to try.

A built-in action is a ready-made operation you run directly on inventory objects without building an automation, for example adding a user to a Team.

Each built-in action has a criticality level, and you can restrict which roles may use it.

A built-in role is one of the four roles every Rencore Governance Workspace comes with: Owner, Admin, Contributor and Reader. Role-based access control with them is included in the Premium and Enterprise Plans.

A Reader sees the inventory, dashboards, reports and policies without changing them. A Contributor also creates and edits them. An Admin also manages users, teams and Environment settings. An Owner can do everything, including creating and deleting Environments and deleting the Workspace.

A built-in team is a default Rencore Governance team that decides which inventory objects a user can see. Role-based access control with them is included in the Premium and Enterprise Plans.

There is one team per connector, such as Teams or SharePoint, and an All Services team that covers every connector. Each user is assigned one team along with their role.

A canvas app is a Power App whose screens you design freely, by dragging controls onto a canvas and connecting them to data.

The Power Apps connector of Rencore Governance scans all canvas apps in your tenant, with their environments, versions and connections. In the inventory they appear as the object type Power App (Canvas App).

A category groups policies, reports and automations by governance goal, such as Security or Costs. The template libraries filter by category.

The Policies and Reports landing pages can group their top items by category instead of by connector.

A channel is a section inside a Microsoft Teams team where members hold conversations and share files on one topic. A channel is standard, private or shared.

The Teams connector of Rencore Governance scans every channel of every team into the inventory, with its members, owners, tabs and SharePoint site. Each channel shows its membership type, so standard, private and shared channels sit in one list.

Codex is the OpenAI coding agent that is part of a ChatGPT Enterprise workspace. The ChatGPT Enterprise connector of Rencore Governance, in preview, reads Codex through the Codex analytics API.

It lists Codex environments with the repositories they reach, cloud tasks, paired machines and devices, daily usage per user and code review activity. Policies flag Codex seats with no Codex usage and shared Codex environments with repository access.

ChatGPT Enterprise is the business plan of the ChatGPT AI assistant by OpenAI. Rencore Governance covers it with the ChatGPT Enterprise connector, in preview and part of the AI & Agents module.

The connector inventories users, invitations, groups, service accounts, custom GPTs, projects, agents, Codex, spend limits and costs, and matches ChatGPT users to Entra ID. Policies flag publicly reachable custom GPTs, idle seats and sign-ins that bypass single sign-on.

A classic site is a SharePoint site built on the older classic experience, with classic pages and lists instead of modern ones.

Rencore Governance finds classic sites with the SharePoint connector. A policy and a report list them, and a second policy lists the classic sites nobody uses.

Claude Enterprise is the business plan of the Claude AI assistant by Anthropic. Rencore Governance covers it with the Claude Enterprise connector, in preview and part of the AI & Agents module.

The connector inventories users, groups, roles, chats, projects, Claude Code and Cowork sessions, spend limits and costs. Policies flag external users, organizations without enforced single sign-on and spend limits over 80% consumed.

A client secret is a password-like string that an app registration uses to prove its identity when it requests a token from Microsoft Entra ID.

Rencore Governance needs a client secret for the connectors that use your own Entra ID app: Power BI, Copilot Studio, Azure and Microsoft Foundry. You enter the tenant ID, the client ID and the secret value when you give consent.

The compliance score is the percentage gauge on each tile of the Policies landing page. It reflects the violations of the active policies on that tile for the selected period.

There is one tile per connector or per category. Next to the gauge, the tile lists the five policies with the most violations, sorted by severity and violation count.

A connection is the stored, signed-in link that a Power App or a flow uses to reach a data source through a connector.

Rencore Governance lists connections as an object type of their own in two connectors: the connections used by your Power Apps, and the connections used by your flows.

A connector is the part of Rencore Governance that reads one service, such as Teams or SharePoint, into the inventory. Each connector has its own object types, policies, reports, automations, actions and consent.

Other connectors cover services such as Power Automate, Copilot Studio and ChatGPT Enterprise. You choose the connectors to scan when you connect a tenant, and the Inventory, Policies and Reports pages group their tiles by connector.

Consent is the permission a Microsoft 365 administrator grants Rencore Governance to scan a tenant. You give it once globally through a single Azure app, or per service.

Consent per service lets different service administrators consent for their area. Reconsent repeats a consent you already gave. It is needed when Rencore Governance starts using an API that requires permissions your existing consent does not cover.

A context change is an automation step that switches the objects the next actions run on. For example, it moves from a team to all of its channels or to its owners.

Without a context change, every action in an automation runs on the object that triggered it. After a context change, the actions that follow run once for each related object, and their placeholders point at that object.

Copilot Studio is the Microsoft tool for building your own AI agents. Rencore Governance covers it with the Copilot Studio connector, part of the AI & Agents module.

The connector inventories agents with their topics, triggers, actions, knowledge, conversations and agent flows, plus their Power Platform environments, daily costs and pay-as-you-go plans. Policies flag unauthenticated public agents, agents without an owner and stale unpublished agents.

A Copilot Studio agent is an AI agent someone built in Microsoft Copilot Studio. Rencore Governance lists each agent with its owner, status and Environment, and policies flag risky agents.

Each agent is listed with its topics, triggers, actions, knowledge sources and conversations. Policies flag unauthenticated public agents, agents without an owner, autonomous agents, agents that reference a confidential site and agents nobody used for 90 days.

A criticality level, Low, Medium or High, rates how much impact an automation or built-in action has on your tenant. Roles carry separate permissions to execute actions of each level.

Deleting a SharePoint site collection is High, while sending an email to a site owner is Low. Because roles carry separate permissions for low, medium and high criticality, you decide who may run high-impact changes.

A custom GPT is a version of ChatGPT that someone in your ChatGPT Enterprise workspace configured for one purpose and can share with others.

The ChatGPT Enterprise connector of Rencore Governance, in preview, lists every custom GPT with its sharing visibility, configuration and usage. Policies flag publicly reachable custom GPTs, stale custom GPTs and custom GPTs with an inactive owner.

Custom Metadata is a Rencore Governance add-on that adds your own business fields to the inventory, such as cost centers or project codes. It is included in the Enterprise Plan.

Fields can also hold classifications. You define custom properties, custom objects, custom relations and data sources, then use those fields like any built-in property in policies, reports, provisioning forms, reviews and automations.

A custom role is a role you build yourself in Rencore Governance when no built-in role fits. Custom roles are only available on the Enterprise Plan.

You give it a name and a description and pick exactly the user permissions it grants, from any product area. You create it under Settings, Users & Roles, Roles, and then assign it to users like a built-in role.

A custom team is a team you build yourself in Rencore Governance to control which inventory objects its members can see. Custom teams are only available on the Enterprise Plan.

You give it a name and a description and choose the connectors and object types it covers. You create it under Settings, Users & Roles, Teams, and assign it to users like a built-in team.

A dashboard groups reports, policies and KPIs on one page as tiles, so each stakeholder sees the governance data that matters to them.

You add a prebuilt dashboard from the Dashboard Template Library or build a custom one, then add, resize and move tiles. Dashboards can be shared, exported and imported, and one dashboard can be set as your default.

The data center is the Microsoft Azure region where Rencore Governance stores all data of a Workspace. You choose it when you create the Workspace, and all customer data stays there.

The active regions are Germany West Central (Frankfurt), Central US (Iowa), Australia East (New South Wales) and Switzerland North (Zurich). West Europe (Amsterdam) is a legacy region that keeps its existing Workspaces.

A data placeholder is a field in double curly braces, such as {{reviewers.names}}, that Rencore Governance fills with real data when it sends a message.

You use placeholders in automation emails and messages, in review emails and in the approval and emails of a provisioning template, for example to name the requester or the object. Each inventory property has its own placeholder.

The Data Processing Agreement for Rencore Governance sets out how Rencore processes personal data on your behalf, as Article 28 of the GDPR requires. It is published on rencore.com and on the Trust Center.

The agreement can be concluded, or in some cases is automatically incorporated, when you sign a contract for Rencore Governance. It applies together with the Governance Terms of Service and the Privacy Policy.

A datagrid is the table view Rencore Governance uses for lists of items, such as the objects of an inventory or the violations of a policy.

Datagrids also list the entries of the audit log. Every datagrid has a search box that filters the rows by display name, and an Export button that saves the list to Excel or PDF, with only the visible columns or with all columns.

Dataverse is the Microsoft data platform behind Power Platform apps and environments. Rencore Governance reads Copilot Studio through Dataverse.

After you give consent, Rencore Governance sets up every environment it scans during the next data collection job: it creates a read-only Rencore Governance security role and an application user for your Entra ID app, and assigns the role to that user.

When you delete a user or a Microsoft 365 group, Microsoft Entra ID keeps it soft-deleted for 30 days. In that time you can restore it with its memberships.

Rencore Governance keeps deleted objects as object types of their own in the inventory: Deleted User and Deleted Group in the Microsoft 365 connector, Deleted Team in the Teams connector and Deleted Site Collection in the SharePoint connector.

A demo environment is an Environment filled with demo data instead of tenant data. You get one by signing up at try.rencore.com.

A demo environment cannot connect a real tenant and has its own 14-day trial period. It lets you try dashboards, policies and automations on realistic data.

A directory role is a Microsoft Entra admin role, such as Global Administrator or Teams Administrator, that grants a set of permissions across the tenant.

The Entra ID connector scans directory roles into the inventory. For each role, you can see the users who hold it, directly or through a security group.

An enterprise application is the local instance of an app in a Microsoft Entra tenant, its service principal, where admins control who can sign in and which permissions it holds.

When you give consent, Rencore Governance adds its enterprise applications to your tenant. With global consent you get one scanner app, and with consent per service you get one app for each service, such as Rencore Governance for Teams.

An Environment is the connected Microsoft 365 tenant inside a Workspace. A Workspace has exactly one Environment.

The Environment holds the data Rencore Governance scans from that tenant, together with its consent, connectors, currency, notifications and mail settings. Virtual Environments split an Environment into smaller segments, and a demo environment, created through try.rencore.com, holds demo data instead of tenant data.

Environment notifications are the emails Rencore Governance sends when something in an Environment needs attention. You turn each one on under Notifications in the Environment Settings.

The notifications are Consent Lost, Error in Automation, Thresholds in Automation, Error in Provisioning and Subscription threshold. Each one goes to all Owners, all Admins, a mailbox you name, or a combination of the three.

Exchange Online is the Microsoft 365 mail and calendar service. Rencore Governance covers it with the Exchange connector, part of the Digital Workplace module.

The connector inventories the mailboxes of your users, rooms and equipment, and the redirect rules set on them, so they appear in the inventory with the rest of your tenant. A policy flags mailboxes with redirect rules that send mail to external domains.

An external user is an account whose home tenant belongs to another organization, invited into your tenant to work with you.

Microsoft distinguishes four user types: internal and external members, and internal and external guests. Rencore Governance shows each user's type, and policies flag external users, inactive external users and groups or teams with external owners or members.

Files & Folders is an add-on that adds metadata for all SharePoint, OneDrive and Loop files and folders to the inventory. It is included in the Enterprise Plan and optional on the Premium Plan.

Files & Folders is a Rencore Governance add-on. The metadata includes permissions, file size and file types. The add-on is required to analyze storage at file level.

A flow is a Power Automate workflow, made of a trigger and actions, that runs a task automatically across apps and services.

The Power Automate connector of Rencore Governance scans every flow in your tenant, together with its runs, triggers, actions and connections.

Global Administrator is the Microsoft Entra admin role with access to every administrative feature in the tenant, including giving admin consent to apps for the whole organization.

When the admin consent workflow is turned on in your tenant, users who sign in to Rencore Governance for the first time can see a consent prompt. A global administrator then signs in once and consents on behalf of the organization.

The inventory is the record of every object Rencore Governance scans from your tenant, with their properties and the relations between them. It is grouped by connector.

It holds objects such as SharePoint sites, Teams, users, Power Automate flows and Copilot Studio agents. Dashboards, reports, policies, automations, reviews and provisioning all work on inventory data.

An inventory object is one item Rencore Governance has scanned from a connector, such as a single Team, SharePoint site collection, user or Power App.

Each object belongs to an object type, also called an entity, with its own properties and relations to other objects. Policies, reports and segments are each built on one primary object type.

A knowledge source is data that a Copilot Studio agent uses to answer, such as public websites, SharePoint and OneDrive, Dataverse or uploaded files.

The Copilot Studio connector of Rencore Governance lists the knowledge of each agent as its own inventory object, Knowledge, with its data source type and the SharePoint site it points at.

A leaver is someone who has left your organization but whose account may still hold licenses, workspaces, ownership and OneDrive content. Rencore Governance finds leavers by their account state, usually a disabled account.

Policies flag disabled accounts that still hold licenses, Teams and SharePoint sites whose owners are disabled, and OneDrives that belong to disabled users. Built-in actions then take back licenses, remove access or close the account.

License cost and currency are the values Rencore Governance uses to show Microsoft 365 license costs in the inventory, reports and policies. The currency is set per Environment.

Monthly license cost is an editable column on license inventories, such as Subscriptions, which you update by exporting, editing and importing a CSV file. A currency change applies after the next scan of the affected areas.

A licensed user is a user of the connected tenant that counts toward your Rencore Governance Subscription. A user counts when the account is enabled, not external, and has a Microsoft license assigned.

All three conditions must be met, and a free license counts as a Microsoft license. Internal guests with a license count. External users and disabled accounts do not.

A mailbox is an Exchange Online recipient that stores email, calendar items and contacts. It can belong to a user, be shared, or represent a room or equipment.

The Exchange connector of Rencore Governance scans the mailboxes of your users, rooms and equipment, and the redirect rules set on them.

Microsoft 365 is the Microsoft cloud suite of Teams, SharePoint, OneDrive, Exchange and the Office apps. The Microsoft 365 connector of Rencore Governance covers the groups, users and licenses behind your tenant.

It inventories Microsoft 365 groups, users, deleted groups and users, subscriptions, service assignments, sensitivity labels and Message Center messages. Policies flag unused licenses, administrators without MFA and groups with external owners.

Microsoft 365 Copilot is the AI assistant in the Microsoft 365 apps. Rencore Governance covers it with the Copilot connector, part of the AI & Agents module.

The connector inventories Copilot sessions, user activity and the external Graph connections Copilot can reach. Policies and reports show who uses their Copilot license, which licenses go unused and which external data sources Copilot draws on.

A Microsoft 365 Group is the membership object behind many Microsoft 365 workspaces. It gives owners and members shared resources, such as a mailbox, a SharePoint site and a Planner plan.

The group also backs the Team built on it. Rencore Governance scans groups with the Microsoft 365 connector, including deleted groups, and policies flag groups with external owners or members.

A Microsoft 365 tenant is the dedicated instance of Microsoft 365 that holds an organization's users, groups, data and settings. Rencore Governance connects to one tenant per Workspace.

In the Workspace, the tenant becomes the Environment, and Rencore Governance scans its metadata into the inventory through the consent an administrator gives. Organizations with several tenants use one Workspace for each tenant.

Microsoft Azure is the Microsoft cloud platform for virtual machines, web apps and other cloud resources. Rencore Governance covers it with the Azure connector, part of the AI & Agents module.

The connector inventories subscriptions, resource groups, virtual machines, web apps and Azure Advisor recommendations. One policy flags resource groups that hold too many services. Rencore Governance ships no automations or actions for Azure.

Microsoft Entra ID, formerly Azure Active Directory, is the Microsoft identity service behind every Microsoft 365 tenant. Rencore Governance registers its applications there and scans it with the Entra ID connector.

Your administrator consents to the Rencore Governance applications in your Entra ID and can revoke them there. The Entra ID connector scans app registrations, enterprise applications, client secrets, certificates, directory roles and risky sign-ins into the inventory.

Microsoft Fabric is the Microsoft analytics platform for end-to-end data work, with Power BI as one of its workloads. It stores its data in one shared data lake, OneLake.

Fabric covers data ingestion and transformation as well as real-time analytics and reporting. It brings data engineering, data warehousing, data science and real-time intelligence together in one software-as-a-service offering. Tenant-wide Fabric settings are managed by users with the Fabric Administrator role in Microsoft Entra ID.

Microsoft Foundry, formerly Azure AI Foundry, is the Microsoft Azure platform for building AI apps and agents with large language models. Rencore Governance covers it with the Microsoft Foundry connector, in preview.

The connector is part of the AI & Agents module. It inventories AI hubs, AI projects, AI services, AI agents, LLM deployments and fine-tuning jobs, so you can see which models and agents your teams deploy.

Microsoft Graph is the Microsoft API that gives access to the data of the Microsoft 365 services. Rencore Governance reads most of your tenant through it, with the permissions you consent to.

Microsoft limits how many requests an application may send, so Rencore Governance keeps a steady, low request load and pauses scanning when Microsoft throttles it, without losing data.

Microsoft Planner is the Microsoft 365 app for task plans and boards. The Planner connector of Rencore Governance, part of the Digital Workplace module, inventories plans.

Plans appear in the inventory with the rest of your tenant. An automation can create a new plan with the Provision Plan action. Rencore Governance ships no policies or built-in actions for Planner.

Microsoft Teams is the Microsoft 365 app for chat, meetings and team collaboration. Rencore Governance covers it with the Teams connector, part of the Digital Workplace module.

The connector inventories teams, channels, tabs, installed apps, shared channel external members and usage data. Policies flag teams without owners, inactive teams, public teams and teams with external users, and automations can archive unused teams or ask for approval first.

Multifactor authentication asks a user for a second form of verification, such as a code on their phone or a fingerprint, in addition to the password.

Microsoft now requires multifactor authentication for administrator users. If the administrator who gave consent for Power Apps and Power Automate has no MFA set up, the permissions are revoked and you have to give consent again.

The Nav Panel is the navigation bar on the left of every page in a Rencore Governance Environment. It opens Home, Search, Inventory, Dashboards, Reports, Policies, Automation, Review and Provisioning.

The Nav Panel shows only the areas your role can open and your Subscription includes. Your user menu, the Workspace & Environment Selector and Settings sit at the bottom of the panel.

OneDrive is the personal file storage of each Microsoft 365 user. The OneDrive connector of Rencore Governance, part of the Digital Workplace module, inventories every OneDrive with its files, folders and file sharing.

Policies flag files shared with external users, OneDrives near their storage limit, OneDrives that belong to a disabled user account and files older than five years.

Partial scanning is the Rencore Governance scanning engine that updates the inventory while a scan is still running. Inventory totals, policy results and segments update during the scan.

It splits the root objects of a tenant into batches, scans each batch with all its child objects, and syncs the batch into the inventory as soon as it is complete.

A pay-as-you-go plan links one or more Power Platform environments to an Azure subscription. Usage in those environments, such as Copilot Studio agent messages, is then billed through Azure.

The Copilot Studio connector of Rencore Governance lists your pay-as-you-go plans, and the daily costs of each plan come from the Azure scan. Rencore Governance reads this Microsoft billing data. It does not bill or cap the usage.

SharePoint sites, lists, folders and files inherit their permissions from their parent by default. When inheritance is broken, the item gets unique permissions that are managed on their own.

Rencore Governance flags broken inheritance with SharePoint policies, and built-in actions restore it on a site, list, folder or file. Restoring inheritance gives the item the permissions of its parent again.

A permission level is a named set of SharePoint permissions, such as Full Control, Edit or Read, that you grant to a user or a SharePoint group.

Each SharePoint site comes with default permission levels, and an admin can add custom ones. When you give a permission level to a SharePoint group, all members of the group get the same access.

A Plan is the edition of Rencore Governance in your Subscription: Professional, Premium or Enterprise. It decides which modules, add-ons and features you can use.

Digital Workplace is included in every Plan. The Premium and Enterprise Plans add Provisioning, Reviews, the Rencore Teams App and role-based access control, and the Enterprise Plan adds features such as tenant segmentation and custom roles.

A policy is a governance rule that Rencore Governance checks against your inventory, for example Teams without owners. Every object that matches the rule is a violation.

Each policy has a primary object type, a filter built in the Policy Builder, a category and a severity. You add policies from the Policy Template Library or build custom ones from scratch or from a report.

Power Apps is the Microsoft low-code tool for building business apps. Rencore Governance covers it with the Power Apps connector, part of the Apps, Automation & BI module.

The connector inventories canvas apps, their versions, connections and Power Platform environments. Policies flag apps shared with everyone, apps without owners and apps that need a premium license. Automations delete or quarantine an app, with or without an approval first.

Power Automate, formerly Microsoft Flow, is the Microsoft low-code tool for automated workflows called flows. Rencore Governance covers it with the Power Automate connector, part of the Apps, Automation & BI module.

The connector inventories flows with their triggers, actions, connections and runs, and the environments they live in. Policies flag flows with errors, flows without owners, unused flows and flows that need a premium license.

Power BI is the Microsoft service for reports and dashboards over business data. Rencore Governance covers it with the Power BI connector, part of the Apps, Automation & BI module.

The connector inventories workspaces, reports, dashboards, datasets, dataflows, datamarts, apps, capacities, pipelines, activity events and artifacts published to the web. Policies flag external access, workspaces without administrators and inactive reports and workspaces.

Power Platform is the Microsoft low-code platform where users build their own apps, flows, reports, agents and websites. It includes Power Apps, Power Automate, Power BI, Copilot Studio and Power Pages.

Rencore Governance covers Power Apps, Power Automate and Power BI with the Apps, Automation & BI module, and Copilot Studio with the AI & Agents module. Power Apps and Power Automate share one scanning application that uses a delegated permission, so it needs a dedicated, correctly licensed administrator account.

Power Platform Administrator is a Microsoft Entra admin role that can manage Power Platform environments, Power Apps, flows and data loss prevention policies in the tenant.

Rencore Governance scans Power Apps and Power Automate with delegated permissions, so the account that gives consent is also the account used for scanning. That account must hold the Power Platform Administrator role.

A Power Platform environment is a container in Microsoft Power Platform that holds apps, flows, agents and their data, often with its own Dataverse database. It is not a Rencore Environment.

Rencore Governance lists these environments as inventory objects of the Power Apps, Power Automate and Copilot Studio connectors. A Rencore Environment connects Rencore Governance to one tenant.

A connector marked Preview is released for use but not yet generally available. These docs show a Preview badge next to its name.

Microsoft Foundry, Claude Enterprise and ChatGPT Enterprise are in Preview. All three are part of the AI & Agents add-on module.

A private channel is a Microsoft Teams channel that only some members of the team can see. It has its own SharePoint site for its files.

Rencore Governance scans private channels with the Teams connector, together with the other channels of a team. A policy and a report list the teams that have private channels.

A property is one field of an inventory object, such as the URL of a site or the visibility of a Team. Reports, segments and policies filter and check objects by their properties.

Each object type has its own properties, and the inventory reference lists them for every connector. Custom Metadata adds properties of your own, such as a cost center.

A provisioning request is a request to create a new Microsoft 365 workspace, such as a Team, from a provisioning template. Users submit it in Rencore Governance or the Rencore Teams App.

The Rencore Teams App was formerly called Rencore Nova. If the template requires approval, the request goes to its approvers first, and Rencore Governance creates the workspace once they approve it.

A provisioning template defines how a new Microsoft 365 workspace is created through Rencore Governance. It creates a team, a SharePoint site, a Microsoft 365 group, a Planner plan or a Viva Engage community.

The template holds the workspace settings, who can see and use the template, the fields on the request form and whether the request needs approval. You start from the Provisioning Template Library, then turn templates on or off, export them or import them.

A redirect rule forwards or redirects the incoming email of a mailbox to another recipient. It can send company mail outside the organization.

The Exchange connector of Rencore Governance scans the redirect rules of every mailbox, with the recipients each rule forwards to, forwards as an attachment to or redirects to, and whether the rule is turned on.

A relation links one inventory object to another, such as a Team to its owners, members and channels. Policies, reports and automations use relations to work with the related object.

On the Related Objects page of an object, primary relations load straight away with a count. Other relations are grouped by connector and load when you open them.

Rencore Governance is the Rencore platform that inventories your digital workplace, apps, automations and AI agents. Rencore runs it as a hosted service, which you open in a web browser.

It scans a connected tenant into an inventory, shows what each object can reach, and applies your rules through policies, reports, automations, reviews and provisioning.

Rencore Lite is a 14-day, self-serve trial of a focused edition of Rencore Governance. You connect your own Microsoft 365 tenant, so the inventory and the risks you see are your own.

You sign up for Rencore Lite on rencore.com, create your Workspace and connect your Microsoft 365 tenant. After the first scan you see an inventory of your tenant and your first risks, ranked by severity.

Rencore Nova is a deprecated end-user app, replaced by the Rencore Teams App, that shuts down on 31 December 2026. It shows Rencore Governance content to users without direct access to it.

Opened in Microsoft Teams or in a browser, Rencore Nova shows content such as dashboards to users in your tenant. It has three sections: Workspaces, Access and Approvals. A Workspace Owner connects it under Rencore Nova Integration in the Environment Settings.

The Rencore Teams App (formerly Rencore Nova) brings Rencore Governance into Microsoft Teams for the people who own and use workspaces. It is included in the Premium and Enterprise Plans.

In it, users browse the Teams, SharePoint sites, Viva Engage communities and Microsoft 365 Groups they own or belong to, request new workspaces, decide on approvals and complete reviews. Admins configure the app, including which services it shows, under Teams App Settings.

A report is a saved query over the inventory that Rencore Governance shows as a chart, list, table or KPI, for example unused SharePoint site collections larger than 1 GB.

Each report has a primary object type, filters, a visualization and a category. You start from a report template or build a custom report, then share it, add it to a dashboard or follow its trend.

A Review is a recurring or one-off check in which workspace owners confirm who has access to their Microsoft 365 workspaces, directly in the Rencore Teams App.

Owners remove people who no longer need access and confirm that sharing is appropriate. An admin sets up a review schedule. Each run of the schedule is a cycle, and each workspace in a cycle gets an object review.

A review decision is what happened to a workspace in a Review: Unreviewed, Reviewed, Archived, Deleted, Rejected or a custom action. It is tracked apart from the review status, such as Pending or Completed.

The status is where a review stands: Pending, In Progress, Completed, Expired or Canceled. The decision is the outcome for the workspace, and the two are independent.

Roles and teams control what each user can do and see in a Workspace. Each user is assigned a role, which grants permissions, and a team, which grants access to inventory objects.

A role grants permissions such as creating policies or running automations. A team grants access to the inventory objects of selected connectors. Rencore Governance ships four built-in roles and a set of default teams (Premium and Enterprise Plans). Custom roles and teams are only available on the Enterprise Plan.

A scan is how Rencore Governance reads metadata from a connected tenant into the inventory. Scanning is continuous, and there is no fixed time when all data is updated.

You set a target interval for each object type, but scans can run later. Rencore Governance adjusts the frequency to the amount of data, the connector, the effort to retrieve the data and how often it changes, and stays within Microsoft 365 throttling limits.

A scan bucket is a group of connectors that never scan at the same time because they share the same Microsoft APIs. Connectors from different buckets scan in parallel.

Rencore Governance runs one connector per bucket at a time. This keeps scans fast without making connectors compete for the same request quota, which would trigger Microsoft throttling.

A scan error means Rencore Governance could not read part of your tenant during a scan job. Some objects may then be missing from the inventory or out of date.

Most scan errors come from missing permissions or from a known limit of a Microsoft API. Each scan error guide quotes the exact message, explains the cause and gives the fix.

A scan interval is how often Rencore Governance aims to scan one object type, such as daily or weekly. The interval is a target, not a guarantee.

You set it per object type in the scan configuration, from the intervals that object type allows. A scan can run later than planned, and there is no fixed time when all data is updated.

A security group is a Microsoft Entra group that gives a set of users access to resources. Unlike a Microsoft 365 group, it comes without a shared mailbox or SharePoint site.

The Microsoft 365 connector of Rencore Governance scans every Entra ID group in your tenant, security groups and Microsoft 365 groups alike, and a report lists the security groups.

A segment is a saved, rule-based filter over inventory objects, for example every user whose country is the United States. Segments are recalculated as scans update the inventory.

You build a segment in the Segment Builder from an object type, property filters and related objects. You can create a segment from a report, and export and import segments as files.

A sensitivity label is a Microsoft Purview classification, such as Confidential or Internal, that an organization applies to content and to containers such as Teams and SharePoint sites. Rencore Governance scans these labels.

Containers include Teams, Microsoft 365 Groups and SharePoint sites. Rencore Governance scans the labels of your tenant with the Microsoft 365 connector, so policies can flag sites without a label and actions can set the label of a group.

Severity is the impact level a policy assigns to its violations. A policy has one of five severities, from highest to lowest: Critical, High, Medium, Low and Information.

Severity is shown with every policy and violation, sorts the top issues on the Policies landing page, and is one of the filters in the Policy Template Library.

A shared channel is a Microsoft Teams channel that people from outside the team, and from other organizations, can join without joining the team.

The Teams connector of Rencore Governance lists the external members of shared channels. Policies flag shared channels with external access and shared channels without owners, and other policies count private channels and teams near the 200 channel limit.

SharePoint is the Microsoft 365 service for intranet sites, document libraries and file sharing. Rencore Governance covers it with the SharePoint connector, part of the Digital Workplace module.

The connector inventories site collections, sites, lists and libraries, files, folders, file sharing, SharePoint groups and SharePoint agents. Policies flag external sharing, missing sensitivity labels, broken permission inheritance and sites near their storage limit.

A SharePoint agent is an AI agent that helps users find information and insights on SharePoint sites and document libraries. It answers each user from the content they have permission to access.

It works as Copilot does in other Microsoft 365 apps. In Rencore Governance, SharePoint agents are part of the AI & Agents module: they are listed in the SharePoint inventory with their site collection, document library, instructions and approval state, and policies check the agents and the sites they read.

A SharePoint group is a set of users defined in a SharePoint site and given a permission level, such as the Owners, Members or Visitors group of the site.

Rencore Governance scans SharePoint groups with the SharePoint connector, using the Rencore Governance for SharePoint (Full Control) application. SharePoint Group and SharePoint Special Group are object types of their own in the SharePoint inventory.

A sharing link is a link in SharePoint or OneDrive that grants access to a file or folder, sometimes to people outside your organization.

Rencore Governance scans file sharing with the SharePoint and OneDrive connectors, so policies can flag files shared with external users, and actions can remove a sharing link or the sharing of a document.

A site collection is the top-level SharePoint container that holds a root site, its subsites, lists, libraries and files. In Rencore Governance it is a root object of the SharePoint connector.

Partial scanning scans each site collection together with its child objects. Policies check site collections for ownership, labels, storage and sharing, and actions archive them, set them to read-only or delete them.

A storage limit, or quota, caps how much space a SharePoint site or a OneDrive can use from the storage of your tenant.

Rencore Governance reports the quota and the storage used of every site collection and OneDrive. Policies flag the ones close to their limit, so you can act before they fill up.

Your Subscription is your purchase of Rencore Governance. It is connected to one Workspace and its Environment, and it sets your Plan and the number of users you can govern.

You buy a Subscription directly from Rencore or through the Azure Marketplace. Each Workspace, with its Environment, needs its own Subscription.

A subsite is a site created under another SharePoint site in the same site collection. It is the older way to structure SharePoint, before flat sites joined by hub sites.

Rencore Governance scans the root site and every subsite of a site collection as Site objects in the SharePoint inventory. Policies flag site collections with subsites and subsites with their own permissions.

The Rencore Support Portal at support.rencore.com is where you raise a support ticket with Rencore and follow its progress. Its account is separate from your Rencore Governance sign-in.

In the portal you submit tickets, called support conversations, add details and talk to Rencore Support engineers. The account does not depend on your Rencore role.

Teams Administrator is a Microsoft Entra admin role that manages Microsoft Teams settings, policies and apps in the Teams admin center.

You need a Teams administrator account to upload the Rencore Teams App to your tenant, and again each time you update it with a new manifest file. The same applies to the deprecated Rencore Nova app.

A Teams app manifest is the file in a Teams app package that describes the app, its icons and its permissions. Admins upload the package to install a custom app.

You install and update the Rencore Teams App with a manifest. Rencore Governance builds the app package for your Environment, and you upload it in the Teams admin center.

Telemetry data is the usage data Rencore Governance collects to operate and improve the service. It never includes personal or customer data from your tenant.

It covers connected connectors, granted permissions, scan jobs, errors and durations, object counts, configuration counts and general adoption metrics. It also counts the active users with a Microsoft 365 license, which is how licensed users are counted.

A template library is the catalog of prebuilt items you start from when you add something new in Rencore Governance. There is one for dashboards, dashboard tiles, reports, policies, automations and provisioning templates.

You filter a library by connector and, depending on the area, by category or severity, then customize the template in its builder.

The tenant ID is the GUID that identifies your Microsoft Entra tenant. You find it on the overview page of the Microsoft Entra admin center.

Some connectors ask for the tenant ID when you give consent. For Power BI, Copilot Studio, Azure and Microsoft Foundry, you create your own app in your tenant and enter its tenant ID, client ID and client secret in Rencore Governance.

Throttling is how Microsoft 365 limits the requests an application or user can send in a period of time. Rencore Governance pauses scanning when it is throttled, so no scanned data is lost.

When a limit is exceeded, Microsoft returns HTTP status 429 and rejects further requests from that client for a while. Rencore Governance keeps a steady, low request load.

The Rencore Trust Center, at trust.rencore.com, is where Rencore publishes its certifications, security reports, policies and sub-processors. Some documents open directly, others you request access to.

On the Trust Center you request the ISO 27001 and ISO 27017 certificates of Rencore GmbH, the SOC 2 Type 2 report for Rencore Governance, the CAIQ questionnaire and the latest penetration test report.

Version history keeps earlier versions of each file in a SharePoint or OneDrive library. Every stored version counts against the storage limit of the site.

With the Files & Folders add-on, the Remove SharePoint File Versions automation action deletes old major or minor versions of a file. It always keeps the current version and the number of versions you choose.

A violation is an inventory object that matches the rule of an active policy, such as a Team with no owner. It can trigger an automation that notifies the owner or fixes the object.

Rencore Governance recalculates violations as scans update the inventory and shows the total, new and removed counts and a trend for each policy.

A Virtual Environment is a logical segment of the data in one Microsoft 365 tenant, for example a department, region or subsidiary. Creating Virtual Environments is called tenant segmentation.

Each Virtual Environment carries its own selection of inventory objects, dashboards, policies and reports, and its own permissions, appearance and managed services, set independently from the root Environment.

Viva Engage, formerly Yammer, is the Microsoft 365 app for company-wide communities. The Viva Engage connector of Rencore Governance, part of the Digital Workplace module, inventories every community.

A policy flags communities without members, automations delete a community with or without an approval first, and actions add or remove community members and owners.

A Viva Engage community is a group in Viva Engage where people share posts, files and events around a team, project or interest.

The Viva Engage connector of Rencore Governance scans every community in your tenant into the inventory, with its owners and members. Communities are one of the workspace types Rencore Governance covers, next to Teams, SharePoint sites and Microsoft 365 groups.

A webhook is a URL another system listens on, so that a call to it starts something there. In Rencore Governance, the automation actions Trigger webhook and Send HTTP request call such a URL.

This connects governance events to tools such as Power Automate, Azure Logic Apps or a ticketing system. Fields can hold placeholders filled from the object the automation runs on.

A Workspace is the top-level container in Rencore Governance. It holds the settings, users, roles and connected apps for exactly one Environment, the connected Microsoft 365 tenant.

All data of a Workspace is stored in the same data center and storage container.

The workspace lifecycle covers a Microsoft 365 workspace, such as a Team or SharePoint site, from request to removal.

Rencore Governance creates the workspace from a provisioning template, scans it into the inventory, flags it with policies when it goes inactive or loses its owners, asks its owners to confirm it in a Review, and archives or deletes it through automations.

A workspace owner is an owner of a Microsoft 365 workspace, such as a Team, a SharePoint site or a group. By default, workspace owners are the reviewers of their workspace in a Review.

Workspace owners are set in Microsoft 365. They are different from users with the Owner role in a Rencore Workspace, which is one of the built-in roles of Rencore Governance.