🎯 Highlights at a Glance​

• Brand new reporting capabilities with print, markdown, and Excel export views
• New Security Tests covering Intune, Entra ID, Conditional Access and Azure
• Microsoft Security Exposure Management (XSPM) Integration - Leverage Defender insights
• Enhanced HTML Report with print, markdown, and Excel export views
• Emergency Access Accounts Configuration - Define your break-glass accounts
• New Maester App Management Commands - Simplified DevOps pipeline setup

Here's a deeper dive into what's new in Maester 2.0:

New Reporting Capabilities​

The Maester report has been completely redesigned with new views and capabilities.

🔐 New Security Tests​

We've added over 15 new tests to help you secure your Microsoft 365 environment. Here are the highlights:

Intune Security​

Identity & Access Management​

Azure Security​

Why it matters:

• Prevent shadow IT by restricting tenant and group creation
• Protect your hybrid identity by blocking on-prem sync attacks
• Secure your Azure backup infrastructure

How to use:

# Run all new tests
Invoke-Maester -Tag "MT.1068", "MT.1069", "MT.1070"

# Run all Entra tests
Invoke-Maester -Tag "Entra"

🛡️ Microsoft Security Exposure Management (XSPM) Tests​

A brand new category! Integrate with Microsoft Security Exposure Management to test for exposure risks across your environment.

New XSPM Tests​

Why it matters:

• Identify attack paths before attackers do
• Prioritize remediation based on exposure risk
• Leverage Microsoft's threat intelligence

How to use:

# Run XSPM tests
Invoke-Maester -Tag "XSPM"

# Check for credential exposure
Invoke-Maester -Tag "XSPM" -Path ./tests/XSPM

📊 Enhanced HTML Report​

The Maester report has been completely redesigned with new views and capabilities.

New Report Features​

Why it matters:

• Share results with stakeholders in their preferred format
• Track remediation progress over time
• Present findings to leadership with professional reports

How to use:

# Generate the enhanced report
Invoke-Maester -OutputFolder ./results

# Open the HTML report and explore the new views
# Click the tabs: Print | Markdown | Excel | Config

🚨 Emergency Access Accounts​

Define your break-glass accounts in the Maester configuration to improve test accuracy.

Why it matters:

• Tests correctly identify your emergency access accounts
• No more false positives on Conditional Access exclusions
• Audit trail for break-glass account usage

How to use:

Edit your maester-config.json:

{
  "GlobalSettings": {
    "EmergencyAccessAccounts": [
      "emergency-admin@contoso.com",
      "break-glass-group-id"
    ]
  }
}

Then run your tests:

Invoke-Maester
# Tests will now recognize your defined emergency access accounts

⚡ Maester App Management​

New cmdlets to simplify setting up Maester for DevOps pipelines.

New Commands​

Why it matters:

• One command to set up your DevOps app registration
• Automatically configures the minimum required permissions
• Supports workload identity federation for GitHub Actions

How to use:

# Create a new Maester app for GitHub Actions
New-MtMaesterApp -Name "Maester Pipeline" -GitHubOrganization "myorg" -GitHubRepository "maester-tests"

# Include mail sending for notifications
New-MtMaesterApp -Name "Maester Pipeline" -SendMail

# Add federated credential to existing app
Add-MtMaesterAppFederatedCredential -GitHubOrganization "myorg" -GitHubRepository "maester-tests"

🔍 Test Inventory Discovery​

A new command to discover and explore available tests.

Why it matters:

• Understand what tests are available before running
• Filter tests by tags or capabilities
• Export inventory for documentation

How to use:

# Get all available tests grouped by tag
$inventory = Get-MtTestInventory

# View tests for a specific tag
$inventory['CIS']

# Export inventory to CSV
Get-MtTestInventory -OutputType CSV -ExportPath ./TestInventory.csv

🔧 Improvements & Fixes​

Performance​

• Optimized Invoke-MtGraphRequest for faster batch operations
• Improved ConvertTo-QueryString with better null handling

CISA Compliance​

• Enhanced CISA test accuracy and reliability
• Individual test IDs for CA What-If analysis

CIS Benchmarks​

• Improved DKIM test with skip logic for onmicrosoft.com domains
• Cleaner test names without level numbers for better readability

Defender for Identity​

• Refactored health issue detection
• Better integration with MDI alerts

🙏 Thank You to Our Contributors​

This release wouldn't be possible without our amazing community:

• @tdcthosc - CISA improvements, CIS refactors, Invoke-Maester enhancements
• @f-bader - Emergency access accounts feature
• @HenrikPiecha - MT.1070, MT.1071, MT.1073 tests
• @marcel-ngn - MT.1068, MT.1069 tests
• @RobbeVandenDaele - XSPM device checks
• @SamErde - Bug fixes and workflow improvements
• @brianveldman - Azure security tests
• @l-gosling - GitLab and Teams integration
• @kij - HTML report improvements
• And many more!

🚀 Get Started​

Update to Maester 2.0 today:

# Update the Maester module
Update-Module Maester -Force

# Update your test files
cd maester-tests
Update-MaesterTests

# Run the tests with the new features
Invoke-Maester

📚 Learn More​

• Maester Documentation
• GitHub Repository
• Join us on Discord

Have feedback or found a bug? Open an issue on GitHub!

Happy testing! 🎉

Code signing and PowerShell​

Regardless if you publish a PowerShell module to the PowerShell gallery or just have a PowerShell script in your home folder, the code in those files, normally is just that, code. But if you have a code signing certificate from a trusted certification authority, you can use this to sign the PowerShell files, which allows anybody else to verify that nobody has tampered with the contents.

This concept is great in theory, but has a few downsides:

• Code Signing certificates are very expensive.
• With the recent changes to code signing certificates, they have to reside inside a HSM, adding operational cost.
• As an open source project you might sign code that is not yours.

The current code signing certificate that Fabian offered at the beginning still has a few months until it's no longer valid, but at the end of this period it won't be extended anymore. Therefore we had to make the decision if we want to sign Maester going forward. There are a few projects out there that offer code signing to open source tools for free, but there are a lot of requirements regarding external code sources that made this road unfeasible for us.

In the end, code signing a PowerShell module adds some value, but the cost outweighs the need, and we decided to stop now.

Starting from version 1.4.0 and any pre-release starting from 1.3.101, the module will no longer be signed.

Why should I care?​

If you use Maester in a CI/CD pipeline with managed workers, nothing will noticeably change. The workers don't persist the module information after running, it and the next run will go through the module installation like always.

But if you have Maester installed on your own machine, PowerShell will throw the following error, calling out that the new version is no longer signed.

Update-Module Maester -AllowPrerelease

Install-Package: The version '1.3.105' of the module 'Maester' being installed is not catalog signed. Ensure that the version '1.3.105' of the module 'Maester' has the catalog file 'Maester.cat' and signed with the same publisher 'CN=Fabian Bader, O=Fabian Bader, L=Hamburg, C=DE' as the previously-installed module 'Maester' with version '1.3.0' under the directory 'C:\Users\Fabian\Documents\PowerShell\Modules\Maester\1.3.0'. If you still want to install or update, use -SkipPublisherCheck parameter.

Sadly, the -SkipPublisherCheck switch is not available for the Update-Module cmdlet.

Solution​

The solution is to install the new version once with:

Install-Module Maester -AllowPrerelease -Force -SkipPublisherCheck

We gladly welcome any feedback or suggestions for improvements. You can also join our community on Discord. Thank you!

A Review of How Tags are Used​

When you run Maester with no tag-related parameters, it automatically includes all available tests except (1) tests that rely on features that are still in preview and (2) tests that can take a very long time in large environments. The goal with this default behavior is to quickly get meaningful results with minimum learning curve.

🏷️ Run All Default Tests​

Invoke-Maester -Path './maester-tests'

Runs all the default tests in the folder ./maester-tests (excludes long running and preview, as noted above) and generates a report of the results in the default ./test-results location.

🏷️ Run Tests with Specific Tags​

You can use the Tag parameter to target tests with specific tags. For example:

Invoke-Maester -Path './maester-tests' -Tag 'CA', 'MFA'

Only run tests with the 'CA' or 'MFA' tags in the ./maester-tests directory.

🏷️ Exclude Tests with Specific Tags​

Invoke-Maester -ExcludeTag 'App', 'Azure'

Run all default tests excluding tests that are tagged with 'App' or 'Azure'. By default, tests that can take a very long time in large environments and tests that rely on preview features are still excluded as well.

What has changed?​

As noted above, Maester's default execution excludes long-running tests and tests in preview status. Two new switch parameters have been introduced so we can begin the removal of the ambiguous tags that targeted these two categories.

As you can imagine, the original naming lead to many people adding the All and Full tags to their test scripts with the goal of being generally included. Now, running Maester with every available test can be accomplished as shown below. Note that you can still combine these parameters with other options:

🏷️ Run Maester with Default Tests, Long-Running Tests, and Preview Tests​

Invoke-Maester -Path './maester-tests' -IncludeLongRunning -IncludePreview

Runs all tests in the path ./maester-tests including preview and long running tests.

🏷️ Run Maester with Default Tests and Long-Running Tests, Excluding 'App' Tests​

Invoke-Maester -Path './maester-tests' -IncludeLongRunning -ExcludeTag 'App'

Runs all tests in the path ./maester-tests including long running tests and excluding tests tagged with 'App'.

Details​

IncludeLongRunning​

These tests may take a long time in tenants that have a large number of user, group, or application objects. In the future, we hope to add the ability to set a dynamic threshold after checking the number of each object type in the tenant before testing. Then, for example, a tenants with less than a hypothetical threshold of 2000 users would run these tests by default, but tenants with more than 2000 users (as an example) would require the IncludeLongRunning switch to include these tests. Tenants with a very large number of users, groups, or applications can take hours to assess or even timeout completely due to the extra processing time required to get the objects and then report on them. Available memory on the system running Maester can also become a limiting factor in these scenarios.

IncludePreview​

Include tests that rely on functionality that is still in preview status. These might be tests that are based on new techniques that are still being validated by the Maester team or tests that are using a beta API.

How Will This Affect Me?​

We have done our best to deprecate the All and Full tags gracefully. They have been removed from all tests, but the Invoke-Maester function has also been updated to handle their use. However, this code may be removed in the future to keep Maester streamlined and easy to maintain. We currently support use of the tags and/or switches with the following logic:

• The -IncludeLongRunning switch is automatically enabled when the Full tag is included in the Tag parameter.
• The -IncludePreview switch is automatically enabled when the All tag is included in the Tag parameter.

In addition, if these deprecated tags are used, you will now see a warning in the output:

Bonus: Get-MtTestInventory​

Several commonly requested features have been related to the ability to get an inventory of the tests and their tags. The new Get-MtTestInventory function delivers exactly that. It enables users of Maester to gain more insights about the tests at their disposal.

The test inventory results are returned as an ordered dictionary (hash table) with the tags as the keys, and a list of the related tests as their associated values.

One way that this can be used is to list all tests associated with a specific tag such as "CIS."

$TestInventory = Get-MtTestInventory -Path ~/Maester-Tests -PassThru
$TestInventory['CIS']

Try those two commands to see the output, and then explore the tests associated with other tags such as 'XSPM.' You can also see the full list of discovered tags by running $TestInventory.Keys after the above command.

Conclusion​

For more information, please refer to the Maester documentation for Invoke-Maester and Get-MtTestInventory.

• Invoke-Maester
• Get-MtTestInventory

As always, Maester is a community project that thrives on your input! We gladly welcome any feedback or suggestions for improvements. You can also join our community on Discord. Thank you!

New version of Maester on Azure Web App 🎉​

What was it before?​

The setup allowed Maester to run on an Azure Web App, enabling you to perform Microsoft Graph security configuration checks on your Microsoft tenant directly from the Azure Web App, secured with Entra ID Authentication through an Azure Bicep deployment. At that time, it only supported Microsoft Graph security configuration tests. Many people asked me to update the deployment to include also the other tests that are part of Maester, because we want to utilize all the available tests that Maester has.

What has changed?​

• 🔥 Support for the latest Maester PowerShell module through the use of PowerShell 7.4 runtimes. 
• 💪🏻 Support for Exchange Online security tests 
• 🎉 Support for Security & Compliance security tests 
• 📱Support for Microsoft Teams security tests 
• 🤙🏻 Support for Azure configuration security tests

📚 Documentation​

Follow the step-by-step guide to start using the Azure Bicep Deployment for Maester on Azure Web App:

• Setup Maester in Azure Web App using Azure Bicep

Contributors 🙏​

We have built this Azure Bicep Deployment: 👇

_{Merill Fernando}

_{Brian Veldman}

What's Next?​

We are incredibly excited about the updated Maester Web App Deployment and have many ideas for new features and improvements. Feel free to share your ideas and contribute as well. 🙌

What is a control?​

The ComplianceForge team provides a nice definition:

"Controls are safeguards or countermeasures implemented to manage risks and protect assets. Cybersecurity controls can be technical, administrative, or physical and are designed to reduce vulnerabilities, prevent threats and ensure confidentiality, integrity and availability of information." (ComplianceForge, 2025)

In the simplest of terms your organization has said, "We care about X". The control documents what you are doing to protect "X".

Keeping in mind too, that your control usually is a reference to a general situation or outcome you are hoping to manage the risk of. Through that reference you will typically aim to have a mapping to a procedure. The procedure should specify what steps are taken to align with a control for a given system or process.

Controls will also typically map to the upstream compliance requirements through policies, standards, or other documentation.

A very simple example of how this fits together:

• Policy - "Employees must protect organization data"
• Control - "Computers should not remain unlocked when not in use for longer than 5 minutes"
• Procedure - "Configure the Windows lock screen timeout setting to 5 minutes of inactivity"

💡 Callout

Above you can see keywords should and must, these have specific implications as to optional or mandatory respectively as well. See RFC 2119 for more detail of one example of defining these terms.

This example is a simple example, but the nuance and complexity becomes challenging to manage at scale, your organization may even have individuals dedicated in a partial or full time capacity to managing this.

For our example we can map our control against a well known control framework or benchmarck, the Center for Internet Security (CIS) Critical Security Controls (CSC) Version 8.1. For CIS CSC safeguard 4.3 they specify a 15 minute maximum inactivity period for general computing devices. There are many different control frameworks out there that reference similar control concepts, and some frameworks may even have contradicting controls.

💡 Callout

Governance terminology (e.g., frameworks, policies, standards, and more) gets used in many contexts with many different meanings. An example being the United States National Institute of Standards and Technology (NIST), which publishes standards and more. The NIST Special Publication (SP) 1800 series is a common example of guidelines. Often these NIST SPs may be referenced as standards though. Standards bodies exist for many different topics in many different ways, such as the OpenID Foundation (OIDF) creating identity standards that are secure, interoperable and privacy-preserving, or ASTM International offers resources for standards development and use worldwide. This illustrates a nuance as well for internal versus external standards. Where external standards are typically consensus driven by an industry working group aroud common specifications for implementations, and internal standards define specific requirements your organization has for implementations.

But still... Why would you implement that control?​

There are a many reasons your organization may want to implement a control like our example, but there are two general categories:

• Proactive risk mitigation
  • It is well known that cybersecurity has direct risk and impact to business operations. Understanding, identifying, and prioritizing these risks is beneficial for any organization. Some risks may be worth taking mitigating measures, such as implementing controls, proactively and others may not be a high enough priority.
• Regulatory compliance
  • Your organization may have specific regulatory or compliance obligations as part of your business operations as well. A common example of a regulatory obligation is Health Insurance Portability and Accountability Act (HIPAA) for healthcare covered entities and their business associates. Using our example control, 45 CFR 164.312(a)(2)(iii) identifies a specific addresable requirement.

Why do we need to compensate?​

Continuing to use the screen lock out example. You may find yourself in situations where:

• There is no technical capability on a system to enforce a screen lockout to the specific maximum inactivity time or possibly at all.
  • An example may be a proprietary system that does not offer the technical capability.
• There is a business process that does not allow for a screen lockout within the specific maximum inactivity time or possibly at all.
  • An example may be a kiosk or shared workstation.
• There may be tangential services you offer that do not fall within scope of the requirements.
  • An example may be a personal use device provided to clients during waiting periods.

Each of these situations could justify a need for an exception to your policy. These could be examples of compensating controls.

• You may decide to implement a physical safeguard and prevent physical access to a proprietary system that does not allow for a screen lockout.
• You may decide to exclude the shared workstations from policy, but require applications in use on those systems to enforce an inactivity requirement.
• You may decide to exclude all personal use devices from policy and prevent access to organization resources.

How does this apply to Maester?​

The Maester project provides a way for testing that a control's procedures are currently in place. Often times though your organization may have different requirements, exceptions, or preference in the controls you implement. Maester offers testing for multiple control procedures from community guidance (i.e., MT or EIDSCA), Cybersecurity & Infrastructure Security Agency (CISA), CIS, and more. Though there is still some decisions on your part which tests you want to use or if you should use your own.

The Maester project is providing you better visibility into the possible controls you may need to implement, but you still need to decide what is the best for your end user experience, acceptable risk tolerance, and business obligations.

Examples of this topic in the wild​

• https://github.com/maester365/maester/discussions/1068
• https://github.com/maester365/maester/discussions/429
• https://github.com/maester365/maester/discussions/1093
• https://github.com/maester365/maester/issues/686
• https://github.com/maester365/maester/issues/1052
• https://github.com/maester365/maester/issues/364
• https://github.com/maester365/maester/issues/282
• https://github.com/maester365/maester/issues/194
• https://github.com/maester365/maester/discussions/1049

Here are some quick stats for you:

❇️ 55,000+ tenants have used Maester to improve their security posture

🚀 260,000+ downloads of Maester on PowerShell Gallery

💻 2,600+ commits on GitHub

🤝 72+ contributors

✳️ 285 Maester tests (90+ new tests!)

📦 252 releases

There's a lot to cover, so let's dive right in!

We have added a lot of new features and improvements based on your feedback. Thank you for that! 🙏

Here are all the new features and improvements in this release:

🌟 New Tests​

We've added a whole bunch of new tests to check your security configuration, growing from 194 to 286! 🎉 Check out the test list for the full breakdown.

ORCA​

Mike Soule came up with the idea to integrate Cam Murray's excellent Office 365 Recommended Configuration Analyzer (ORCA) with Maester.

We reached out to Cam and he was all for helping Microsoft customers become more secure. With the greenlight, Mike started integrating ORCA and we had amazing support from Thomas Schmidt who really helped improve the quality and polish of the ORCA tests in Maester. Call out to Cameron Moore who pitched in with a huge number of PRs.

You can read more about this in our previous blog post Maester adds ORCA tests

Entra app tests​

We have a number of app related tests that help you identify potential security issues with your Entra applications.

Note: We don't run these new app related tests by default since they can take a long time to run. You will need to explicitly include them using Invoke-Maester -IncludeLongRunning.

This is because it needs to query all applications and service principals in the tenant which can take many hours in large tenants.

The application risk tests are based on the excellent Azure Tiering research by Emilien Socchi. These help identity apps that have a path to Global Admin permissions, which can lead to a full tenant takeover.

Maester - Platform Updates​

Special call out to Thomas Schmidt, Sam Erde, Stephan van Rooij and Cameron Moore for their amazing contributions to this release. They have been instrumental in making Maester more robust, performant and easier to use.

In addition, we have had a lot of contributions from the community, which has helped us improve Maester even further. Thank you to all our contributors! 🙏

🤖 Maester GitHub Action​

We are excited to announce the new Maester GitHub Action! 🎉

This version is a huge update and adds performance improvements as well a number of new features and configuration options.

We moved the Maester GitHub Action to a new repository, which allows us to better manage the action and its dependencies.

However, this means that you will need to update your workflow files to use the new action. See the Usage section in the Maester GitHub Action documentation for more details.

📋 Excel and CSV Export Formats​

We have added new export formats for the Maester report. You can now export the report in Excel and CSV formats, which makes it even more easier to share and analyze the results.

It's as simple as adding an -ExportExcel or -ExportCsv switch when running Invoke-Maester!

🚥 Severity levels​

Each test now includes a severity rating. This will help you prioritize the tests and focus on the most critical issues first.

You can also change the severity levels of the tests to suite your needs.

Check the Severity Levels documentation for all the details including how you can add Severity to your custom tests.

📊 Maester Report Improvements​

You can now search and filter the results list by name, severity, tags and more.

The test details view now support navigating to the next and previous test, making it easier to review the results.

Thank you to all our amazing contributors! 🙏​

There are many, many more new features, improvements and fixes that have gone in by this amazing list of contributors 👇

Here's a sneak peek at the some of the checks from ORCA that will be included in the next Maester release.

What is ORCA?​

Cam Murray created the Office 365 Recommended Configuration Analyzer (ORCA) PowerShell module to help align tenant configuration with Microsoft's recommended configurations. Many of these settings are available in the configuration analyzer today, but ORCA provided these insights earlier and often in a more concise approach. Building these configuration items as tests in Maester provided an awesome way to build on the core ORCA module value and bring even more context into the configuration state of a tenant.

How to build?​

The ORCA module utilizes user defined types with enumerations and classes heavily. This is the best approach for an individual module and helps produce well-typed and structured code bases. It also can be challenging when trying to merge code bases dynamically as those types within the module need to exist outside the module.

Git Submodules have their own issues too so definitely avoid those unless the challenges are worth it.

To handle this, PowerShell has this awesome feature called the abstract syntax tree (AST). This feature allows you to parse PowerShell files and interface with them as structured objects. Using the AST the Maester team was able to build a script to parse the ORCA code base and dynamically build the necessary functions, tests, and report details for incorporating with the Maester module.

Similarly and even more elegantly the EIDSCA team was able to incorporate their module as well.

How to contribute?​

Update-OrcaTests.ps1​

Located in /build/orca/Update-OrcaTests.ps1 is the build mechanism for each test derived from ORCA.

1. The latest ORCA module is pulled from orca.git into the subfolder /orca.
2. Prerequisites are initialized as described above and the following files are created in /powershell/internal/orca:
   • Add-IsPresetValue.ps1
   • Get-ORCACollection.ps1
   • Get-PolicyStateInt.ps1
   • Get-PolicyStates.ps1
   • Get-AnyPolicyState.ps1
3. Each ORCA check located in /build/orca/orca/Checks/ are processed and compiled into Maester tests like so:
   1. A $content variable is prepared and contains the following properties:

      Property	Purpose
      file	Name of the check script
      content	Content of the check script
      name	Name of the check
      pass	Text requirement of passing
      fail	Text for remediation
      func	Name of the test function
      control	Check control number
      area	Check category/area
      description	Check description
      links	Check related links

   2. Each property listed above are populated using regular expressions on the raw value of the ORCA check content.
   3. $testId is derived from $content.func to fit the Maester test id format.

      If it is not possible to derive it using the expected ORCA test function name format (ORCA.n or ORCA.n.n), where the last number is optional and can be any number of digits, it will skip processing this test. A manual fixed id must be added to $mapping = @{} at line ~187

   4. A pester test instruction file is generated and added to /tests/orca/ for each processed test, that instructs Maester to run the below mentioned function and process the result.
   5. A powershell function file is generated and added to /powershell/public/orca/ that contains the logic of initiating and processing the ORCA check result.
   6. A markdown file is generated and added to /powershell/public/orca/ that is associated with the above mentioned PowerShell file in which the description, remediation action and related links are placed.
4. ScriptsToProcess is made available for the Maester module manifest.
5. FunctionsToExport is made available for the Maester module manifest.

When modifying the /build/orca/Update-OrcaTests.ps1 it is important to run it as well in order to build all ORCA test files as described. See How to build?

Test function​

Each test function generated for each ORCA check contains various logic:

1. Skip if not connected to Exchange Online.
2. Set $SCC to true if connected to Security & Compliance, otherwise set to false.
3. If Get-ORCACollection has not been run before and stored in $__MtSession.OrcaCache then execute Get-ORCACollection -SCC:$SCC and store it in the cache.
4. Run the ORCA class New-Object -TypeName <Check> associated with the test upon the ORCA result $obj.Run($Collection) stored in the cache.
5. First, if the ORCA check should be skipped if it SkipInReport is specified in the check output.
6. Second, determine if the ORCA check should be skipped by evaluating if $obj.CheckFailed is true, if $obj.Completed is false or if the check output specifies that this is a Security & Compliance check and we are not connected to Security & Compliance.
7. Determine if the check passed or failed based on $obj.ResultStandard (See ORCA config level for more information).
8. Determine if we need to expand the results of the check $obj.ExpandResults otherwise add details to Maester and return.
9. Expand each nested result in $obj.ExpandResults into a markdown table showing the result of each individual result.
10. Add details to Maester and return.

Markdown file​

Each test function has its associated markdown file that provides Maester with test descriptions. It is comprised of description, remediation action and related links from the ORCA check.

Caveats to be aware of​

ORCA result is only processed once​

Each test will call Get-ORCACollection only if it has not been run and stored in the cache $__MtSession.OrcaCache before.

SkipInReport​

Some ORCA checks might have the property SkipInReport set. This must be handled in each test within a try-catch-finally block due to ORCA returning a Continue statement.

Test name should fit Maester format​

Every ORCA test should fit into the Maester test name format.

Regular expressions​

Regular expressions used to capture the raw content of each ORCA check is carefully crafted and allows us to adapt and overcome differences, such as:

• Always add punctuation to fail recommendation text if not present to stay consistent between tests.
• Dynamically populate name of the test if there are more than one ORCA check (The file name contains _) determined by property uniqueness.
• Replace _ with .
• Capture entire text of ORCA check importance, even if it varies between apostrophe and quotes.
• Remove HTML tags from ORCA check description.

Security & Compliance​

The command Get-ORCACollection requires the parameter of -SCC in order to include Security & Compliance tests in each test. However, we only set this to true if we are connected to Security & Compliance.

⚠️ WARNING: We require each ORCA check to include the property SCC in its object output in order for us to skip it in Maester if we are not connected to Security & Compliance. A pull request has been submitted by Thomas S. Schmidt to add this in the upstream module and is awaiting approval. For now it has been manually implemented in /build/orca/orca/ORCA.psm1 @ line 388 and /build/orca/orca/Checks/check-ORCA242.ps1 @ line 29.

ORCA config level​

Maester base the result on ORCA config level Standard. The property ResultStandard of the ORCA check output will be either Pass or Informational if the test passed.

Results​

With this build script, the Maester module can now dynamically build the necessary files for testing and reporting on all the ORCA controls. Providing users with a single report covering many controls that existed before Maester and which are still valuable.

Acknowledgements​

Huge shoutout to the Maester team for all of their awesome contributions in this substantial addition, including:

• Thomas S. Schmidt @ TDC Erhverv Security Insights
• Cameron Moore
• Cam Murray

Contributors​

• Mike Soule
• Thomas S. Schmidt

Teams using Azure DevOps pipelines can now easily integrate Maester into their CI/CD workflows to run automated security checks and enhance their security monitoring on a daily basis.

Utiziling an Azure web app providing access to the results using Entra id as authentication.

Azure DevOps Web App Flowchart​

Quick Stats​

• 🚀 Automated security tests using Azure DevOps Pipelines updated every 12th hour by default
• 🔥 Up and running within 10 minutes
• 🤝 Viewable Maester reports using Azure Web App
• 🔐 Pipeline with authentication support for Exchange Online, ISSP (using certificate based authentication) and Microsoft Teams

Get Started​

Follow the step-by-step guide to set up Maester in Azure DevOps with required resources:

• Documentation: Set up Maester in Azure DevOps with Web App

Contributor​

• Sebastian Claesson

Teams using BitBucket pipelines can easily integrate Maester into their CI/CD workflows to run automated security checks and enhance their security monitoring.

Maester running on BitBucket​

Why It Matters​

• Run automated Microsoft 365 security tests in BitBucket pipelines
• Quick setup - get started in minutes
• Clear and actionable security test reports

Get Started​

Follow the step-by-step guide to set up Maester in BitBucket:

• Documentation: Set up Maester in BitBucket

Contributor​

• Suryendu Bhattacharyya

Teams using GitLab pipelines can easily integrate Maester into their CI/CD workflows to run automated security checks and enhance their security monitoring.

Maester running on GitLab​

Why It Matters​

• Run automated Microsoft 365 security tests in GitLab pipelines
• Quick setup - get started in minutes
• Clear and actionable security test reports

Get Started​

Follow the step-by-step guide to set up Maester in GitLab:

• Documentation: Set up Maester in GitLab

Contributor​

• Stefan Wey

Maester Terraform Module 🎉​

Quick Stats​

• 🚀 Automated security tests using Azure DevOps Pipelines
• 🔥 Up and running within 5 minutes
• 🤝 Downloadable and viewable Maester reports
• ✳️ Detailed view of each test, including name, duration, and status

DevOps Tests Page​

📚 Documentation​

Follow the step-by-step guide to start using the Terraform Module:

• Azure DevOps with Terraform Module
• Terraform Registry

Contributors 🙏​

We have built this Terraform Module: 👇

_{Merill Fernando}

_{Brian Veldman}

What's Next?​

We are incredibly excited about the Maester Terraform Module and have many ideas for new features and improvements. 🙌

Maester reaches v1! 🎉​

We launched Maester at the PowerShell + DevOps Global Summit in March this year and it has been an amazing journey since then.

Here are some quick stats for you:

• 🚀 100,000+ downloads on PowerShell Gallery
• 🌐 17,000 monthly visitors to maester.dev
• 💻 1,800+ commits on GitHub
• 🤝 48+ contributors
• ✳️ 194 Maester tests
• 📦 155 releases

We have added a lot of new features and improvements based on your feedback. Thank you for that! 🙏

What's new since March v0.1.0​

It’s taken a whole village to bring you Maester v1. 🌟 Here are some of the highlights:

🧪 New Tests​

We've almost doubled the number of tests, growing from 96 to 194! 🎉 Check out the test list for the full breakdown. Special mentions go to:

• Mike – Mike started adding CISA tests to Maester the very next day after Maester was unveiled at the PowerShell conference. 🚀 Since then, he’s been instrumental in contributing code, replying to issues on GitHub, and engaging on Discord. Maester wouldn’t be where it is today without him. Thank you, Mike! 🙌
• Ben – Ben took the initiative to add CIS benchmark tests and is now our #6 highest contributor. Thanks, Ben, for the tremendous value you've brought to Maester! 💪

🤖 Maester GitHub Action​

Fabian built the Maester - GitHub Action, simplifying the setup and running of Maester on GitHub. He completed this just in time for the PowerShell Conference Europe. Thank you, Fabian! 👏

🛡️ Entra ID - Security Config Analyzer Updates​

Thomas has done phenomenal work keeping Maester updated with EIDSCA. His vigilance in monitoring Entra ID and adding new security checks has been invaluable in improving the security posture of countless Entra tenants. 🙏

📊 Pester Test & Report Improvements​

A massive shout-out to Frode Flaten for refactoring the Maester codebase and elevating it to new heights. 🚀 From enhancing performance for PSScriptAnalyzer to improving test reports with filtering and tag support, Frode has made Maester run smoother and more efficiently. Thank you, Frode! 🌟

🛠️ New & Improved Test Folder Installation​

Thanks to Sam Erde for making Maester more robust. From improving the test install/update process to fixing PowerShell mistakes (😉), Sam has been a powerhouse!

🫂 New Teams Tests​

Kudos to Stefan Wey for a whirlwind of contributions! Stefan added new tests for Microsoft Teams meeting policies, fixed Entra Recommendations tests, and ensured PowerShell 5 compatibility. Incredible work! 👏

💬 Teams Alerts​

Thanks to Guido Baijense for adding support to send Teams alerts from Maester using a cmdlet with Adaptive Card templates. 💬

🗨️ Slack Alerts​

Shout-out to Fabrizio Di Carlo for adding Slack alert support to Maester. 💻

☁️ Azure Automation​

Daniel Bradley added Azure Automation support to Maester. 🚀

🏗️ Azure Automation with Bicep​

Brian Veldman elevated Azure Automation by adding Bicep support. Amazing! 🙌

🐳 Azure Container App Job​

Thanks to Mike Soule for enabling Docker and Azure Container App Job support for Maester. ⚙️

🖥️ Azure DevOps - Virtual Machine Scale Set Support​

Ilija Ranogajec added support for running Maester in VMSS hosted agents. Awesome work! 🚀

✍️ New Maester Blog​

We’ve started a new blog to share ideas on tests, security, DevOps, and automation. Don’t forget to subscribe via RSS! 📰

📚 Test Documentation Updates​

Big thanks to the following contributors for improving remediation steps for tests, making them clearer and easier to follow:

• Michael Morten Sonne
• Jan Bakker
• Christian Frohn

Thank you to all our amazing contributors! 🙏​

There are many, many more new features, improvements and fixes that have gone in by this amazing list of contributors 👇

_{Mike Soule}

_Fabian

_Thomas

_{Frode Flaten}

_Ben

_{Sam Erde}

_{Michael Sonne}

_{Christian Frohn}

_{Stefan Wey}

_{Daniel Bradley}

_{Thomas Schmidt}

_{Adam Laycock}

_{Guido Baijense}

_corpca-Admin

_{Ben Street}

_dnsinit

_{Erik Oppedijk}

_{Tom Biscardi}

_{Brian Veldman}

_{Tom Pye}

_{Marco Deleu}

_{Pranav Kothare}

_{PT Mohr}

_{Daniel Wahlgren}

_{Tommi Laukkanen}

_{Wes MacDonald}

_{Nathan McNulty}

_{Joshua Fernando}

_{Milan Schwartz}

_{Irwin Strachan}

_{Fabrizio Di Carlo}

_{Ilija Ranogajec}

_{Jan Bakker}

_{Robin Dadswell}

_{Frederik Leed}

_{Thorsten Sauter}

_{Håkon Kristiansen}

_{Jeroen Burgerhout}

_m-hanisch

_{Matt Cave}

_Lennart

_Jean-Paul

_{Petter Fauske}

_{Gerald Lasch}

_{Thomas Balthazar}

_{Stephan van Rooij}

_mircodemo

What's next?​

We are super excited about the future of Maester and we have a lot of ideas for new features and improvements. We are even more excited to have you come and shape the future of Maester with us! 🙌

We've created a repository to host slide decks that you can use to get started.

You can find the slide decks in the Maester Content Hub.

If you make updates, create a new variation or have a slide deck or other content that you would like to share, please create a pull request.

We would love to see your contributions!

Sign up for the Discord event here and click Interested to be alerted when the AMA starts.

When?​

Click on the Discord event link to see the date and time in your timezone.

You can find the steps in the Teams Alerts page.

A huge shout out to Guido Baijense for contributing the code for this feature!

This is what I really ❤️ about the Maester community. 🙏

Next up, we need to add this as configurable option to the GitHub Action. This way you can easily enable it for your workflows without having to write scripts. If you are interested in helping out with this, check out the action.yml that needs to be updated.

Reach out on the Maester channel on our Discord server if you have any questions or feedback.

Welcome to the Maester blog. The Maester blog is a place where Maester contributors will share their thoughts on all things Maester. We will share updates, breaking changes, tutorials, why we made certain decisions, and much more.

If you are interested in contributing to this blog, please feel free to submit a PR to the Maester repository blog.