DOCSEARCHbyAlgolia
Submit Docs

Maester Documentation

website·Indexed 34 days ago

https://maester.dev

Documentation for Maester version 2.2.1-preview, featuring a comprehensive library of test commands for auditing Microsoft Entra ID, Exchange Online, and tenant security configurations, including CISA security policy checks and identity blueprint hygiene.

Tokens
768.5K
Snippets
4.4K
Records
6.5K
Agent score
66%

What's inside Maester

  1. Overview of Invoke-MtGraphRequest

    Invoke-MtGraphRequest is an enhanced version of Invoke-MgGraphRequest designed to simplify interactions with Microsoft Graph. It provides several built-in capabilities that standard requests lack: automatic paging when a nextLink is returned, batching of requests when multiple items are piped through, and session-based caching of results. Note that batch requests do not support caching.

  2. Overview of Maester Open Source Core

    Maester is an open-source framework designed to make cloud security testing executable, reusable, and accessible. The core framework, including the built-in core tests and the ability to run Maester locally, is free and provided under the MIT license. It is intended for use by individual administrators, security teams, consultants, MSPs, and auditors to implement security checks without requiring expensive tooling or large budgets.

  3. Overview of the Maester security test framework

    Maester is a PowerShell-based test automation framework used to monitor and maintain Microsoft 365 tenant security configurations. It allows administrators to implement DevOps practices for security by defining policies as code, storing them in version control, and running continuous tests to ensure compliance. Maester leverages Pester, a popular PowerShell testing framework, and provides both built-in tests for quick startup and the ability to write custom tests to codify specific organizational security intents.

  4. Overview of Maester Security Test Suites

    Maester provides several test suites to validate security configurations for Microsoft 365 and Microsoft Entra. Each test within these suites includes a test ID, severity level, tags, a PowerShell command for execution, an overview, and remediation details.

    Available suites include:

    • Maester: General security tests for Microsoft 365 and Microsoft Entra configurations.
    • Entra ID SCA: Tests mapped to the Entra ID Security Config Analyzer.
    • CISA: Baseline tests based on CISA SCuBA for Microsoft 365.
    • CIS: Implementation of CIS Benchmark controls.
    • ORCA: Security configuration tests specifically for Exchange Online.

  5. Overview of the Maester security test framework

    Maester is a PowerShell-based test automation framework used to monitor Microsoft 365 tenants and ensure security configurations remain compliant with defined security policies. It allows administrators to apply DevOps practices to security management by defining policies as code, storing them in version control, and running continuous tests to detect configuration drift or vulnerabilities (e.g., accidental deletion of groups in Conditional Access policies).

  6. Overview of the Maester PowerShell module

    The Maester PowerShell module (version 2.2.1-preview) provides a collection of commands designed to help developers write Pester tests for validating Microsoft 365 tenant configurations, specifically focusing on Microsoft Defender for Endpoint and other security settings. The underlying Graph API calls for these commands are available in the Maester GitHub repository's src folder.

  7. Overview of available Maester security test suites

    Maester (v2.2.0) provides several curated test suites to validate security configurations for Microsoft 365 and Microsoft Entra. Each test within these suites includes a test ID, severity level, tags, a PowerShell command for execution, and remediation guidance.

    Available suites include:

    • Maester: 167 tests for general Microsoft 365 and Microsoft Entra configurations.
    • Entra ID SCA: 44 tests mapped to the Entra ID Security Config Analyzer.
    • CISA: 79 tests based on the CISA SCuBA baseline for Microsoft 365.
    • CIS: 50 tests implementing CIS Benchmark controls.
    • ORCA: 67 tests for Exchange Online security configurations.

  8. Restrict sharing of sensitive information via email (CISA.MS.EXO.8.4)

    To comply with CISA.MS.EXO.8.4, the DLP solution must restrict the sharing of credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN) via email to prevent unauthorized disclosure of sensitive information.

  9. Detect high-risk Microsoft Graph application permissions (MT.1050)

    The MT.1050 test identifies Microsoft Entra ID applications or service principals that possess 'Tier-0' Microsoft Graph permissions. These permissions are considered high-risk because they may provide a direct or indirect attack path to a Global Administrator account or enable a full tenant takeover. This test is based on the Microsoft Application permissions tiering research. While some legitimate use cases exist for these permissions (e.g., Maester requires RoleEligibilitySchedule.ReadWrite.Directory for PIM validation), administrators should audit these permissions—especially those granted to third-party vendor applications—to ensure the principle of least privilege is maintained.

  10. Verify Conditional Access MFA for risky sign-ins (MT.1012)

    The Maester test MT.1012 checks if a tenant has at least one Conditional Access (CA) policy that requires multifactor authentication (MFA) specifically for risky sign-ins. This is a high-severity security check to ensure that sign-in risk is mitigated by MFA.
    # The underlying PowerShell test command for this check is:
Test-MtCaMfaForRiskySignIn

  11. Enable Safe Links for Office Applications (CIS M365 2.1.1)

    Enabling the Safe Links policy for Office applications ensures that URLs within Office documents and email applications (including Office Online and Office mobile) are processed against Defender for Office time-of-click verification and rewritten if necessary. This extends phishing protection to hyperlinks even after they have been delivered to a user.

    Impact: Users may experience a very short delay when clicking URLs in Office documents. If a link is blocked, users will receive a notification message.

  12. Retrieve detailed information about supported SASL mechanisms using Test-MtAdSupportedSaslMechanismDetails

    The Test-MtAdSupportedSaslMechanismDetails cmdlet retrieves detailed information about the Simple Authentication and Security Layer (SASL) mechanisms supported by Active Directory. It helps administrators understand the security implications of the mechanisms in use.

    Key SASL Mechanisms analyzed include:

    • GSSAPI: Generic Security Services API (Kerberos) - Considered the most secure.
    • GSS-SPNEGO: SPNEGO negotiation for Kerberos/NTLM.
    • EXTERNAL: Authentication via external means, such as TLS client certificates.
    • DIGEST-MD5: Digest authentication (less secure and often disabled).

    Security best practices recommend preferring Kerberos (GSSAPI) and disabling DIGEST-MD5 if it is not required.

    Test-MtAdSupportedSaslMechanismDetails