Test your Microsoft 365 security, every day, in one run.
Maester
PS>Install-Module Maester -AllowPrereleaseInstall-Module MaesterInstalls the 3.0 preview, which these docs describe. About the previewInstalls the stable release, 2.3.0. 2.x docs
Runs on Windows, macOS and Linux · Nothing leaves your tenant
One page that says how your tenant is doing, what changed since the last run, and what to fix first.
How it works
From install to a report in five minutes.
Install the module, connect to your tenant, run it, with Microsoft's Zero Trust Assessment in the same pass. Watch the whole run.
Transcript
Maester. This is Maester: the open-source way to test your Microsoft 365 security, every day, in one run.
Install. Install it from the PowerShell Gallery. Every check ships inside the module, so there's nothing else to set up.
Connect. Connect Maester to your tenant. It reads your configuration with read-only permissions, and nothing leaves your tenant.
Run. Now run Invoke-Maester. Add the Zero Trust Assessment pack, and Microsoft's own assessment runs in the same pass.
Watch it run. The console shows every product as it's tested, the checks running right now, and the results as they land: over twelve hundred checks across CIS, CISA, Microsoft's guidance and Zero Trust.
The report. When the run finishes, your report opens. It tells you what to fix first, ranked by severity and effort.
Every finding. Every finding explains what an attacker could do, what Maester found, and exactly how to fix it.
Frameworks. See where you stand against the frameworks your auditors ask about, and the attack techniques each gap leaves open.
Zero Trust. And Microsoft's Zero Trust Assessment sits right alongside, in the same report.
Automate. Run it every day in GitHub Actions or Azure DevOps, and know the moment something changes.
Maester Cloud. Or run it with Maester Cloud, securely, in your own Azure subscription: your data never leaves your tenant. Find out more at maester.cloud, and get started at maester.dev.
- 1Install
Install-Module Maester - 2Connect
Connect-Maester - 3Run
Invoke-Maester -Pack ZTA - 4Automate
maester-action@main
Watch and listen
Maester on Entra.Chat
Coverage
One run. Every framework your auditors ask about.
Each check names the requirement it implements, so one report answers CIS, CISA and Microsoft's own guidance at once. Every check is also mapped to MITRE ATT&CK techniques and NIST SP 800-53 controls.
Microsoft Zero Trust Assessment
Microsoft's Zero Trust Assessment, inside your Maester report.
The Zero Trust Assessment pack ships with Maester. It runs Microsoft's assessment in its own PowerShell session and puts all 336 results next to Maester's checks, in one report and one pipeline.
How the pack works →# Run Maester and the Zero Trust Assessment together
Invoke-Maester -Pack ZTANew in 3.0
What's new in Maester 3.0.
Automate
Run it every day, wherever you already deploy.
Maester Packs
Extend Maester with packs.
Write your own
Write your policies as tests.
A Maester test is one PowerShell function with an attribute that says what it checks. Maester finds it, runs it with the built-in checks and puts it in the same report.
function Test-CT1001 { [MaesterTest( Id = 'CT.1001', Title = 'Only admins and guest inviters can invite guests', Severity = 'Medium', Service = 'Graph' )] param() $policy = Invoke-MtGraphRequest -RelativeUri 'policies/authorizationPolicy' $policy.allowInvitesFrom -in 'adminsAndGuestInviters', 'none' }
Checks for the services you actually run.
Sponsors
Maester is free because these sponsors pay for the work.
Sponsorship pays for maintainer time and the test tenants every check is proven against. It never buys a say in what a check reports.
Maester Cloud
Need history, drift and every tenant in one place?
Maester Cloud keeps your results over time, shows what changed between runs and alerts you when it does. Your subscription also keeps the Maester core open and free.
Community
Built in the open by 74+ contributors.
Maester is written by security practitioners, Microsoft MVPs and Microsoft engineers. Ask questions on Discord, add a check to the catalog, or write a pack.
