Introducing Maester 2.0

We’re excited to announce Maester 2.0 - our biggest release yet! With over 400 commits since version 1.3.0, this release brings powerful new capabilities for Microsoft 365 security testing.

• Brand new reporting capabilities with print, markdown, and Excel export views
• New Security Tests covering Intune, Entra ID, Conditional Access and Azure
• Microsoft Security Exposure Management (XSPM) Integration - Leverage Defender insights
• Enhanced HTML Report with print, markdown, and Excel export views
• Emergency Access Accounts Configuration - Define your break-glass accounts
• New Maester App Management Commands - Simplified DevOps pipeline setup

Here’s a deeper dive into what’s new in Maester 2.0:

The Maester report has been completely redesigned with new views and capabilities.

We’ve added over 15 new tests to help you secure your Microsoft 365 environment. Here are the highlights:

Why it matters:

• Prevent shadow IT by restricting tenant and group creation
• Protect your hybrid identity by blocking on-prem sync attacks
• Secure your Azure backup infrastructure

How to use:

# Run all new tests
Invoke-Maester -Tag "MT.1068", "MT.1069", "MT.1070"

# Run all Entra tests
Invoke-Maester -Tag "Entra"

A brand new category! Integrate with Microsoft Security Exposure Management to test for exposure risks across your environment.

Why it matters:

• Identify attack paths before attackers do
• Prioritize remediation based on exposure risk
• Leverage Microsoft’s threat intelligence

How to use:

# Run XSPM tests
Invoke-Maester -Tag "XSPM"

# Check for credential exposure
Invoke-Maester -Tag "XSPM" -Path ./tests/XSPM

The Maester report has been completely redesigned with new views and capabilities.

Why it matters:

• Share results with stakeholders in their preferred format
• Track remediation progress over time
• Present findings to leadership with professional reports

How to use:

# Generate the enhanced report
Invoke-Maester -OutputFolder ./results

# Open the HTML report and explore the new views
# Click the tabs: Print | Markdown | Excel | Config

Define your break-glass accounts in the Maester configuration to improve test accuracy.

Why it matters:

• Tests correctly identify your emergency access accounts
• No more false positives on Conditional Access exclusions
• Audit trail for break-glass account usage

How to use:

Edit your maester-config.json:

{
  "GlobalSettings": {
    "EmergencyAccessAccounts": [
      "[email protected]",
      "break-glass-group-id"
    ]
  }
}

Then run your tests:

Invoke-Maester
# Tests will now recognize your defined emergency access accounts

New cmdlets to simplify setting up Maester for DevOps pipelines.

Why it matters:

• One command to set up your DevOps app registration
• Automatically configures the minimum required permissions
• Supports workload identity federation for GitHub Actions

How to use:

# Create a new Maester app for GitHub Actions
New-MtMaesterApp -Name "Maester Pipeline" -GitHubOrganization "myorg" -GitHubRepository "maester-tests"

# Include mail sending for notifications
New-MtMaesterApp -Name "Maester Pipeline" -SendMail

# Add federated credential to existing app
Add-MtMaesterAppFederatedCredential -GitHubOrganization "myorg" -GitHubRepository "maester-tests"

A new command to discover and explore available tests.

Why it matters:

• Understand what tests are available before running
• Filter tests by tags or capabilities
• Export inventory for documentation

How to use:

# Get all available tests grouped by tag
$inventory = Get-MtTestInventory

# View tests for a specific tag
$inventory['CIS']

# Export inventory to CSV
Get-MtTestInventory -OutputType CSV -ExportPath ./TestInventory.csv

• Optimized Invoke-MtGraphRequest for faster batch operations
• Improved ConvertTo-QueryString with better null handling

• Enhanced CISA test accuracy and reliability
• Individual test IDs for CA What-If analysis

• Improved DKIM test with skip logic for onmicrosoft.com domains
• Cleaner test names without level numbers for better readability

• Refactored health issue detection
• Better integration with MDI alerts

This release wouldn’t be possible without our amazing community:

• @tdcthosc - CISA improvements, CIS refactors, Invoke-Maester enhancements
• @f-bader - Emergency access accounts feature
• @HenrikPiecha - MT.1070, MT.1071, MT.1073 tests
• @marcel-ngn - MT.1068, MT.1069 tests
• @RobbeVandenDaele - XSPM device checks
• @SamErde - Bug fixes and workflow improvements
• @brianveldman - Azure security tests
• @l-gosling - GitLab and Teams integration
• @kij - HTML report improvements
• And many more!

Update to Maester 2.0 today:

# Update the Maester module
Update-Module Maester -Force

# Update your test files
cd maester-tests
Update-MaesterTests

# Run the tests with the new features
Invoke-Maester

• Maester Documentation
• GitHub Repository
• Join us on Discord

Have feedback or found a bug? Open an issue on GitHub!

Happy testing! 🎉