Maester Tests

These tests are maintained by the Maester community and validate Microsoft 365, Microsoft Entra, Defender, Intune, and related security configurations.

269 checks89 High126 Medium48 Low6 Info

Run theseInvoke-Maester -Suite maester,xspm

AZDO.1000Azure DevOps OAuth apps can access resources in your organization through OAuth.New in 3.0

Security policiesAuthenticationHighMediumLowT1528, T1671—Maester AZDO.1001Identities can connect to your organization's Git repos through SSH.New in 3.0

Security policiesAuthenticationHighMediumMediumT1552.004, T1098.001—Maester AZDO.1002Log Audit Events.New in 3.0

AuditingLogging and detectionHighLowLowT1685.002nist-800-53-r5:AU-12, nist-800-53-r5:AU-2Maester AZDO.1003Restrict public projects.New in 3.0

Security policiesExternal access and sharingHighLowLowT1213.003, T1593.003nist-800-53-r5:AC-22, nist-800-53-r5:AC-3Maester AZDO.1004Additional protections when using public package registries.New in 3.0

Security policiesEngineering systemsHighLowLowT1195.001, T1204.005nist-800-53-r5:SR-3Maester AZDO.1005IP Conditional Access policy validation.New in 3.0

Security policiesAccess controlHighMediumLowT1078.004, T1550.001nist-800-53-r5:AC-17Maester AZDO.1010Audit streaming.New in 3.0

AuditingLogging and detectionHighLowMediumT1685.002, T1070nist-800-53-r5:AU-6, nist-800-53-r5:SI-4Maester AZDO.1013Organization Owner should not be an individual.New in 3.0

Users and accessPrivileged accessHighLowLowT1078.004—Maester AZDO.1015Limit variables that can be set at queue time.New in 3.0

PipelinesEngineering systemsHighLowLowT1677nist-800-53-r5:SI-10Maester AZDO.1016Limit job authorization scope to current project for non-release pipelines.New in 3.0

PipelinesEngineering systemsHighMediumMediumT1550.001, T1213.003nist-800-53-r5:AC-6Maester AZDO.1017Limit job authorization scope to current project for classic release pipelines.New in 3.0

PipelinesEngineering systemsHighMediumMediumT1550.001, T1213.003nist-800-53-r5:AC-6Maester AZDO.1018Protect access to repositories in YAML pipelines.New in 3.0

PipelinesEngineering systemsHighMediumMediumT1550.001, T1213.003nist-800-53-r5:AC-3, nist-800-53-r5:AC-6Maester AZDO.1022Limit building pull requests from forked GitHub repositories.New in 3.0

PipelinesEngineering systemsHighLowLowT1677—Maester AZDO.1023Disable Marketplace tasks.New in 3.0

PipelinesEngineering systemsHighMediumHighT1195.001nist-800-53-r5:CM-7, nist-800-53-r5:CM-11Maester AZDO.1025Enable shell tasks arguments validation.New in 3.0

PipelinesEngineering systemsHighLowLowT1059, T1677nist-800-53-r5:SI-10Maester AZDO.1030Project Collection Administrators.New in 3.0

Users and accessPrivileged accessHighLowMediumT1078.004, T1098.003nist-800-53-r5:AC-6(5)Maester AZDO.1031Validate SSH Key Expiration.New in 3.0

Security policiesAuthenticationHighMediumLowT1552.004nist-800-53-r5:IA-5Maester AZDO.1032(Tenant) Restrict creation of global Personal Access Tokens.New in 3.0

Security policiesAuthenticationHighLowLowT1528, T1550.001nist-800-53-r5:IA-5Maester AZDO.1033(Tenant) Enable automatic revocation of leaked Personal Access Tokens.New in 3.0

Security policiesAuthenticationHighLowLowT1552.001, T1593.003 +1nist-800-53-r5:IA-5Maester AZDO.1035(Tenant) Restrict Personal Access Token lifespan.New in 3.0

Security policiesAuthenticationHighMediumLowT1528, T1550.001nist-800-53-r5:IA-5Maester AZDO.1036(Tenant) Restrict Personal Access Token full scope.New in 3.0

Security policiesAuthenticationHighLowLowT1528, T1550.001nist-800-53-r5:AC-6Maester AZDO.1037(Organization) Restrict Personal Access Token creation.New in 3.0

Security policiesAuthenticationHighMediumMediumT1528, T1550.001nist-800-53-r5:IA-5Maester AZDO.1040(Organization) Secret Protection: existing repositories enrolled.New in 3.0

RepositoriesEngineering systemsHighLowMediumT1552.001nist-800-53-r5:IA-5(7)Maester AZDO.1041(Organization) Secret Protection: push protection blocks secret commits.New in 3.0

RepositoriesEngineering systemsHighLowLowT1552.001nist-800-53-r5:IA-5(7)Maester MT.1003At least one Conditional Access policy is configured with All Apps.

Conditional AccessAccess controlHighMediumMediumT1078.004—Maester MT.1004At least one Conditional Access policy is configured with All Apps and All Users.

Conditional AccessAccess controlHighMediumMediumT1078.004—Maester MT.1005All Conditional Access policies are configured to exclude at least one emergency/break glass account or group.

Conditional AccessPrivileged accessHighLowLow——Maester MT.1006At least one Conditional Access policy is configured to require MFA for admins.

Conditional AccessPrivileged accessHighLowLowT1078.004, T1110nist-800-53-r5:IA-2(1)Maester MT.1007At least one Conditional Access policy is configured to require MFA for all users.

Conditional AccessAuthenticationHighMediumMediumT1078.004, T1110nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2)Maester MT.1008At least one Conditional Access policy is configured to require MFA for Azure management.

Conditional AccessPrivileged accessHighLowLowT1078.004, T1110nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2)Maester MT.1009At least one Conditional Access policy is configured to block other legacy authentication.

Conditional AccessAuthenticationHighMediumMediumT1078.004, T1110nist-800-53-r5:CM-7Maester MT.1010At least one Conditional Access policy is configured to block legacy authentication for Exchange ActiveSync.

Conditional AccessAuthenticationHighMediumMediumT1078.004, T1110nist-800-53-r5:CM-7Maester MT.1011At least one Conditional Access policy is configured to secure security info registration only from a trusted location.

Conditional AccessAuthenticationHighMediumMediumT1078.004, T1098.005nist-800-53-r5:AC-17, nist-800-53-r5:IA-5Maester MT.1014At least one Conditional Access policy is configured to require compliant or Entra hybrid joined devices for admins.

Conditional AccessPrivileged accessHighLowMediumT1078.004, T1539 +1nist-800-53-r5:IA-3, nist-800-53-r5:AC-2(11)Maester MT.1016At least one Conditional Access policy is configured to require MFA for guest access.

Conditional AccessAuthenticationHighMediumLowT1078.004, T1110nist-800-53-r5:IA-2(1), nist-800-53-r5:AC-20Maester MT.1021Security Defaults are enabled.

User and directory settingsAuthenticationHighMediumLowT1078.004, T1110nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2)Maester MT.1025No external user with permanent role assignment on Control Plane.

Roles and administratorsPrivileged accessHighLowMediumT1078.004, T1199nist-800-53-r5:AC-6(5), nist-800-53-r5:AC-2(7)Maester MT.1026No hybrid user with permanent role assignment on Control Plane.

Roles and administratorsPrivileged accessHighLowMediumT1078.004, T1556.007 +1nist-800-53-r5:AC-6(5), nist-800-53-r5:AC-2(7)Maester MT.1027No Service Principal with Client Secret and permanent role assignment on Control Plane.

Roles and administratorsPrivileged accessHighLowMediumT1078.004, T1552nist-800-53-r5:AC-6(5), nist-800-53-r5:IA-5Maester MT.1028No user with mailbox and permanent role assignment on Control Plane.

Roles and administratorsPrivileged accessHighLowMediumT1078.004, T1566nist-800-53-r5:AC-6(5), nist-800-53-r5:AC-6(2)Maester MT.1029Stale accounts are not assigned to privileged roles.

Privileged Identity ManagementPrivileged accessHighLowLowT1078.004nist-800-53-r5:AC-2(3), nist-800-53-r5:AC-6(5)Maester MT.1030Eligible role assignments on Control Plane are in use by administrators.

Privileged Identity ManagementPrivileged accessHighLowLowT1078.004nist-800-53-r5:AC-6, nist-800-53-r5:AC-2(3)Maester MT.1031Privileged role on Control Plane are managed by PIM only.

Privileged Identity ManagementPrivileged accessHighLowMediumT1098.003nist-800-53-r5:AC-2(7), nist-800-53-r5:AC-6(5)Maester MT.1032Limited number of Global Admins are assigned.

Privileged Identity ManagementPrivileged accessHighLowMediumT1078.004, T1098.003nist-800-53-r5:AC-6(5)Maester MT.1033Users should be blocked from using legacy authentication.

Conditional AccessAuthenticationHighMediumMediumT1078.004, T1110nist-800-53-r5:CM-7Maester MT.1034Emergency access users should not be blocked.

Conditional AccessPrivileged accessHighLowLow——Maester MT.1035All security groups assigned to Conditional Access Policies should be protected by RMAU.

Conditional AccessPrivileged accessHighLowMediumT1098, T1556.009nist-800-53-r5:AC-6, nist-800-53-r5:AC-3Maester MT.1049Conditional Access policies for User Risk and Sign-in Risk should be configured separately.

Conditional AccessAccess controlHighLowLowT1078.004nist-800-53-r5:AC-2(12)Maester MT.1050Apps with high-risk permissions having a direct path to Global Administrator-IncludePreview

App consent and permissionsApplications and workload identitiesHighLowMediumT1078.004, T1098.001 +1nist-800-53-r5:AC-6Maester MT.1051Apps with high-risk permissions having an indirect path to Global Administrator-IncludePreview

App consent and permissionsApplications and workload identitiesHighLowMediumT1078.004, T1098.001 +1nist-800-53-r5:AC-6Maester MT.1052At least one Conditional Access policy is targeting the Device Code authentication flow.

Conditional AccessAuthenticationHighLowLowT1078.004, T1528 +1nist-800-53-r5:CM-7, nist-800-53-r5:IA-2Maester MT.1056Ensure that no person has permanent access to all Azure subscriptions at the root scope

Access managementPrivileged accessHighLowLowT1078.004, T1098.003nist-800-53-r5:AC-6(5), nist-800-53-r5:AC-2Maester MT.1063All App registration owners should have MFA registered

Authentication methodsAuthenticationHighLowLowT1078.004, T1098.001 +1nist-800-53-r5:IA-2(1), nist-800-53-r5:AC-6Maester MT.1065Ensure all Recovery Services Vaults have soft delete enabled

BackupData protectionHighLowLowT1490, T1485nist-800-53-r5:CP-9Maester MT.1072Conditional Access policies should not use the deprecated Approved Client App grant.

Conditional AccessAccess controlHighMediumMediumT1078.004nist-800-53-r5:AC-2(11), nist-800-53-r5:IA-3Maester MT.1084Microsoft Entra seamless single sign-on should be disabled for all domains in EntraID Connect servers.

Hybrid identityAuthenticationHighMediumMediumT1110, T1558.002nist-800-53-r5:CM-7, nist-800-53-r5:IA-2Maester MT.1087Devices should not be publicly exposed with remotely exploitable, highly likely to be exploited, high or critical severity CVE's.

Exposure ManagementDevices and endpointsHighLowMediumT1190—Exposure management (XSPM)MT.1092Intune APNS certificate should be valid for more than 30 days

Tenant administrationDevices and endpointsHighLowLow——Maester MT.1093Apple Automated Device Enrollment Tokens should be valid for more than 30 days

Tenant administrationDevices and endpointsHighLowLow——Maester MT.1094Apple Volume Purchase Program Tokens should be valid for more than 30 days

Tenant administrationDevices and endpointsHighLowLow——Maester MT.1095Android Enterprise account connection should be healthy

Tenant administrationDevices and endpointsHighLowLow——Maester MT.1097Ensure all Intune Certificate Connectors are healthy and running supported versions

Tenant administrationDevices and endpointsHighLowMedium——Maester MT.1098Mobile Threat Defense Connectors should be healthy

Tenant administrationDevices and endpointsHighLowLow——Maester MT.1100Intune Diagnostic Settings should include Audit Logs

Tenant administrationLogging and detectionHighLowMediumT1685.002nist-800-53-r5:AU-12Maester MT.1102Windows Feature Update Policy Settings should not reference end of support builds

Device configurationDevices and endpointsHighMediumMedium—nist-800-53-r5:SI-2Maester MT.1103Ensure Intune RBAC groups are protected by Restricted Management Administrative Units or Role Assignable groups

Tenant administrationPrivileged accessHighLowMediumT1098.003nist-800-53-r5:AC-6, nist-800-53-r5:AC-3Maester MT.1113AI agents should not be shared with broad access control policies.

AgentsAI and agentsHighMediumMediumT1213nist-800-53-r5:AC-3Maester MT.1114AI agents should require user authentication.

AgentsAI and agentsHighMediumMediumT1213nist-800-53-r5:IA-2Maester MT.1116AI agents should not send email with AI-controlled inputs.

AgentsAI and agentsHighLowMediumT1048nist-800-53-r5:AC-4Maester MT.1119AI agents should not have hard-coded credentials in topics.

AgentsAI and agentsHighLowMediumT1552nist-800-53-r5:IA-5(7)Maester MT.1123Ensure BitLocker full disk encryption is configured

Endpoint securityDevices and endpointsHighLowMediumT1005nist-800-53-r5:SC-28(1)Maester MT.1147Do not sync krbtgt_AzureAD to Entra ID.

Hybrid identityInfrastructure hardeningHighLowLowT1558nist-800-53-r5:IA-5, nist-800-53-r5:AC-6Maester MT.1149Behavior Monitoring should be enabled.

Endpoint antivirusDevices and endpointsHighLowLowT1204.002nist-800-53-r5:SI-3Maester MT.1150Cloud Protection should be enabled.

Endpoint antivirusDevices and endpointsHighLowLowT1204.002nist-800-53-r5:SI-3Maester MT.1152Script Scanning should be enabled.

Endpoint antivirusDevices and endpointsHighLowLowT1059nist-800-53-r5:SI-3Maester MT.1153Real-time Monitoring should be enabled.

Endpoint antivirusDevices and endpointsHighLowLowT1204.002nist-800-53-r5:SI-3Maester MT.1165Network Protection should be enabled.

Endpoint antivirusDevices and endpointsHighLowLowT1204.001, T1189 +1nist-800-53-r5:SI-3Maester MT.1172Unified audit log ingestion is enabled.

AuditLogging and detectionHighLowLowT1685.002nist-800-53-r5:AU-12Maester MT.1178Ensure ASR Rules are configured correctly.

Endpoint securityDevices and endpointsHighLowLowT1003.001, T1546.003 +1nist-800-53-r5:CM-7, nist-800-53-r5:SI-3Maester MT.1179Ensure App Control for Business is enabled.

Endpoint securityDevices and endpointsHighHighHighT1204.002nist-800-53-r5:CM-7(5)Maester MT.1181Conditional Access policy is present that blocks high agent risk sign-ins.

Conditional AccessAI and agentsHighLowLowT1078.004nist-800-53-r5:AC-2(12), nist-800-53-r5:AC-2(13)Maester MT.1207Foreign or multi-tenant Agent Blueprint Principals and Agent Identities should not hold privileged directory roles (Preview).-IncludePreview

Agent identitiesPrivileged accessHighLowMediumT1078.004, T1199nist-800-53-r5:AC-6, nist-800-53-r5:AC-20Maester MT.1209Agent Identities and Blueprint Principals should not be assigned privileged Entra directory roles (Preview).-IncludePreview

Agent identitiesPrivileged accessHighLowMediumT1078.004, T1098.003nist-800-53-r5:AC-6(5)Maester MT.1210Agent Users should not have privileged directory roles or membership in role-assignable groups (Preview).-IncludePreview

Agent identitiesPrivileged accessHighLowMediumT1078.004, T1098.003nist-800-53-r5:AC-6(5)Maester MT.1211Agent Identity Blueprints should not use the allAllowed inheritance pattern for delegated scopes or application roles (Preview).-IncludePreview

Agent identitiesAI and agentsHighLowMediumT1078.004nist-800-53-r5:AC-6Maester MT.1213Agent Identity Blueprints should not use wildcard or plain-http redirect URIs (Preview).-IncludePreview

Agent identitiesAI and agentsHighLowLowT1557nist-800-53-r5:SC-23, nist-800-53-r5:SC-8Maester MT.1217Ensure macOS LAPS is configured on Automated Device Enrollment profiles.

Device enrollmentPrivileged accessHighLowLowT1078.003, T1021 +1nist-800-53-r5:IA-5Maester MT.1223Agent Identities should not have high-risk Microsoft Graph permissions (Preview).-IncludePreview

Agent identitiesAI and agentsHighLowMediumT1078.004, T1098.001 +1nist-800-53-r5:AC-6Maester MT.1259Baseline scope sign-ins should be subject to Conditional Access.New in 3.0-IncludePreview

Conditional AccessAccess controlHighMediumMediumT1078.004, T1087.004nist-800-53-r5:AC-3Maester AZDO.1006External Users access.New in 3.0

Users and accessExternal access and sharingMediumMediumLowT1078.004nist-800-53-r5:AC-3, nist-800-53-r5:AC-21Maester AZDO.1007Team and project administrator are allowed to invite new users.New in 3.0

Users and accessAccess controlMediumLowLowT1136.003—Maester AZDO.1014Anonymous access to pipeline badges.New in 3.0

PipelinesExternal access and sharingMediumLowLowT1593.003—Maester AZDO.1019Stage chooser.New in 3.0

PipelinesEngineering systemsMediumMediumLow——Maester AZDO.1020Creation of classic build pipelines.New in 3.0

PipelinesEngineering systemsMediumMediumLow——Maester AZDO.1021Creation of classic release pipelines.New in 3.0

PipelinesEngineering systemsMediumMediumLow——Maester AZDO.1024Disable Node 6 tasks.New in 3.0

PipelinesEngineering systemsMediumLowLow—nist-800-53-r5:SI-2Maester AZDO.1026Enable automatic enrollment to Advanced Security for Azure DevOps.New in 3.0

RepositoriesEngineering systemsMediumLowMediumT1552.001, T1195.001 +1nist-800-53-r5:SA-11, nist-800-53-r5:IA-5(7)Maester AZDO.1028Disable creation of TFVC repositories.New in 3.0

RepositoriesEngineering systemsMediumLowLow——Maester AZDO.1034(Tenant) Restrict creation of new Azure DevOps organizations.New in 3.0

Organization policiesAccess controlMediumLowLow——Maester AZDO.1038(Organization) Disallow extensions from accessing resources on the local network.New in 3.0

Security policiesApplications and workload identitiesMediumLowLowT1190—Maester AZDO.1039(Organization) Secret Protection: new repositories enrolled automatically.New in 3.0

RepositoriesEngineering systemsMediumLowMediumT1552.001nist-800-53-r5:IA-5(7)Maester AZDO.1042(Organization) Code Security: new repositories enrolled automatically.New in 3.0

RepositoriesEngineering systemsMediumLowMediumT1195.001, T1190nist-800-53-r5:SA-11Maester AZDO.1043(Organization) Code Security: existing repositories enrolled.New in 3.0

RepositoriesEngineering systemsMediumLowMediumT1195.001, T1190nist-800-53-r5:SA-11Maester AZDO.1044(Organization) Code Security: dependency and CodeQL alerts enabled.New in 3.0

RepositoriesEngineering systemsMediumLowLowT1195.001, T1190nist-800-53-r5:SA-11, nist-800-53-r5:SI-2Maester MT.1001At least one Conditional Access policy is configured with device compliance.

Conditional AccessAccess controlMediumMediumMediumT1078.004nist-800-53-r5:AC-2(11), nist-800-53-r5:IA-3Maester MT.1002App management restrictions on applications and service principals is configured and enabled.

ApplicationsApplications and workload identitiesMediumLowMediumT1078.004, T1098.001 +1—Maester MT.1012At least one Conditional Access policy is configured to require MFA for risky sign-ins.

Conditional AccessAuthenticationMediumLowLowT1078.004, T1110nist-800-53-r5:AC-2(12), nist-800-53-r5:IA-2(1)Maester MT.1013At least one Conditional Access policy is configured to require new password when user risk is high.

Conditional AccessAuthenticationMediumLowLowT1078.004nist-800-53-r5:AC-2(12), nist-800-53-r5:IA-5Maester MT.1015At least one Conditional Access policy is configured to block access for unknown or unsupported device platforms.

Conditional AccessAccess controlMediumMediumLowT1078.004nist-800-53-r5:AC-2(11), nist-800-53-r5:CM-7Maester MT.1017At least one Conditional Access policy is configured to enforce non persistent browser session for non-corporate devices.

Conditional AccessAuthenticationMediumMediumLowT1539, T1550.004nist-800-53-r5:AC-19, nist-800-53-r5:AC-12Maester MT.1018At least one Conditional Access policy is configured to enforce sign-in frequency for non-corporate devices.

Conditional AccessAuthenticationMediumMediumLowT1539, T1550.004nist-800-53-r5:IA-11, nist-800-53-r5:AC-12Maester MT.1019At least one Conditional Access policy is configured to enable application enforced restrictions.

Conditional AccessAccess controlMediumMediumMediumT1213.002, T1530—Maester MT.1020All Conditional Access policies are configured to exclude Directory/OnPremises synchronization accounts or do not scope them.

Conditional AccessAccess controlMediumLowLow——Maester MT.1024Entra recommendations should be completed.

Entra recommendationsInfrastructure hardeningMediumLowMedium——Maester MT.1036All excluded objects should have a fallback include in another policy.

Conditional AccessAccess controlMediumLowMediumT1078.004—Maester MT.1038Conditional Access policies should not include or exclude deleted groups.

Conditional AccessAccess controlMediumLowLowT1078.004—Maester MT.1041Ensure users installing Outlook add-ins is not allowed

Exchange Online

OutlookApplications and workload identitiesMediumMediumLowT1137.006, T1114.002nist-800-53-r5:CM-7, nist-800-53-r5:CM-11Maester MT.1042Restrict dial-in users from bypassing a meeting lobby

MeetingsExternal access and sharingMediumLowLow—nist-800-53-r5:AC-3Maester MT.1043Ensure Spam confidence level (SCL) is configured in mail transport rules with specific domains

Exchange Online

Mail flowEmail and collaboration protectionMediumLowMediumT1566nist-800-53-r5:SI-8Maester MT.1045Only invited users should be automatically admitted to Teams meetings

MeetingsExternal access and sharingMediumMediumLow—nist-800-53-r5:AC-3Maester MT.1046Restrict anonymous users from joining meetings

MeetingsExternal access and sharingMediumMediumLow—nist-800-53-r5:AC-3Maester MT.1047Restrict anonymous users from starting Teams meetings

MeetingsExternal access and sharingMediumLowLow—nist-800-53-r5:AC-3Maester MT.1048Limit external participants from having control in a Teams meeting

MeetingsExternal access and sharingMediumLowLow—nist-800-53-r5:AC-6Maester MT.1054Ensure built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant'

Device complianceDevices and endpointsMediumMediumMediumT1078.004nist-800-53-r5:AC-19, nist-800-53-r5:CM-6Maester MT.1057App registrations should no longer use secrets.

ApplicationsApplications and workload identitiesMediumLowHighT1078.004, T1552nist-800-53-r5:IA-5Maester MT.1058Exchange application access policies must be configured.

App consent and permissionsApplications and workload identitiesMediumLowMediumT1114.002nist-800-53-r5:AC-6, nist-800-53-r5:AC-3Maester MT.1059Microsoft Defender for Identity health issues should be resolved

Defender for IdentityLogging and detectionMediumLowMedium——Maester MT.1060Drift folders should match their baseline.New in 3.0

Configuration driftInfrastructure hardeningMediumLowLow——Maester MT.1061Device registration MFA control conflicts with Conditional Access policies.

Conditional AccessAuthenticationMediumLowLowT1098.005—Maester MT.1062Ensure Direct Send is set to be rejected

Exchange Online

Mail flowEmail and collaboration protectionMediumMediumMediumT1566, T1684.002nist-800-53-r5:CM-7Maester MT.1064Ensure that write permissions are required to create new management groups

Management groupsAccess controlMediumLowLowT1666nist-800-53-r5:AC-6Maester MT.1066Conditional Access policies should not reference non-existent users, groups, or roles.

Conditional AccessAccess controlMediumLowLowT1078.004—Maester MT.1068Restrict non-admin users from creating tenants.

User and directory settingsAccess controlMediumLowLow—nist-800-53-r5:AC-6, nist-800-53-r5:CM-7Maester MT.1070Restrict device join to selected users/groups or none.

Device identityDevices and endpointsMediumLowLowT1098.005nist-800-53-r5:AC-6, nist-800-53-r5:IA-3Maester MT.1071At least one Conditional Access policy explicitly includes Azure DevOps.

Conditional AccessAccess controlMediumLowLowT1078.004nist-800-53-r5:AC-3Maester MT.1073Soft- and hard-matching of synchronized objects should be blocked.

Hybrid identityInfrastructure hardeningMediumLowLowT1078.004, T1098nist-800-53-r5:IA-4, nist-800-53-r5:CM-6Maester MT.1075Require explicit assignment of Third Party Entra Apps.

ApplicationsApplications and workload identitiesMediumMediumHighT1078.004nist-800-53-r5:AC-3, nist-800-53-r5:AC-6Maester MT.1077App registrations with privileged API permissions should not have owners.

Exposure ManagementApplications and workload identitiesMediumLowMediumT1098.001nist-800-53-r5:AC-6Exposure management (XSPM)MT.1078App registrations with highly privileged directory roles should not have owners.

Exposure ManagementApplications and workload identitiesMediumLowMediumT1098.001nist-800-53-r5:AC-6Exposure management (XSPM)MT.1079Privileged API permissions on service principals should not remain unused.

Exposure ManagementApplications and workload identitiesMediumLowMediumT1078.004nist-800-53-r5:AC-6Exposure management (XSPM)MT.1080Credentials, tokens, or cookies from highly privileged users should not be exposed on vulnerable endpoints.

Exposure ManagementPrivileged accessMediumLowMediumT1539, T1528—Exposure management (XSPM)MT.1081Hybrid users should not be assigned Entra ID role assignments.

Exposure ManagementPrivileged accessMediumLowMediumT1078.002, T1078.004 +1nist-800-53-r5:AC-6(5)Exposure management (XSPM)MT.1088Devices with critical credentials should be protected by TPM.

Exposure ManagementDevices and endpointsMediumLowMediumT1552.004—Exposure management (XSPM)MT.1089Devices with critical credentials should be protected by Credential Guard.

Exposure ManagementDevices and endpointsMediumLowMediumT1003.001—Exposure management (XSPM)MT.1090Global Administrator role should not be added as local administrator on the device during Microsoft Entra join

Device identityPrivileged accessMediumLowLowT1078.004nist-800-53-r5:AC-6Maester MT.1091Registering user should not be added as local administrator on the device during Microsoft Entra join

Device identityPrivileged accessMediumMediumLowT1078.004nist-800-53-r5:AC-6Maester MT.1096Ensure at least one Intune Multi Admin Approval policy is configured

Tenant administrationPrivileged accessMediumLowLowT1072, T1078.004nist-800-53-r5:AC-3(2), nist-800-53-r5:CM-5(4)Maester MT.1112Privileged user accounts should not remain enabled when the linked primary account is disabled.-IncludePreview

Exposure ManagementPrivileged accessMediumLowLowT1078.004nist-800-53-r5:AC-2Exposure management (XSPM)MT.1115AI agents should not have risky HTTP configurations.

AgentsAI and agentsMediumLowMediumT1571, T1048 +1nist-800-53-r5:SC-7Maester MT.1118AI agents should not use author (maker) authentication for connections.

AgentsAI and agentsMediumMediumMediumT1550.001, T1213nist-800-53-r5:AC-6Maester MT.1120AI agents should not use MCP server tools without review.

AgentsAI and agentsMediumLowMediumT1195, T1199—Maester MT.1121AI agents with generative orchestration should have custom instructions.

AgentsAI and agentsMediumLowMedium——Maester MT.1122AI agents should not have orphaned ownership.

AgentsAI and agentsMediumLowMedium——Maester MT.1148Archive Scanning should be enabled.

Endpoint antivirusDevices and endpointsMediumLowLowT1027.015, T1204.002nist-800-53-r5:SI-3Maester MT.1151Email Scanning should be enabled.

Endpoint antivirusDevices and endpointsMediumLowLowT1566.001nist-800-53-r5:SI-3Maester MT.1154Full Scan Removable Drives should be enabled.

Endpoint antivirusDevices and endpointsMediumLowLowT1091nist-800-53-r5:SI-3Maester MT.1156Scanning Network Files should be enabled.

Endpoint antivirusDevices and endpointsMediumLowLowT1080nist-800-53-r5:SI-3Maester MT.1161Cloud Block Level should be High or higher.

Endpoint antivirusDevices and endpointsMediumLowLowT1204.002nist-800-53-r5:SI-3Maester MT.1164PUA Protection should be enabled.

Endpoint antivirusDevices and endpointsMediumLowLowT1204.002nist-800-53-r5:SI-3Maester MT.1166Local Admin Merge should be disabled.

Endpoint antivirusDevices and endpointsMediumLowMediumT1685, T1564.012nist-800-53-r5:CM-6Maester MT.1167Real-Time Scan Direction should cover both directions.

Endpoint antivirusDevices and endpointsMediumLowLowT1204.002nist-800-53-r5:SI-3Maester MT.1171Sample Submission should send safe samples automatically.

Endpoint antivirusDevices and endpointsMediumLowLowT1204.002—Maester MT.1174Insider Risk Management policy for Risky AI usage is enabled.

Insider risk managementLogging and detectionMediumLowMediumT1213nist-800-53-r5:SI-4Maester MT.1175DLP policy is configured for the Microsoft 365 Copilot location.

Data loss preventionData protectionMediumLowMediumT1213.002, T1530nist-800-53-r5:SC-7(10)Maester MT.1176Retention policy is configured for the Microsoft Copilot location.

Data lifecycle managementData protectionMediumLowLow—nist-800-53-r5:SI-12Maester MT.1177Ensure LAPS Configuration Policy is properly set.

Endpoint securityPrivileged accessMediumLowMediumT1078.003, T1021nist-800-53-r5:IA-5Maester MT.1180Ensure Managed Installer Rules are configured correctly.

Endpoint securityDevices and endpointsMediumLowLow—nist-800-53-r5:CM-7(5)Maester MT.1182Mature DMARC policy SHALL be published for every Entra managed and verified domain.

User and directory settingsEmail and collaboration protectionMediumMediumHighT1566, T1684.002nist-800-53-r5:SI-8Maester MT.1183Temporary bypass for onPremisesObjectIdentifier updates should be disabled.

Hybrid identityInfrastructure hardeningMediumLowLowT1078.004, T1098—Maester MT.1184Conditional Access policy without any target resources configured.

Conditional AccessAccess controlMediumLowLowT1078.004—Maester MT.1185Block legacy MSOnline (MSOL) PowerShell module.

User and directory settingsAccess controlMediumLowLowT1059.009, T1078.004nist-800-53-r5:CM-7Maester MT.1186Require explicit assignment of high-privilege first-party Entra Apps.

ApplicationsApplications and workload identitiesMediumMediumMediumT1059.009, T1087.004 +1nist-800-53-r5:AC-3, nist-800-53-r5:AC-6Maester MT.1187The Microsoft 365 traffic forwarding profile in Global Secure Access should be enabled.-IncludePreview

Global Secure AccessAccess controlMediumLowMedium——Maester MT.1188Entra Private Access applications should be covered by a Conditional Access policy that requires a managed device.-IncludePreview

Global Secure AccessAccess controlMediumMediumMediumT1078.004, T1133nist-800-53-r5:AC-17, nist-800-53-r5:IA-3Maester MT.1189Groups assigned to Global Secure Access traffic forwarding profiles should not be nested.-IncludePreview

Global Secure AccessAccess controlMediumLowLow——Maester MT.1191Break-glass accounts should be excluded from the Compliant Network Conditional Access policy.-IncludePreview

Global Secure AccessPrivileged accessMediumLowLow——Maester MT.1193Entra Private Access application segments should avoid broad or risky destinations.-IncludePreview

Global Secure AccessAccess controlMediumLowMediumT1021, T1046nist-800-53-r5:SC-7, nist-800-53-r5:AC-17Maester MT.1194The baseline Global Secure Access security profile should enforce a threat-intelligence floor.-IncludePreview

Global Secure AccessAccess controlMediumLowLowT1204.001, T1566.002—Maester MT.1196Review who can change attributes used by dynamic group rules.

GroupsAccess controlMediumLowMediumT1098—Maester MT.1197Remove memberOf rules.

GroupsIdentity lifecycle and hygieneMediumLowMedium——Maester MT.1198App registration certificates should not have excessive validity periods.

ApplicationsApplications and workload identitiesMediumLowMediumT1649nist-800-53-r5:IA-5Maester MT.1200Agent Identities should have an active Agent Identity Blueprint Principal (Preview).-IncludePreview

Agent identitiesAI and agentsMediumLowLowT1078.004—Maester MT.1201Agent Users should have an existing parent Agent Identity (Preview).-IncludePreview

Agent identitiesAI and agentsMediumLowLowT1078.004—Maester MT.1203Agent Identity Blueprint Principals should have an existing Blueprint (Preview).-IncludePreview

Agent identitiesAI and agentsMediumLowLowT1078.004—Maester MT.1204Agent Identities, Blueprint Principals, and Blueprints should have active, enabled owners (Preview).-IncludePreview

Agent identitiesAI and agentsMediumLowLow—nist-800-53-r5:AC-2Maester MT.1205Agent Identity Blueprints and Blueprint Principals should have assigned sponsors (Preview).-IncludePreview

Agent identitiesAI and agentsMediumLowLow—nist-800-53-r5:AC-2Maester MT.1206Enabled Agent Identities should have active sign-in activity within the last 180 days (Preview).-IncludePreview

Agent identitiesAI and agentsMediumLowLowT1078.004nist-800-53-r5:AC-2(3)Maester MT.1208Agent Identity Blueprints should not have expired, excessive, or long-lived client credentials (Preview).-IncludePreview

Agent identitiesAI and agentsMediumLowMediumT1078.004, T1098.001 +1nist-800-53-r5:IA-5Maester MT.1212Agent Identity Blueprint Principals should require assignment for the application roles they expose (Preview).-IncludePreview

Agent identitiesAI and agentsMediumLowLowT1078.004nist-800-53-r5:AC-3, nist-800-53-r5:AC-6Maester MT.1214Ensure macOS compliance policy requires System Integrity Protection.

Device complianceDevices and endpointsMediumLowLowT1553.006, T1547.006 +1nist-800-53-r5:SI-7, nist-800-53-r5:CM-6Maester MT.1215Ensure Gatekeeper restricts macOS app download locations.

Device complianceDevices and endpointsMediumLowLowT1553.001, T1204.002nist-800-53-r5:CM-11, nist-800-53-r5:CM-7(5)Maester MT.1216Ensure macOS compliance policy requires a Defender machine risk score level.

Device complianceDevices and endpointsMediumLowMediumT1078.004nist-800-53-r5:SI-4, nist-800-53-r5:AC-19Maester MT.1225Users should not be able to create Agent Identity Blueprints.New in 3.0-IncludePreview

Agent identitiesAI and agentsMediumLowLowT1136.003nist-800-53-r5:AC-6Maester MT.1226GitHub and GitLab federated identity credentials should use immutable subject identifiers.New in 3.0-IncludePreview

ApplicationsApplications and workload identitiesMediumLowMediumT1199nist-800-53-r5:IA-4Maester MT.1227Subscriptions should be blocked from leaving and entering the tenantNew in 3.0

SubscriptionsInfrastructure hardeningMediumLowLowT1537nist-800-53-r5:AC-4Maester MT.1228Ensure iOS compliance policy blocks jailbroken devices.New in 3.0

Device complianceDevices and endpointsMediumLowLowT1068, T1553.006nist-800-53-r5:SI-7, nist-800-53-r5:AC-19Maester MT.1229Ensure iOS compliance policy requires a strong device passcode.New in 3.0

Device complianceDevices and endpointsMediumMediumLowT1110, T1111nist-800-53-r5:IA-5(1), nist-800-53-r5:AC-11Maester MT.1230Ensure iOS compliance policy requires a minimum operating system version.New in 3.0

Device complianceDevices and endpointsMediumMediumMediumT1203, T1068nist-800-53-r5:SI-2, nist-800-53-r5:CM-6Maester MT.1231Ensure iOS compliance policy requires a Defender machine risk score level.New in 3.0

Device complianceDevices and endpointsMediumLowMediumT1078.004nist-800-53-r5:SI-4, nist-800-53-r5:AC-19Maester MT.1232Ensure Android compliance policy blocks rooted devices.New in 3.0

Device complianceDevices and endpointsMediumLowLowT1068, T1553.006nist-800-53-r5:SI-7, nist-800-53-r5:AC-19Maester MT.1233Ensure Android compliance policy requires a strong device password.New in 3.0

Device complianceDevices and endpointsMediumMediumLowT1110, T1111nist-800-53-r5:IA-5(1), nist-800-53-r5:AC-11Maester MT.1234Ensure Android compliance policy requires a recent security patch level.New in 3.0

Device complianceDevices and endpointsMediumMediumMediumT1203, T1068nist-800-53-r5:SI-2, nist-800-53-r5:CM-6Maester MT.1235Ensure Android compliance policy requires device threat protection.New in 3.0

Device complianceDevices and endpointsMediumLowMediumT1078.004nist-800-53-r5:SI-4, nist-800-53-r5:AC-19Maester MT.1238Ensure iOS app protection policy requires a strong app PIN.New in 3.0

App protectionAccess controlMediumMediumLowT1110.001nist-800-53-r5:IA-5, nist-800-53-r5:AC-19Maester MT.1239Ensure iOS app protection policy keeps organization data inside managed apps.New in 3.0

App protectionData protectionMediumMediumLowT1567.002, T1115nist-800-53-r5:AC-4, nist-800-53-r5:AC-19Maester MT.1240Ensure iOS app protection policy encrypts organization data.New in 3.0

App protectionData protectionMediumLowLowT1005nist-800-53-r5:SC-28(1), nist-800-53-r5:AC-19Maester MT.1243Ensure iOS app protection policy acts on the device threat level.New in 3.0

App protectionAccess controlMediumLowMediumT1068, T1078.004nist-800-53-r5:SI-4, nist-800-53-r5:AC-19Maester MT.1244Ensure Android app protection policy requires a strong app PIN.New in 3.0

App protectionAccess controlMediumMediumLowT1110.001nist-800-53-r5:IA-5, nist-800-53-r5:AC-19Maester MT.1245Ensure Android app protection policy keeps organization data inside managed apps.New in 3.0

App protectionData protectionMediumMediumLowT1115, T1567.002nist-800-53-r5:AC-4, nist-800-53-r5:AC-19Maester MT.1246Ensure Android app protection policy encrypts organization data.New in 3.0

App protectionData protectionMediumLowLowT1005nist-800-53-r5:SC-28(1), nist-800-53-r5:AC-19Maester MT.1249Ensure Android app protection policy acts on the device threat level.New in 3.0

App protectionAccess controlMediumLowMediumT1068, T1078.004nist-800-53-r5:SI-4, nist-800-53-r5:AC-19Maester MT.1251Ensure Android app protection policy requires Play Integrity device attestation.New in 3.0

App protectionDevices and endpointsMediumMediumLowT1068nist-800-53-r5:SI-7, nist-800-53-r5:AC-19Maester MT.1252Apps scoped with Exchange RBAC for Applications should not hold the same or a broader permission tenant-wide in Microsoft Entra ID.New in 3.0

App consent and permissionsApplications and workload identitiesMediumLowMediumT1114.002nist-800-53-r5:AC-6, nist-800-53-r5:AC-3Maester MT.1260High-risk users should not be left unremediated in Entra ID Protection.New in 3.0-IncludePreview

Identity ProtectionLogging and detectionMediumLowLowT1078.004nist-800-53-r5:AC-2(12), nist-800-53-r5:IR-4Maester MT.1265Fix dynamic groups whose rule processing failed.New in 3.0

GroupsIdentity lifecycle and hygieneMediumLowLow——Maester AZDO.1008Request access to Azure DevOps by e-mail notifications to administrators.New in 3.0

Users and accessAccess controlLowLowLow——Maester AZDO.1027Disable showing Gravatar images for users outside of your enterprise.New in 3.0

RepositoriesEngineering systemsLowLowLowT1589.002—Maester MT.1022All users utilizing a P1 license should be licensed.

Conditional AccessInfrastructure hardeningLowLowMedium——Maester MT.1023All users utilizing a P2 license should be licensed.

Conditional AccessInfrastructure hardeningLowLowMedium——Maester MT.1037Only users with Presenter role are allowed to present in Teams meetings

MeetingsEmail and collaboration protectionLowMediumLow—nist-800-53-r5:AC-6Maester MT.1039Ensure MailTips are enabled for end users

Exchange Online

OutlookEmail and collaboration protectionLowLowLow——Maester MT.1044Ensure modern authentication for Exchange Online is enabled

Exchange Online

Client accessAuthenticationLowLowLowT1110—Maester MT.1053Ensure intune device clean-up rule is configured

Tenant administrationDevices and endpointsLowLowLow——Maester MT.1055Microsoft 365 Group (and Team) creation should be restricted to approved users.

GroupsAccess controlLowMediumLow—nist-800-53-r5:AC-6, nist-800-53-r5:CM-7Maester MT.1067Authentication method policies should not reference non-existent groups.

Authentication methodsAuthenticationLowLowLow——Maester MT.1069Restrict non-admin users from creating security groups.

User and directory settingsAccess controlLowLowLow—nist-800-53-r5:AC-6Maester MT.1074Ensure no more than 100 outbound mails per day are sent using the .onmicrosoft.com domain

Exchange Online

MailboxesEmail and collaboration protectionLowLowMedium——Maester MT.1076MOERA SHOULD NOT be used for sent mail

Exchange Online

MailboxesEmail and collaboration protectionLowLowMedium——Maester MT.1083Ensure Delicensing Resiliency is enabled

Exchange Online

MailboxesInfrastructure hardeningLowLowLow——Maester MT.1085Pending approvals for Critical Asset Management should not be present.

Exposure ManagementLogging and detectionLowLowLow——Exposure management (XSPM)MT.1086Devices should not share both critical and non-critical user credentials.

Exposure ManagementDevices and endpointsLowLowHighT1003—Exposure management (XSPM)MT.1099Windows Diagnostic Data Processing should be enabled

Tenant administrationDevices and endpointsLowLowLow——Maester MT.1101Default Branding Profile should be customized

Tenant administrationDevices and endpointsLowLowLow——Maester MT.1105Ensure MDM Authority is set to Intune

Tenant administrationDevices and endpointsLowLowLow——Maester MT.1106Catalog resources must have valid roles (no stale / removed app roles or SPNs).

Identity GovernanceIdentity lifecycle and hygieneLowLowMedium——Maester MT.1107Access packages and catalogs should not reference deleted groups.

Identity GovernanceIdentity lifecycle and hygieneLowLowMedium——Maester MT.1108Access packages should not reference inactive or orphaned assignment policies.

Identity GovernanceIdentity lifecycle and hygieneLowLowMedium——Maester MT.1109Access package approval workflows must have valid approvers.

Identity GovernanceIdentity lifecycle and hygieneLowLowMedium——Maester MT.1110No catalog should contain resources without any associated access packages.

Identity GovernanceIdentity lifecycle and hygieneLowLowMedium——Maester MT.1111High privileged user should be linked to an identity.-IncludePreview

Exposure ManagementPrivileged accessLowLowLow—nist-800-53-r5:AC-2Exposure management (XSPM)MT.1117Published AI agents should not be dormant.

AgentsAI and agentsLowLowMedium——Maester MT.1155Full Scan Mapped Drives should be disabled for performance.

Endpoint antivirusDevices and endpointsLowLowLow——Maester MT.1157CPU Load Factor should be optimized (20-30%).

Endpoint antivirusDevices and endpointsLowLowLow——Maester MT.1158Scan should be scheduled.

Endpoint antivirusDevices and endpointsLowLowLow—nist-800-53-r5:SI-3Maester MT.1160Signatures should be checked before scan.

Endpoint antivirusDevices and endpointsLowLowLow—nist-800-53-r5:SI-3Maester MT.1162Cloud Extended Timeout should be 30-50 seconds.

Endpoint antivirusDevices and endpointsLowLowLowT1204.002—Maester MT.1163Signature Update Interval should be 1-4 hours.

Endpoint antivirusDevices and endpointsLowLowLowT1204.002nist-800-53-r5:SI-3Maester MT.1168Cleaned Malware should be retained for at least 30 days.

Endpoint antivirusDevices and endpointsLowLowLow——Maester MT.1169Catch-up Full Scan should be disabled.

Endpoint antivirusDevices and endpointsLowLowLow——Maester MT.1170Catch-up Quick Scan should be disabled.

Endpoint antivirusDevices and endpointsLowLowLow——Maester MT.1173Sensitivity labels are published for files used by Microsoft 365 Copilot.

Information protectionData protectionLowMediumMedium—nist-800-53-r5:AC-16Maester MT.1190Entra Private Access applications should not use the Default connector group.-IncludePreview

Global Secure AccessInfrastructure hardeningLowLowLow——Maester MT.1192Groups assigned to Entra Private Access applications should not be nested.-IncludePreview

Global Secure AccessAccess controlLowLowLow——Maester MT.1195The Quick Access app should not be subject to a sign-in frequency Conditional Access control.-IncludePreview

Global Secure AccessAuthenticationLowLowLow——Maester MT.1199App registration credentials should not be expired or expiring soon.

ApplicationsApplications and workload identitiesLowLowMediumT1098.001—Maester MT.1224Microsoft-managed Conditional Access policies should not be left in report-only mode.New in 3.0

Conditional AccessAccess controlLowLowLow—nist-800-53-r5:CM-3Maester MT.1236Ensure Android compliance policy blocks USB debugging.New in 3.0

Device complianceDevices and endpointsLowLowLowT1005, T1052.001nist-800-53-r5:SC-41, nist-800-53-r5:CM-7Maester MT.1237Ensure Android compliance policy blocks devices managed with device administrator.New in 3.0

Device complianceDevices and endpointsLowMediumMedium—nist-800-53-r5:AC-19, nist-800-53-r5:CM-6Maester MT.1241Ensure iOS app protection policy requires a minimum OS and app version.New in 3.0

App protectionDevices and endpointsLowMediumLowT1203, T1068nist-800-53-r5:SI-2, nist-800-53-r5:AC-19Maester MT.1242Ensure iOS app protection policy limits offline access to organization data.New in 3.0

App protectionAccess controlLowMediumLowT1078.004nist-800-53-r5:AC-12, nist-800-53-r5:AC-19Maester MT.1247Ensure Android app protection policy requires a minimum OS and app version.New in 3.0

App protectionDevices and endpointsLowMediumLowT1203, T1068nist-800-53-r5:SI-2, nist-800-53-r5:AC-19Maester MT.1248Ensure Android app protection policy limits offline access to organization data.New in 3.0

App protectionAccess controlLowMediumLowT1078.004nist-800-53-r5:AC-12, nist-800-53-r5:AC-19Maester MT.1250Ensure Android app protection policy blocks screen capture of organization data.New in 3.0

App protectionData protectionLowMediumLowT1113nist-800-53-r5:AC-4, nist-800-53-r5:AC-19Maester AZDO.1009Feedback Collection.New in 3.0

Organization policiesEngineering systemsInfo————Maester AZDO.1011Project Resource Limits.New in 3.0

Resource usage and limitsEngineering systemsInfo————Maester AZDO.1012Work Items Tags Limits.New in 3.0

Resource usage and limitsEngineering systemsInfo————Maester AZDO.1029Storage Usage Limit.New in 3.0

Resource usage and limitsEngineering systemsInfo————Maester AZDO.1045(Organization) Copilot code review: allowed for repositories.New in 3.0-IncludePreview

RepositoriesAI and agentsInfo————Maester MT.1159Quick Scan Time configuration is not required.

Endpoint antivirusDevices and endpointsInfo————Maester