Pending approvals for Critical Asset Management should not be present
Part of Maester · Defender · Exposure Management · All checks
Invoke-Maester -TestId MT.1085Overview
Section titled “Overview”Microsoft provides an approval step for assets that do not meet the automatic classification threshold. Assets with a lower classification confidence score must be approved by a Security Administrator. Stale pending approvals can lead to limited visibility in Microsoft Defender XDR and potential security risks if critical assets are not properly identified.
Therefore, you should regularly review critical assets to ensure the correct classification has been applied to your assets.
How to fix
Section titled “How to fix”On the Critical asset management page, review the asset classification named in the Maester test results. Review the pending approvals and verify the correct classification of the listed assets.
More details are available in the Microsoft Learn article: “Add assets to predefined classifications”.
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | MT.1085 |
| Severity | Low |
| Suite | Maester |
| Product | Defender |
| Feature | Exposure Management |
| Area | Logging and detection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtXspmPendingApprovalCriticalAssetManagement |
| Services | Graph |
Source
Section titled “Source”- Test:
tests/maester/xspm/Test.MT.1085.ps1 - Documentation:
tests/maester/xspm/Test.MT.1085.md