Automating Microsoft 365 Security Checks with Maester

Setting up Microsoft 365 usually starts with good intentions: Conditional Access is configured, multi-factor authentication is enabled for admins, guest access to sensitive groups is restricted. Six months pass, team members change, someone disables a rule for a quick fix and forgets to re-enable it. This is usually discovered during an audit or after an incident.

Manually monitoring tenant state through the Entra ID portal or making engineers click through dozens of menus once a month is tedious and unreliable. Automated tests have long been used to verify server infrastructure configuration. The Maester project adapts this approach for the Microsoft 365 environment.

What Maester Is

Maester is a testing framework built on PowerShell and the popular Pester engine. Its main purpose is to run a suite of checks against your M365 tenant, verify settings against security best practices, and generate a detailed report.

The tool integrates Microsoft Graph API, M365 management modules, and familiar Pester tests. If you have ever written unit tests in PowerShell, Maester's syntax will feel native.

Quick Start and Launch

You need PowerShell and a couple of commands to get started. Installation is done directly from PowerShell Gallery:

Install-Module -Name Maester -Scope CurrentUser

After installation, create a working folder and download the ready-made test suite:

md ~/maester-tests
cd ~/maester-tests
Install-MaesterTests

Running the tests involves two steps: authentication and invoking the runner itself.

cd ~/maester-tests
Connect-Maester
Invoke-Maester

The Connect-Maester command requests authentication to Microsoft Entra. By the way, there is a parameter for working with sovereign clouds like USGov or China:

Connect-Maester -Environment USGov

Feature Overview

Ready-made tests verify basic settings: conditional access policies, MFA status, password configurations, external sharing parameters, and admin roles. The practical value of the framework reveals itself in several areas.

Custom Pester Tests

You are not limited to the standard set from the repository. Any .tests.ps1 file in the tests folder becomes part of the overall run. If your organization prohibits creating public links to SharePoint files, you write a short Pester test that verifies this setting via the Microsoft Graph API.

Multiple Report Formats

The Invoke-Maester results can be exported to HTML, JSON, CSV, Excel, or Markdown. An interactive HTML report is convenient to show auditors or upload to an internal web resource.

Chat Notifications

Results do not have to be read in the console. The script sends a summary to Microsoft Teams, Slack, or via email. If someone changed a critical security policy overnight, the team will see a message in the work channel in the morning.

CI/CD Integration

The framework fits into the DevSecOps concept. Running it on a schedule is easy to set up in GitHub Actions, Azure DevOps, or GitLab CI. The authors released a ready-made action in GitHub Marketplace (maester365/maester-action) that outputs the check results to the pipeline summary.

Caveats

In the repository description, the developers warn about unstable operation of the ExchangeOnlineManagement module version 3.9.2. Connection attempts with this version often result in errors. The failure is related to the Microsoft module itself, not Maester, so it is better to temporarily use previous versions of ExchangeOnlineManagement.

Another point is test currency. Microsoft security standards and APIs change regularly. To keep the checks up to date, you will need to pull fresh tests occasionally with the Update-MaesterTests command.

Conclusion

Maester will be useful for system administrators, security engineers, and DevOps specialists who manage Microsoft 365 tenants. The tool moves security auditing from the category of tedious manual work to automated code verification. If you want to monitor changes in the tenant and receive notifications about configuration drift, the project is worth testing in your infrastructure.