Maester - PowerShell Commands

Overview

This page lists all the commands available in the Maester PowerShell module.

The Maester PowerShell module is a collection of commands that help you write Pester tests to validate your Microsoft 365 tenant configuration. You can view the Graph API calls for these commands in the Maester GitHub repository's src folder. You can also select the Edit this page link found in the command's documentation to view the source code for the command.

See the writing Maester tests guide for more information on how to write your own tests using these commands.

Maester Commands

• Maester Commands Overview
• Add-MtMaesterAppFederatedCredentialAdds a federated credential to a Maester application for GitHub Actions authentication.
• Add-MtTestResultDetailAdd detailed information about a test so that it can be displayed in the test results report.
• Clear-MtADCacheResets the local cache of Active Directory data.
• Clear-MtDnsCacheResets the local cache of DNS lookups.
• Clear-MtExoCacheResets the local cache of Exchange Online queries.
• Clear-MtGraphCacheResets the local cache of Graph API calls.
• Compare-MtJsonObjectCompares two PowerShell objects (typically JSON objects) and returns a list of differences.
• Compare-MtTestResultCompares Maester test result JSON files
• Connect-MaesterHelper method to connect to Microsoft Graph using Connect-MgGraph with the required permission scopes as well as other services such as Azure and Exchange Online.
• Connect-MtGitHubEstablishes a GitHub Enterprise Cloud organization REST API session for Maester.
• Convert-MtResultsToFlatObjectConvert Maester test results to a flattened object that can be exported to CSV or Excel.
• ConvertFrom-MailAuthenticationRecordDkimReturns structured RFC compliant object from DKIM record
• ConvertFrom-MailAuthenticationRecordDmarcReturns structured RFC compliant object for a DMARC record
• ConvertFrom-MailAuthenticationRecordMxA simple wrapper for Resolve-DnsName
• ConvertFrom-MailAuthenticationRecordSpfReturns a structured RFC compliant object for the supplied SPF record
• Disconnect-MaesterHelper method to sign out of the current Microsoft Graph session.
• Disconnect-MtGitHubClears the current GitHub REST session in Maester.
• Get-MailAuthenticationRecordObtains and converts the mail authentication records of a domain
• Get-MdeConfigurationGets information about your organization's Defender-protected devices and their policies
• Get-MdeDeviceCountCounts how many devices are protected by Microsoft Defender for Endpoint
• Get-MdePolicyConfigurationGets Microsoft Defender Antivirus policies that are assigned to devices
• Get-MdeSettingValueExtracts setting values from Graph API configuration policy responses
• Get-MtADDaclsCollects Active Directory ACLs (Access Control Lists).
• Get-MtADDomainStateCollects Active Directory domain state information.
• Get-MtADGpoStateCollects Active Directory Group Policy state information.
• Get-MtAdminPortalUrlGet the URL for the specific Microsoft admin portal based on the environment.
• Get-MtAuthenticationMethodPolicyConfigGet details of authentication methods
• Get-MtAzureManagementGroupReturns all Azure Management Groups in the tenant
• Get-MtConditionalAccessPolicyReturns all the conditional access policies in the tenant.
• Get-MtExoRetrieves cached response or requests from cmdlet
• Get-MtExoThreatPolicyMalwareRetrieves cached and extended (priority, enabled) of 'Get-MtExo -Request MalwareFilterPolicy'
• Get-MtGraphScopeReturns the list of Graph scopes required to run Maester.
• Get-MtGroupMemberReturns all the members of the specific group ID.
• Get-MtHtmlReportGenerates a formatted html report using the MaesterResults object created by ConvertTo-MtMaesterResult
• Get-MtLicenseInformationGet license information for a Microsoft 365 product.
• Get-MtLinkServicePrincipalGet the deep link to the Microsoft Entra admin portal for a specific Graph object type.
• Get-MtMaesterAppRetrieves Maester applications from Azure AD/Entra ID.
• Get-MtRegistrableDomainGet the registrable domain for a given domain name.
• Get-MtRoleReturns all the role definitions in the tenant.
• Get-MtRoleMemberReturns all the members of a role.
• Get-MtSafeMarkdownEscapes text to be safe to use in markdown.
• Get-MtSessionGets the current Maester session information which includes the current Graph base uri and other details.
• Get-MtSpoRetrieves SharePoint Online tenant settings via PnP with session caching.
• Get-MtTestInventoryDiscover Pester test inventory and associated tags.
• Get-MtUserGet a list of users from the tenant
• Get-MtUserAuthenticationMethodGet the authentication methods for the specified user
• Get-MtUserAuthenticationMethodInfoByTypeReturns DisplayName and IsMfa metadata about a specific user authentication method type
• Get-MtXspmAuthenticationArtifactIconGet the icon representation for a specific authentication artifact type.
• Get-MtXspmExposedAuthenticationArtifactCheck data from Exposure Management for exposed token artifacts.
• Get-MtXspmPrivilegedClassificationIconGet the icon representation for a specific privileged classification level.
• Get-MtXspmUnifiedIdentityInfoCheck data from various XDR tables to identify users and workload identities with sensitive privileges and apply classification from community project EntraOps.
• Get-ObjectDifferenceThis function compares to object arrays
• Get-RelatedPolicyProvides MarkDown text for specific array of objects
• Import-MtMaesterResultImports Maester test result JSON files from disk into PowerShell objects.
• Import-SingleResultFileHelper: loads a single JSON file and adds valid results to the list.
• Install-MaesterTestsInstalls the latest ready-made Maester tests built by the Maester team and the required Pester module.
• Invoke-MaesterThis is the main Maester command that runs the tests and generates a report of the results.
• Invoke-MtAzureRequestInvoke a REST API request to the Azure Management API.
• Invoke-MtAzureResourceGraphRequestInvoke a query request to the Azure Resource Graph.
• Invoke-MtGraphRequestEnhanced version of Invoke-MgGraphRequest that supports paging, batching and caching.
• Invoke-MtGraphSecurityQueryExecute KQL query in Microsoft 365 Defender Advanced Hunting by using Graph API Security endpoint to get results programmatically.
• Merge-MtMaesterResultMerges multiple MaesterResults objects into a single multi-tenant result for combined HTML reporting.
• New-MtMaesterAppCreates a new Maester application in Entra ID with required permissions.
• Resolve-SPFRecordReturns a list of all IP addresses from an SPF record.
• Send-MtMailSend an email with the summary of the Maester test results
• Send-MtTeamsMessageSend an adaptive card in a teams channel with the summary of the Maester test results
• Test-AzdoAllowExtensionsLocalNetworkAccessReturns a boolean depending on the configuration.
• Test-AzdoAllowRequestAccessTokenReturns a boolean depending on the configuration.
• Test-AzdoAllowTeamAdminsInvitationsAccessTokenReturns a boolean depending on the configuration.
• Test-AzdoArtifactsExternalPackageProtectionTokenReturns a boolean depending on the configuration.
• Test-AzdoAuditStreamReturns a boolean depending on the configuration.
• Test-AzdoDisableGlobalPATCreationReturns a boolean depending on the configuration.
• Test-AzdoDisablePATCreationReturns a boolean depending on the configuration.
• Test-AzdoEnableLeakedPersonalAccessTokenAutoRevocationReturns a boolean depending on the configuration.
• Test-AzdoEnforceAADConditionalAccessReturns a boolean depending on the configuration.
• Test-AzdoExternalGuestAccessReturns a boolean depending on the configuration.
• Test-AzdoFeedbackCollectionReturns a boolean depending on the configuration.
• Test-AzdoLogAuditEventReturns a boolean depending on the configuration.
• Test-AzdoOrganizationAutomaticEnrollmentAdvancedSecurityNewProjectReturns a boolean depending on the configuration.
• Test-AzdoOrganizationBadgesArePrivateReturns a boolean depending on the configuration.
• Test-AzdoOrganizationCreationClassicBuildPipelineReturns a boolean depending on the configuration.
• Test-AzdoOrganizationCreationClassicReleasePipelineReturns a boolean depending on the configuration.
• Test-AzdoOrganizationCreationRestrictionReturns a boolean depending on the configuration.
• Test-AzdoOrganizationLimitJobAuthorizationScopeNonReleasePipelineReturns a boolean depending on the configuration.
• Test-AzdoOrganizationLimitJobAuthorizationScopeReleasePipelineReturns a boolean depending on the configuration.
• Test-AzdoOrganizationLimitVariablesAtQueueTimeReturns a boolean depending on the configuration.
• Test-AzdoOrganizationOwnerReturns a boolean depending on the configuration.
• Test-AzdoOrganizationProtectAccessToRepositoryReturns a boolean depending on the configuration.
• Test-AzdoOrganizationRepositorySettingsDisableCreationTFVCRepoReturns a boolean depending on the configuration.
• Test-AzdoOrganizationRepositorySettingsGravatarImageReturns a boolean depending on the configuration.
• Test-AzdoOrganizationStageChooserReturns a boolean depending on the configuration.
• Test-AzdoOrganizationStorageUsageReturns a boolean depending on the configuration.
• Test-AzdoOrganizationTaskRestrictionsDisableMarketplaceTaskReturns a boolean depending on the configuration.
• Test-AzdoOrganizationTaskRestrictionsDisableNode6TaskReturns a boolean depending on the configuration.
• Test-AzdoOrganizationTaskRestrictionsShellTaskArgumentValidationReturns a boolean depending on the configuration.
• Test-AzdoOrganizationTriggerPullRequestGitHubRepositoryReturns a boolean depending on the configuration.
• Test-AzdoProjectCollectionAdministratorReturns a list of all Project Collection Administrators.
• Test-AzdoPublicProjectReturns a boolean depending on the configuration.
• Test-AzdoResourceUsageProjectReturns a boolean depending on the configuration.
• Test-AzdoResourceUsageWorkItemTagReturns a boolean depending on the configuration.
• Test-AzdoRestrictFullScopePersonalAccessTokenReturns a boolean depending on the configuration.
• Test-AzdoRestrictPersonalAccessTokenLifespanReturns a boolean depending on the configuration.
• Test-AzdoSSHAuthenticationReturns a boolean depending on the configuration.
• Test-AzdoThirdPartyAccessViaOauthReturns a boolean depending on the configuration.
• Test-AzdoValidateSshKeyExpirationReturns a boolean depending on the configuration.
• Test-MaesterResultValidHelper: validates that a result object has the required properties.
• Test-MdePolicyComplianceTests policy compliance for an MDE setting across all assigned policies
• Test-MdePolicyHasAssignmentChecks if a configuration policy is assigned to any groups or devices
• Test-MdeSettingComplianceTests compliance for a specific MDE setting value
• Test-MtAIAgentAuthorAuthenticationTests if AI agents use author (maker) authentication for their connector tools.
• Test-MtAIAgentBroadSharingTests if AI agents are shared too broadly.
• Test-MtAIAgentDormantTests if AI agents are dormant.
• Test-MtAIAgentEmailExfiltrationTests if AI agents can send email with AI-controlled inputs.
• Test-MtAIAgentHardCodedCredentialsTests if AI agents have hard-coded credentials in topic definitions.
• Test-MtAIAgentMcpToolsTests if AI agents are configured with MCP server tools.
• Test-MtAIAgentMissingInstructionsTests if AI agents with generative orchestration have custom instructions.
• Test-MtAIAgentNoAuthenticationTests if AI agents require user authentication.
• Test-MtAIAgentOrphanedTests if AI agents are orphaned.
• Test-MtAIAgentRiskyHttpConfigTests if AI agents have risky HTTP configurations.
• Test-MtAdAccountLockoutDurationChecks the account lockout duration configured in the default domain password policy.
• Test-MtAdAccountLockoutThresholdChecks the account lockout threshold configured in the default domain password policy.
• Test-MtAdAdActivationObjectsCountCounts Active Directory activation objects from configuration.
• Test-MtAdAllowedDnsSuffixesCountRetrieves the count of allowed DNS suffixes configured for the domain.
• Test-MtAdAuthNPolicyConfigCountCounts Active Directory AuthN policy containers.
• Test-MtAdCertificateTemplatesCountCounts the number of certificate templates published in Active Directory.
• Test-MtAdComputerCreatorSidCountCounts computers with the ms-ds-CreatorSid attribute set.
• Test-MtAdComputerDelegationCountCounts computers with delegation configured.
• Test-MtAdComputerDelegationDetailsProvides detailed breakdown of delegation configuration per computer.
• Test-MtAdComputerDisabledCountCounts the number of disabled computer objects in Active Directory.
• Test-MtAdComputerDnsHostNameCountCounts computers with DNS host name configured.
• Test-MtAdComputerDnsZoneCountCounts unique DNS zones used by domain computers.
• Test-MtAdComputerDnsZoneDetailsProvides detailed breakdown of computers by DNS zone.
• Test-MtAdComputerDormantCountCounts the number of dormant computer objects in Active Directory.
• Test-MtAdComputerInDefaultContainerCounts computers located in the default Computers container.
• Test-MtAdComputerNonDcConstrainedDelegationCountCounts non-domain controller computers with constrained delegation configured.
• Test-MtAdComputerNonDcUnconstrainedDelegationCountCounts non-domain controller computers with unconstrained delegation.
• Test-MtAdComputerNonStandardGroupCounts computers with non-standard primary group IDs.
• Test-MtAdComputerOUCountCounts the distinct organizational units (OUs) containing computer objects.
• Test-MtAdComputerOperatingSystemCountCounts the number of distinct operating systems in use by domain computers.
• Test-MtAdComputerOperatingSystemDetailsProvides detailed breakdown of computers by operating system and service pack.
• Test-MtAdComputerPerOUAverageCalculates the average number of computers per organizational unit.
• Test-MtAdComputerSidHistoryCountCounts computers with SID History set.
• Test-MtAdComputerSpnNonFqdnHostsCounts computer SPNs with hosts that do not use fully qualified domain names (FQDN).
• Test-MtAdComputerSpnServiceClassCountCounts the distinct SPN service classes in use by computer accounts.
• Test-MtAdComputerSpnServiceClassUsageProvides a breakdown of SPN service class usage across computer accounts.
• Test-MtAdComputerSpnUnknownCountCounts unidentified SPN service classes on computer accounts.
• Test-MtAdComputerSpnUnknownDetailsProvides detailed information about unidentified SPN service classes on computer accounts.
• Test-MtAdComputerStaleEnabledCountCounts enabled computers that have not logged on for 180 days or more.
• Test-MtAdComputerUnconstrainedDelegationCountCounts computers with unconstrained delegation configured.
• Test-MtAdCrlDistributionPointsCountCounts the CRL distribution points configured in Active Directory.
• Test-MtAdCrossForestReferencesCountRetrieves the count of cross-forest references configured in the forest.
• Test-MtAdDaclConflictObjectCountCounts conflict objects represented in DACL data.
• Test-MtAdDaclConflictObjectDetailsReturns detailed information for conflict objects represented in DACL data.
• Test-MtAdDaclDenyAceCountCounts deny authorization ACEs in collected DACL data.
• Test-MtAdDaclDenyAceDetailsReturns a breakdown of deny authorization ACEs by object and identity.
• Test-MtAdDaclDistinctIdentityCountCounts distinct identities referenced by DACL ACEs.
• Test-MtAdDaclDistinctObjectCountCounts distinct Active Directory objects that have DACL entries.
• Test-MtAdDaclIdentityAceDistributionReturns the ACE distribution per identity in collected DACL data.
• Test-MtAdDaclInheritedObjectTypeCountCounts inherited object types referenced by Active Directory DACL entries.
• Test-MtAdDaclInheritedObjectTypeDetailsReturns inherited object type breakdown from Active Directory DACL entries.
• Test-MtAdDaclNonInheritedAceCountCounts non-inherited ACEs in Active Directory DACLs.
• Test-MtAdDaclOuObjectCountCounts DACL entries on Organizational Unit objects.
• Test-MtAdDaclPrivilegedAllowAceCountCounts privileged allow ACEs in collected DACL data.
• Test-MtAdDaclPrivilegedAllowAceDetailsReturns details for privileged allow ACEs in collected DACL data.
• Test-MtAdDaclPrivilegedExtendedRightCountCounts allow ACEs that grant the ExtendedRight permission.
• Test-MtAdDaclPrivilegedExtendedRightDetailsReturns a breakdown of ExtendedRight allow ACEs by ObjectType.
• Test-MtAdDaclPrivilegedExtendedRightIdentityReturns identities with privileged extended rights in Active Directory DACLs.
• Test-MtAdDaclUnresolvedSidCountCounts unresolved SID references in Active Directory DACL entries.
• Test-MtAdDaclUnresolvedSidDetailsReturns unresolved SID details from Active Directory DACL entries.
• Test-MtAdDcAllFsmoRolesCountCounts domain controllers that hold all 5 FSMO roles.
• Test-MtAdDcFsmoRoleHolderDetailsProvides detailed information about FSMO role holders.
• Test-MtAdDcNonGlobalCatalogCountCounts domain controllers that are not configured as Global Catalogs.
• Test-MtAdDcNonStandardLdapPortCountCounts domain controllers using non-standard LDAP ports.
• Test-MtAdDcNonStandardLdapsPortCountCounts domain controllers using non-standard LDAPS ports.
• Test-MtAdDcOperatingSystemCountCounts the distinct operating systems running on domain controllers.
• Test-MtAdDcOperatingSystemDetailsProvides detailed breakdown of operating systems on domain controllers.
• Test-MtAdDcReadOnlyCountCounts read-only domain controllers (RODCs) in the domain.
• Test-MtAdDcSiteCoverageCountCounts the number of Active Directory sites with domain controllers.
• Test-MtAdDcSmbSigningEnabledCountCounts domain controllers with SMB signing enabled.
• Test-MtAdDcSmbv1EnabledCountCounts domain controllers with SMBv1 protocol enabled.
• Test-MtAdDcSmbv311EnabledCountCounts domain controllers with SMBv3.1.1 protocol enabled.
• Test-MtAdDefaultQueryPolicyReturns default LDAP query policy limits from Active Directory.
• Test-MtAdDfsrSubscriptionCountRetrieves the count of DFS-R subscriptions for SYSVOL replication.
• Test-MtAdDisabledReplicationConnectionCountChecks for disabled Active Directory replication connections.
• Test-MtAdDnsAdSrvRecordCountCounts Active Directory Domain Services SRV records.
• Test-MtAdDnsAdSrvRecordDetailsProvides detailed information about Active Directory Domain Services SRV records.
• Test-MtAdDnsDnssecRecordCountCounts DNSSEC (DNS Security Extensions) trust anchor records.
• Test-MtAdDnsDuplicateZoneCountCounts duplicate or conflict DNS zones.
• Test-MtAdDnsDynamicRecordCountCounts the number of dynamic DNS records in Active Directory.
• Test-MtAdDnsEmptyZoneCountCounts DNS zones that contain zero records.
• Test-MtAdDnsNonStandardZoneCountCounts DNS zones with non-standard names.
• Test-MtAdDnsReverseZoneCountCounts reverse lookup DNS zones.
• Test-MtAdDnsReverseZoneNetworkCountCounts distinct networks with reverse lookup zones.
• Test-MtAdDnsReverseZoneNetworkDetailsProvides detailed information about networks with reverse lookup zones.
• Test-MtAdDnsRootServerIncorrectCountCounts root DNS servers with incorrect IP addresses.
• Test-MtAdDnsRootServerIncorrectDetailsProvides detailed information about root DNS servers with incorrect IP addresses.
• Test-MtAdDnsSoaDetailsProvides SOA (Start of Authority) record details for each DNS zone.
• Test-MtAdDnsZoneCountCounts the number of DNS zones with records in Active Directory.
• Test-MtAdDnsZoneDelegationCountCounts the number of DNS zone delegations in Active Directory.
• Test-MtAdDnsZoneDelegationDetailsProvides detailed information about DNS zone delegations.
• Test-MtAdDnsZoneRecordDetailsProvides detailed record count information for each DNS zone.
• Test-MtAdDnsZonesWithOnlySoaNsCounts DNS zones that contain only SOA and NS records.
• Test-MtAdDnsZonesWithRecordsCountCounts DNS zones that contain non-default records.
• Test-MtAdDomainControllerCountCounts the number of domain controllers in the domain.
• Test-MtAdDomainFunctionalLevelRetrieves the current domain functional level.
• Test-MtAdDomainNameNonStandardDetailsLists details of domain names that don't comply with RFC standards.
• Test-MtAdDomainNameStandardComplianceChecks if domain names comply with RFC standards.
• Test-MtAdDsHeuristicsCountCounts Active Directory dSHeuristics configuration settings.
• Test-MtAdEnrollmentCaCertificateDetailsReturns Enterprise CA certificate validity details for AD enrollment.
• Test-MtAdEnrollmentTemplatesCountCounts the number of certificate templates available for enrollment.
• Test-MtAdEnterpriseCaCountCounts the number of Enterprise certificate authorities configured in Active Directory.
• Test-MtAdFineGrainedPolicyAppliesToShows which users and groups each fine-grained password policy applies to.
• Test-MtAdFineGrainedPolicyCountCounts the number of fine-grained password policies configured in the domain.
• Test-MtAdFineGrainedPolicySettingCountsProvides a detailed breakdown of settings across all fine-grained password policies.
• Test-MtAdFineGrainedPolicyValueCountAnalyzes distinct values across all fine-grained password policies.
• Test-MtAdForestDomainCountCounts the number of domains in the forest.
• Test-MtAdForestFunctionalLevelRetrieves the current forest functional level.
• Test-MtAdGpoAllSettingsDisabledDetailsReturns details of GPOs where all settings are disabled.
• Test-MtAdGpoBlockedInheritanceCountCounts targets blocking GPO inheritance.
• Test-MtAdGpoChangedBefore2020CountCounts Group Policy Objects (GPOs) last changed before 2020.
• Test-MtAdGpoComputerSettingsDisabledDetailsReturns details of GPOs where computer settings are disabled.
• Test-MtAdGpoCpasswordFoundCountCounts the number of GPOs that contain a cpassword.
• Test-MtAdGpoCpasswordFoundDetailsReturns details of GPOs that contain a cpassword.
• Test-MtAdGpoCreatedBefore2020CountCounts the number of Group Policy Objects (GPOs) created before 2020 in Active Directory.
• Test-MtAdGpoDefaultPasswordFoundCountCounts the number of GPOs that contain a default password (decoded from cpassword).
• Test-MtAdGpoDefaultPasswordFoundDetailsReturns details of GPOs that contain a default password.
• Test-MtAdGpoDenyAceCountCounts GPO reports that include a Deny ACE.
• Test-MtAdGpoDenyAceDetailsReturns details of GPO reports that include a Deny ACE.
• Test-MtAdGpoDisabledLinkCountCounts the number of disabled GPO links in Active Directory.
• Test-MtAdGpoDisabledLinkDetailsReturns details of GPOs with disabled GPO links.
• Test-MtAdGpoEnforcedCountCounts enforced GPO links (links that block inheritance).
• Test-MtAdGpoEnforcementCountCounts the number of GPOs that have enforced GPO links.
• Test-MtAdGpoInheritedPermissionsCountCounts GPO reports with inherited permissions.
• Test-MtAdGpoLinkedCountCounts distinct GPOs that have at least one enabled link (active GPOs).
• Test-MtAdGpoLinkedOUCountCounts the number of Organizational Units with GPO links in Active Directory.
• Test-MtAdGpoNoApplyGroupPolicyAceCountCounts the number of GPOs missing the "Apply Group Policy" ACE.
• Test-MtAdGpoNoApplyGroupPolicyAceDetailsReturns details of GPOs missing the "Apply Group Policy" ACE.
• Test-MtAdGpoNoAuthenticatedUsersCountCounts GPO reports that do not include Authenticated Users.
• Test-MtAdGpoNoAuthenticatedUsersDetailsReturns details of GPO reports without Authenticated Users.
• Test-MtAdGpoNoDomainComputersCountCounts GPO reports that do not include Domain Computers.
• Test-MtAdGpoNoEnterpriseDcCountCounts GPO reports that do not include Enterprise Domain Controllers.
• Test-MtAdGpoNoPermissionsCountCounts Group Policy Objects (GPOs) with missing permissions.
• Test-MtAdGpoNoPermissionsDetailsReturns details of GPO reports missing permissions.
• Test-MtAdGpoOwnerDetailsReturns details of GPO owners, including how many GPOs each owner has.
• Test-MtAdGpoOwnerDistinctCountCounts the number of distinct GPO owners.
• Test-MtAdGpoSettingsDisabledCountCounts GPOs where settings are disabled (AllDisabled, UserDisabled, or ComputerDisabled).
• Test-MtAdGpoStateTotalCountCounts the total number of Group Policy Objects (GPOs) returned by Get-MtADGpoState.
• Test-MtAdGpoTotalCountCounts the total number of Group Policy Objects in Active Directory.
• Test-MtAdGpoUnlinkedCountCounts Active Directory GPOs that are not linked to any OU, domain, or site.
• Test-MtAdGpoUnlinkedDetailsReturns details of unlinked Group Policy Objects (GPOs) in Active Directory.
• Test-MtAdGpoUnlinkedTargetCountCounts AD targets (OUs, domains, sites) that do not have any GPO links.
• Test-MtAdGpoUserSettingsDisabledDetailsReturns details of GPOs where user settings are disabled.
• Test-MtAdGpoVersionMismatchCountCounts the number of GPOs with a version mismatch.
• Test-MtAdGpoVersionMismatchDetailsReturns details of GPOs with a version mismatch.
• Test-MtAdGpoWmiFilterCountCounts the number of GPOs that have a non-empty WMI filter.
• Test-MtAdGpoWmiFilterDetailsReturns details of GPOs that have a non-empty WMI filter.
• Test-MtAdGroupAdminCountCounts groups with AdminCount set in Active Directory.
• Test-MtAdGroupChangeAveragePerYearCalculates the average group membership changes per year in Active Directory.
• Test-MtAdGroupDistributionCountCounts the number of distribution groups in Active Directory.
• Test-MtAdGroupDomainLocalCountCounts the number of domain local groups in Active Directory.
• Test-MtAdGroupEmptyNonPrivilegedCountCounts empty non-privileged groups in Active Directory.
• Test-MtAdGroupEmptyNonPrivilegedDetailsDetails of empty non-privileged groups in Active Directory.
• Test-MtAdGroupGlobalCountCounts the number of global groups in Active Directory.
• Test-MtAdGroupInContainerCountCounts groups located in container objects (CN=) instead of Organizational Units (OU=).
• Test-MtAdGroupMemberAccountTypeCountCounts the distinct account types of members across Active Directory groups.
• Test-MtAdGroupMemberAccountTypeDetailsProvides detailed breakdown of member account types across Active Directory groups.
• Test-MtAdGroupMemberDistinctGroupCountCounts the distinct groups that have members in Active Directory.
• Test-MtAdGroupMemberForeignSidCountCounts the foreign SID principals in Active Directory groups.
• Test-MtAdGroupMemberForeignSidDetailsDetails of foreign security principals by their domain of origin.
• Test-MtAdGroupMemberTrustCountCounts the trust members in Active Directory groups.
• Test-MtAdGroupMemberTrustDetailsProvides detailed breakdown of trust members by group in Active Directory.
• Test-MtAdGroupPrivilegedWithMembersCountCounts privileged groups that have members in Active Directory.
• Test-MtAdGroupPrivilegedWithMembersDetailsDetails of privileged groups with their member counts in Active Directory.
• Test-MtAdGroupSecurityCountCounts the number of security groups in Active Directory.
• Test-MtAdGroupSidHistoryCountCounts groups with SID History set in Active Directory.
• Test-MtAdGroupStaleCountCounts groups that have not been modified since before 2020.
• Test-MtAdGroupUniversalCountCounts the number of universal groups in Active Directory.
• Test-MtAdGroupWithManagerCountCounts groups that have a manager assigned via the ManagedBy attribute.
• Test-MtAdIntermediateCaCountCounts the intermediate certificate authorities configured in Active Directory.
• Test-MtAdIntermediateCaDetailsRetrieves detailed information about intermediate certificate authorities.
• Test-MtAdIpSiteLinksCountCounts the number of IP site links in Active Directory.
• Test-MtAdKdsRootKeysCountCounts the number of KDS root keys used for gMSA in Active Directory.
• Test-MtAdKrbtgtLastLogonChecks the KRBTGT account last logon time.
• Test-MtAdKrbtgtNonStandardUacCountChecks if the KRBTGT account has non-standard User Account Control (UAC) settings.
• Test-MtAdKrbtgtPasswordLastSetChecks when the KRBTGT account password was last set.
• Test-MtAdLapsInstalledStatusChecks whether Local Administrator Password Solution (LAPS) is installed in Active Directory.
• Test-MtAdLdapQueryPolicyCountCounts Active Directory LDAP query policies.
• Test-MtAdMachineAccountQuotaRetrieves the ms-DS-MachineAccountQuota value for the domain.
• Test-MtAdManagedServiceAccountCountCounts managed service accounts (MSAs) in the domain.
• Test-MtAdNetbiosNameNonStandardDetailsLists details of NetBIOS names that don't comply with naming standards.
• Test-MtAdNetbiosNameStandardComplianceChecks if NetBIOS names comply with naming standards.
• Test-MtAdNonAutoReplicationConnectionCountChecks for non-auto-generated Active Directory replication connections.
• Test-MtAdNtAuthCertificatesCountCounts the NTAuth certificates configured in Active Directory.
• Test-MtAdOptionalFeatureCountRetrieves the count of Active Directory optional features.
• Test-MtAdOptionalFeatureEnabledDetailsRetrieves detailed information about enabled Active Directory optional features.
• Test-MtAdOptionalFeaturesCountCounts the number of Active Directory optional features.
• Test-MtAdOuAtDomainRootCountCounts the number of Organizational Units at the domain root level in Active Directory.
• Test-MtAdOuEmptyCountCounts the number of empty Organizational Units (OUs without users, groups, or computers) in Active Directory.
• Test-MtAdOuEmptyDetailsProvides detailed information about empty Organizational Units in Active Directory.
• Test-MtAdOuOverlappingNameCountCounts the number of Organizational Units with overlapping (duplicate) names in Active Directory.
• Test-MtAdOuStaleCountCounts the number of Organizational Units that have not been modified since before 2020.
• Test-MtAdPasswordComplexityRequiredChecks whether password complexity is required in the default domain password policy.
• Test-MtAdPasswordHistoryCountChecks the password history count configured in the default domain password policy.
• Test-MtAdPasswordMaxAgeChecks the maximum password age configured in the default domain password policy.
• Test-MtAdPasswordMinLengthChecks the minimum password length configured in the default domain password policy.
• Test-MtAdPasswordReversibleEncryptionChecks whether reversible encryption is enabled for passwords in the default domain password policy.
• Test-MtAdPrinterTotalCountCounts the total number of printers published in Active Directory.
• Test-MtAdRecycleBinEnabledPathsCounts Active Directory paths where the Recycle Bin is enabled.
• Test-MtAdRecycleBinStatusRetrieves the Active Directory Recycle Bin status.
• Test-MtAdRegisteredDhcpServersCountCounts the number of DHCP servers registered in Active Directory.
• Test-MtAdRidsRemainingRetrieves the number of remaining RIDs (Relative Identifiers) in the domain.
• Test-MtAdRootDseSynchronizedStatusChecks the Root DSE synchronization status.
• Test-MtAdSchemaModificationYearCountCounts the number of years with Active Directory schema modifications.
• Test-MtAdSchemaModificationYearDetailsProvides detailed breakdown of Active Directory schema modifications by year.
• Test-MtAdSchemaVersionDetailsProvides detailed Active Directory schema version information.
• Test-MtAdSchemaVersionEntryCountCounts the number of schema version entries in Active Directory.
• Test-MtAdSiteTotalCountCounts the total number of Active Directory sites.
• Test-MtAdSiteWithoutDcCountCounts the number of Active Directory sites without domain controllers.
• Test-MtAdSiteWithoutDcDetailsLists the Active Directory sites without domain controllers.
• Test-MtAdSiteWithoutSubnetCountCounts the number of Active Directory sites without subnet associations.
• Test-MtAdSiteWithoutSubnetDetailsLists the Active Directory sites without subnet associations.
• Test-MtAdSmtpSiteLinksCountCounts the number of SMTP site links in Active Directory.
• Test-MtAdSpnMappingsReturns Active Directory SPN mappings from configuration.
• Test-MtAdSpnSuffixesCountRetrieves the count of SPN (Service Principal Name) suffixes configured in the forest.
• Test-MtAdSubnetCatchAllCountCounts the number of catch-all subnets (overly broad RFC1918 ranges).
• Test-MtAdSubnetFirstOctetCountCounts the distinct first octets used in IPv4 subnets.
• Test-MtAdSubnetFirstThreeOctetsCountCounts the distinct first three octets (/24 networks) used in IPv4 subnets.
• Test-MtAdSubnetFirstTwoOctetsCountCounts the distinct first two octets (/16 networks) used in IPv4 subnets.
• Test-MtAdSubnetIpv6CatchAllCountCounts the number of IPv6 catch-all subnets in Active Directory.
• Test-MtAdSubnetIpv6CountCounts the number of IPv6 subnets configured in Active Directory.
• Test-MtAdSubnetNonInternalCountCounts the number of non-RFC1918 (public IP) subnets in Active Directory.
• Test-MtAdSubnetNonInternalDetailsLists the non-RFC1918 (public IP) subnets in Active Directory.
• Test-MtAdSubnetSiteAssociationCountCounts the number of sites that have subnet associations.
• Test-MtAdSubnetTotalCountCounts the total number of Active Directory subnets.
• Test-MtAdSubnetWithoutSiteCountCounts the number of subnets without site associations.
• Test-MtAdSupportedSaslMechanismCountRetrieves the count of supported SASL mechanisms in Active Directory.
• Test-MtAdSupportedSaslMechanismDetailsRetrieves detailed information about supported SASL mechanisms.
• Test-MtAdTombstoneLifetimeRetrieves the tombstone lifetime in days.
• Test-MtAdTombstoneLifetimeConfigReturns the Active Directory tombstone lifetime configuration.
• Test-MtAdTrustDetailsLists detailed information about all Active Directory trusts.
• Test-MtAdTrustInterForestCountCounts the number of inter-forest trusts in Active Directory.
• Test-MtAdTrustNonQuarantinedDetailsLists details of non-quarantined trusts in Active Directory.
• Test-MtAdTrustQuarantinedCountCounts the number of quarantined trusts in Active Directory.
• Test-MtAdTrustStaleCountCounts the number of stale trusts in Active Directory (trusts not validated for >60 days).
• Test-MtAdTrustStaleDetailsLists detailed information about stale trusts in Active Directory.
• Test-MtAdTrustTotalCountCounts the total number of Active Directory trusts.
• Test-MtAdTrustedRootCaCountCounts the trusted root certificate authorities configured in Active Directory.
• Test-MtAdTrustedRootCaDetailsRetrieves detailed information about trusted root certificate authorities.
• Test-MtAdUpnSuffixesCountRetrieves the count of UPN (User Principal Name) suffixes configured in the forest.
• Test-MtAdUpnSuffixesDetailsRetrieves detailed information about UPN (User Principal Name) suffixes configured in the forest.
• Test-MtAdUserAdminCountCountCounts users with AdminCount set in Active Directory.
• Test-MtAdUserBuiltInAdminCountCounts built-in administrator style user accounts.
• Test-MtAdUserBuiltInAdminEnabledDetailsReturns enabled built-in administrator style user details.
• Test-MtAdUserBuiltInAdminLastLogonDetailsReturns last logon details for built-in administrator style accounts.
• Test-MtAdUserBuiltInAdminPasswordAgeDetailsReturns password age details for built-in administrator style accounts.
• Test-MtAdUserDelegationAllowedCountCounts user accounts that are trusted for Kerberos delegation.
• Test-MtAdUserDelegationConfiguredCountCounts users with delegation configured.
• Test-MtAdUserDelegationDetailsReturns delegation details for users with delegation configured.
• Test-MtAdUserDisabledCountCounts the number of disabled user objects in Active Directory.
• Test-MtAdUserDormantEnabledCountCounts enabled user accounts that have been dormant for more than 90 days.
• Test-MtAdUserHomeDirectoryCountCounts users with a home directory configured in Active Directory.
• Test-MtAdUserHoneyPotCountCounts potential honey pot style user accounts.
• Test-MtAdUserHoneyPotDetailsReturns details for potential honey pot style user accounts.
• Test-MtAdUserInContainerCountCounts users located in container objects instead of OUs.
• Test-MtAdUserKerberosDesOnlyCountCounts user accounts configured to use DES-only Kerberos encryption.
• Test-MtAdUserKnownServiceAccountCountCounts users that match known service account naming patterns.
• Test-MtAdUserKnownServiceAccountDetailsReturns details for users matching known service account naming patterns.
• Test-MtAdUserManagerSetCountCounts users with the manager attribute set in Active Directory.
• Test-MtAdUserNeverLoggedInCountCounts enabled user accounts that have never logged on.
• Test-MtAdUserNoPreAuthCountCounts user accounts that do not require Kerberos pre-authentication.
• Test-MtAdUserNonStandardPrimaryGroupCountCounts users with a non-standard primary group in Active Directory.
• Test-MtAdUserPasswordNeverExpiresCountCounts enabled user accounts with passwords set to never expire.
• Test-MtAdUserPasswordNotRequiredCountCounts user accounts where a password is not required.
• Test-MtAdUserProfilePathCountCounts users with a profile path configured in Active Directory.
• Test-MtAdUserReversibleEncryptionCountCounts user accounts configured to allow reversible password encryption.
• Test-MtAdUserScriptPathCountCounts users with a logon script configured in Active Directory.
• Test-MtAdUserSidHistoryCountCounts users with SID History set in Active Directory.
• Test-MtAdUserSpnDomainAdminCountCounts SPNs configured on domain administrator accounts.
• Test-MtAdUserSpnDomainAdminDetailsProvides detailed information about SPNs configured on domain administrator accounts.
• Test-MtAdUserSpnNonFqdnHostsCounts user SPNs with hosts that do not use fully qualified domain names (FQDN).
• Test-MtAdUserSpnServiceClassCountCounts the distinct SPN service classes in use by user accounts.
• Test-MtAdUserSpnServiceClassUsageProvides a breakdown of SPN service class usage across user accounts.
• Test-MtAdUserSpnSetCountCounts users with SPNs configured in Active Directory.
• Test-MtAdUserSpnTotalCountCounts the total number of SPNs configured on user accounts.
• Test-MtAdUserSpnUnknownCountCounts unidentified SPN service classes on user accounts.
• Test-MtAdUserSpnUnknownDetailsProvides detailed information about unidentified SPN service classes on user accounts.
• Test-MtAdUserWorkstationRestrictionCountCounts user accounts with logon workstation restrictions configured.
• Test-MtAdWellKnownSecurityPrincipalsCountCounts the number of well-known security principal objects in Active Directory.
• Test-MtAndroidEnterpriseConnectionCheck the health of the Android Enterprise connection for Intune.
• Test-MtAppManagementPolicyEnabledChecks if the default app management policy is enabled.
• Test-MtAppRegistrationOwnersWithoutMFATests if app registration owners have Multi-Factor Authentication (MFA) enabled.
• Test-MtAppRegistrationsWithSecretsCheck if any service principals are still using secrets instead of certificates or managed identities.
• Test-MtAppleAutomatedDeviceEnrollmentTokenCheck the validity of the Apple Automated Device Enrollment (ADE) token for Intune.
• Test-MtApplePushNotificationCertificateCheck the validity of the Apple Push Notification Service (APNS) Certificate for Intune.
• Test-MtAppleVolumePurchaseProgramTokenCheck the validity of the Apple Volume Purchase Program (VPP) token for Intune.
• Test-MtAuthenticationPolicyReferencedObjectsExistChecks if authentication method policies reference valid groups that exist in the tenant.
• Test-MtBitLockerFullDiskEncryptionEnsure at least one Intune Disk Encryption policy enforces BitLocker with full disk encryption type.
• Test-MtCaAgentRiskBlockPolicyChecks if the tenant has at least one conditional access policy that blocks agent identities based on their risk level.
• Test-MtCaAllAppsExistsChecks if the tenant has at least one fallback policy targeting All Apps and All Users.
• Test-MtCaApplicationEnforcedRestrictionChecks if the tenant has at least one conditional access policy is configured to enable application enforced restrictions
• Test-MtCaApprovedClientAppChecks if the tenant has no conditional access policy that requires an approved client app.
• Test-MtCaAzureDevOpsChecks if any conditional access policy explicitly includes Azure DevOps
• Test-MtCaBlockLegacyExchangeActiveSyncAuthenticationChecks if the tenant has at least one conditional access policy that blocks legacy authentication for Exchange Active Sync authentication.
• Test-MtCaBlockLegacyOtherAuthenticationChecks if the tenant has at least one conditional access policy that blocks legacy authentication.
• Test-MtCaBlockUnknownOrUnsupportedDevicePlatformChecks if the tenant has at least one Conditional Access policy is configured to block access for unknown or unsupported device platforms
• Test-MtCaDeviceCodeFlowChecks if the tenant has at least one conditional access policy that includes Authentication Flows - Device Code Flow as a condition.
• Test-MtCaDeviceComplianceAdminsExistsChecks if the tenant has at least one conditional access policy requiring device compliance for admins.
• Test-MtCaDeviceComplianceExistsChecks if the tenant has at least one conditional access policy requiring device compliance.
• Test-MtCaEmergencyAccessExistsChecks if the tenant has at least one emergency/break glass account or account group excluded from all conditional access policies
• Test-MtCaEnforceNonPersistentBrowserSessionChecks if the tenant has at least one conditional access policy enforcing non persistent browser session
• Test-MtCaEnforceSignInFrequencyChecks if the tenant has at least one conditional access policy enforcing sign-in frequency for non-corporate devices
• Test-MtCaExclusionForDirectorySyncAccountChecks if all conditional access policies scoped to all cloud apps and all users exclude the directory synchronization accounts
• Test-MtCaGapThis function checks if all objects found in policy exclusions are found in policy inclusions.
• Test-MtCaGroupsRestrictedChecks if groups used in Conditional Access are protected by either Restricted Management Administrative Units or Role Assignable Groups.
• Test-MtCaLicenseUtilizationTest Conditional Access License Utilization and return stats on usage for the specific license.
• Test-MtCaMfaForAdminChecks if the tenant has at least one conditional access policy requiring MFA for admins
• Test-MtCaMfaForAdminManagementChecks if the tenant has at least one conditional access policy requiring multifactor authentication to access Azure management.
• Test-MtCaMfaForAllUsersChecks if the tenant has at least one conditional access policy requiring multifactor authentication for all users
• Test-MtCaMfaForGuestChecks if the tenant has at least one conditional access policy requiring multifactor authentication for all guest users.
• Test-MtCaMfaForRiskySignInChecks if the tenant has at least one conditional access policy requiring multifactor authentication for risky sign-ins.
• Test-MtCaMisconfiguredIDProtectionChecks for common misconfigurations in Conditional Access - both user risk and sign-in risk are configured in one policy.
• Test-MtCaReferencedGroupsExistChecks if any conditional access policies include or exclude groups that have been deleted.
• Test-MtCaReferencedObjectsExistChecks if any conditional access policies reference non-existent users, groups, or roles.
• Test-MtCaRequirePasswordChangeForHighUserRiskChecks if the tenant has at least one conditional access policy requiring password change for high user risk.
• Test-MtCaSecureSecurityInfoRegistrationChecks if the tenant has at least one conditional access policy securing security info registration.
• Test-MtCaUntargetedPolicyChecks if any Conditional Access policy is not targeted to any resource.
• Test-MtCaWIFBlockLegacyAuthenticationChecks if the user is blocked from using legacy authentication
• Test-MtCertificateConnectorsCheck Intune Certificate Connectors Health and Version
• Test-MtCis365PublicGroupChecks if there are public groups
• Test-MtCisAdminConsentWorkflowEnabledChecks if the admin consent workflow is enabled
• Test-MtCisAttachmentFilterChecks if the default common attachment types filter is enabled
• Test-MtCisAttachmentFilterComprehensiveChecks if the common attachment types filter is comprehensive
• Test-MtCisAuditLogSearchChecks if audit log search is enabled
• Test-MtCisCalendarSharingChecks state of sharing policies
• Test-MtCisCloudAdminChecks if Global Admins are cloud users
• Test-MtCisCommunicateInitiateExternalTeamsUsersEnsure external Teams users cannot initiate conversations
• Test-MtCisCommunicateWithUnmanagedTeamsUsersEnsure communication with unmanaged Teams users is disabled
• Test-MtCisConnectionFilterSafeListChecks if connection filter IPs are allow listed
• Test-MtCisCreateTenantDisallowedChecks if non-admin users are restricted from creating tenants
• Test-MtCisCustomerLockBoxChecks if the customer lockbox feature is enabled
• Test-MtCisDevicesWithoutCompliancePolicyMarkedChecks if devices without a compliance policy assigned are marked "not compliant".
• Test-MtCisDkimChecks state of DKIM for all EXO domains
• Test-MtCisEnsureBitLockerKeyRecoveryRestrictedChecks if non-admin users are restricted from recovering BitLocker keys for their owned devices.
• Test-MtCisEnsureGuestAccessRestrictedChecks if guest user access is restricted.
• Test-MtCisEnsureGuestUserDynamicGroupChecks if minimum one dynamic group exists with a membership rule targeting guest users.
• Test-MtCisEnsureUserConsentToAppsDisallowedChecks if user consent to applications is disallowed.
• Test-MtCisExoAdditionalStorageProviderChecks if additional storage providers are restricted in Outlook on the web
• Test-MtCisFormsPhishingProtectionEnabledChecks if the internal phishing protection for Microsoft Forms is enabled.
• Test-MtCisGitHubIssueDeletionLimitedCIS.GH.1.2.4: Ensure issue deletion is limited to specific users.
• Test-MtCisGitHubRepositoryCreationLimitedCIS.GH.1.2.2: Ensure repository creation is limited to specific members.
• Test-MtCisGitHubRepositoryDeletionLimitedCIS.GH.1.2.3: Ensure repository deletion is limited to specific users.
• Test-MtCisGitHubStrictBasePermissionCIS.GH.1.3.8: Ensure strict base permissions are set for repositories.
• Test-MtCisGitHubTeamCreationLimitedCIS.GH.1.3.2: Ensure team creation is limited to specific members.
• Test-MtCisGlobalAdminCountChecks if the number of Global Admins is between 2 and 4
• Test-MtCisHostedConnectionFilterPolicyChecks if connection filter IPs are allow listed
• Test-MtCisInternalMalwareNotificationChecks if notifications for internal users sending malware are enabled
• Test-MtCisOutboundSpamFilterPolicyChecks if Exchange Online Spam Policies are set to notify administrators
• Test-MtCisPasswordExpiryChecks if passwords are set to expire
• Test-MtCisSafeAntiPhishingPolicyChecks if the anti-phishing policy matches CIS recommendations
• Test-MtCisSafeAttachmentChecks if the Safe Attachments policy is enabled
• Test-MtCisSafeAttachmentsAtpPolicyChecks if Safe Attachments for SharePoint, OneDrive, and Microsoft Teams are enabled
• Test-MtCisSafeLinkChecks if safe links for office applications are Enabled
• Test-MtCisSharedMailboxSignInChecks if shared mailboxes allow sign-ins
• Test-MtCisSpoB2BIntegrationEnsure SharePoint and OneDrive integration with Azure AD B2B is enabled
• Test-MtCisSpoDefaultSharingLinkEnsure link sharing is restricted in SharePoint and OneDrive
• Test-MtCisSpoDefaultSharingLinkPermissionEnsure the SharePoint default sharing link permission is set
• Test-MtCisSpoGuestAccessExpiryEnsure guest access to a site or OneDrive will expire automatically
• Test-MtCisSpoGuestCannotShareUnownedItemEnsure that SharePoint guest users cannot share items they don't own
• Test-MtCisSpoPreventDownloadMaliciousFileEnsure Office 365 SharePoint infected files are disallowed for download
• Test-MtCisTeamsLobbyBypassEnsure only people in my org can bypass the lobby
• Test-MtCisTeamsReportSecurityConcernsEnsure users can report security concerns in Teams to internal destination
• Test-MtCisThirdPartyAndCustomAppsEnsure all or a majority of third-party and custom apps are blocked
• Test-MtCisThirdPartyApplicationsDisallowedChecks if users are not allowed to register applications.
• Test-MtCisThirdPartyFileSharingEnsure third-party file sharing cloud services in Teams are disabled
• Test-MtCisThirdPartyStorageServicesRestrictedChecks if users are restricted to store and share files in third-party storage services in Microsoft 365 on the web.
• Test-MtCisUserOwnedAppsRestrictedChecks if users are restricted to install add-ins from the Office Store and start trials on behalf of the organization.
• Test-MtCisWeakAuthenticationMethodsDisabledChecks if weak authentication methods (SMS, voice call, email OTP) are disabled in the tenant.
• Test-MtCisZAPChecks if the Zero-hour auto purge (ZAP) for Microsoft Teams is enabled
• Test-MtCisaActivationNotificationChecks for notification on role activation
• Test-MtCisaAntiSpamAllowListChecks state of anti-spam policies
• Test-MtCisaAntiSpamSafeListChecks state of anti-spam policies
• Test-MtCisaAppAdminConsentChecks if admin consent workflow is configured with reviewers
• Test-MtCisaAppGroupOwnerConsentChecks if group owners can consent to apps
• Test-MtCisaAppRegistrationChecks if user app registration is prevented
• Test-MtCisaAppUserConsentChecks if user app consent is prevented
• Test-MtCisaAssignmentNotificationChecks for notification on role assignments
• Test-MtCisaAttachmentFileTypeChecks state of preset security policies
• Test-MtCisaAttachmentFilterChecks state of preset security policies
• Test-MtCisaAuditLogChecks state of purview
• Test-MtCisaAuditLogPremiumChecks state of purview
• Test-MtCisaAuditLogRetentionChecks state of purview
• Test-MtCisaAuthenticatorContextChecks if the Authentication Methods policy for Microsoft Authenticator is set appropriately
• Test-MtCisaAutoExternalForwardingChecks ...
• Test-MtCisaBlockExecutableChecks state of preset security policies
• Test-MtCisaBlockHighRiskSignInChecks if Sign-In Risk Based Policies - MS.AAD.2.3 is set to 'blocked'
• Test-MtCisaBlockHighRiskUserChecks if User Risk Based Policies - MS.AAD.2.1 is set to 'blocked'
• Test-MtCisaBlockLegacyAuthChecks if Baseline Policies Legacy Authentication - MS.AAD.1.1v1 is set to 'blocked'
• Test-MtCisaCalendarSharingChecks state of sharing policies
• Test-MtCisaCloudGlobalAdminChecks if Global Admins are cloud users
• Test-MtCisaContactSharingChecks state of sharing policies
• Test-MtCisaCrossTenantInboundDefaultChecks cross-tenant default inbound access configuration
• Test-MtCisaDiagnosticSettingsChecks for configuration of Entra diagnostic settings
• Test-MtCisaDkimChecks state of DKIM for all EXO domains
• Test-MtCisaDlpChecks state of DLP for EXO
• Test-MtCisaDlpAlternateThis will always return $null
• Test-MtCisaDlpBaselineRuleChecks state of baseline CISA rules for DLP in EXO
• Test-MtCisaDlpPiiChecks state of DLP for EXO
• Test-MtCisaDmarcAggregateCisaChecks state of DMARC records for all exo domains
• Test-MtCisaDmarcRecordExistChecks state of DMARC records for all exo second level domains
• Test-MtCisaDmarcRecordRejectChecks state of DMARC records for all exo domains
• Test-MtCisaDmarcReportChecks state of DMARC records for all exo domains
• Test-MtCisaEmailFilterAlternativePlaceholder
• Test-MtCisaExoAlertChecks state of alerts
• Test-MtCisaExoAlertSiemChecks state of alerts
• Test-MtCisaExternalSenderWarningChecks state of transport policies
• Test-MtCisaGlobalAdminCountChecks if Global Admins is an acceptable number
• Test-MtCisaGlobalAdminRatioChecks the ratio of global admins to privileged roles
• Test-MtCisaGuestInvitationChecks if guest invitations are restricted to admins
• Test-MtCisaGuestUserAccessChecks if guests use proper role template
• Test-MtCisaImpersonationChecks state of preset security policies
• Test-MtCisaImpersonationTipChecks state of preset security policies
• Test-MtCisaMailboxAuditingChecks state of mailbox auditing
• Test-MtCisaMailboxIntelligenceChecks state of preset security policies
• Test-MtCisaMalwareActionChecks state of preset security policies
• Test-MtCisaMalwareZapChecks state of preset security policies
• Test-MtCisaManagedDeviceChecks if Conditional Access Policy requiring managed device is enabled
• Test-MtCisaManagedDeviceRegistrationChecks if a policy is enabled requiring a managed device for registration
• Test-MtCisaMethodsMigrationChecks if migration to Authentication Methods is complete
• Test-MtCisaMfaChecks if Conditional Access Policy requiring MFA is enabled
• Test-MtCisaNotifyHighRiskChecks if Risk Based Policies - MS.AAD.2.2v1 has recipients
• Test-MtCisaPasswordExpirationChecks if passwords are set to not expire
• Test-MtCisaPermanentRoleAssignmentChecks for permanent active role assingments
• Test-MtCisaPhishResistantChecks if Conditional Access Policy using Phishing-Resistant Authentication Strengths is enabled
• Test-MtCisaPrivilegedPhishResistantChecks if Conditional Access Policy requiring phishing resistant authentication methods for privileged roles is enabled
• Test-MtCisaRequireActivationApprovalChecks for approval requirement on activation of Gloabl Admin role
• Test-MtCisaSafeLinkChecks state of URL block list
• Test-MtCisaSafeLinkClickTrackingChecks state of URL direct download scans
• Test-MtCisaSafeLinkDownloadScanChecks state of URL direct download scans
• Test-MtCisaSmtpAuthenticationChecks state of SMTP authentication in Exchange Online.
• Test-MtCisaSpamActionChecks state of spam filter
• Test-MtCisaSpamAlternativeChecks state of spam filter
• Test-MtCisaSpamBypassChecks state of spam filter
• Test-MtCisaSpamFilterChecks state of spam filter
• Test-MtCisaSpfDirectiveChecks state of SPF records for all exo domains
• Test-MtCisaSpfRestrictionChecks state of SPF records for all exo domains
• Test-MtCisaSpoAnyoneLinkExpirationChecks state of Anyone link expiration for SharePoint Online
• Test-MtCisaSpoAnyoneLinkPermissionChecks state of Anyone link permissions for SharePoint Online
• Test-MtCisaSpoDefaultSharingPermissionChecks state of default SharePoint Online sharing permission
• Test-MtCisaSpoDefaultSharingScopeChecks state of default SharePoint Online sharing scope
• Test-MtCisaSpoOneDriveSharingChecks state of OneDrive sharing
• Test-MtCisaSpoSharingChecks state of SharePoint Online sharing
• Test-MtCisaSpoSharingAllowedDomainChecks state of SharePoint Online sharing
• Test-MtCisaSpoVerificationCodeReauthChecks state of verification code reauthentication for SharePoint Online
• Test-MtCisaUnmanagedRoleAssignmentChecks for active role assingments with no start time
• Test-MtCisaWeakFactorChecks if weak Authentication Methods are disabled
• Test-MtConditionalAccessWhatIfTests Conditional Access evaluation with What If for a given scenario.
• Test-MtConnectionChecks if the current session is connected to the specified service.
• Test-MtDeviceComplianceSettingsEnsure the built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant'
• Test-MtDeviceRegistrationLocalAdminsGlobalAdminTests whether global administrators are configured as local administrators on devices during Microsoft Entra join.
• Test-MtDeviceRegistrationLocalAdminsRegisteringUserTests whether registering users are configured as local administrators on devices during Microsoft Entra join.
• Test-MtDeviceRegistrationMfaConflictThis function checks if MFA during device registration is being enforced in Entra ID settings and in conditional access policies.
• Test-MtDomainsDmarcRecordMaturityChecks maturity of policies and percentage values in DMARC records for all Entra registered domains.
• Test-MtEidscaAF01Checks if Authentication Method - FIDO2 security key - State is set to 'enabled'
• Test-MtEidscaAF02Checks if Authentication Method - FIDO2 security key - Allow self-service set up is set to 'true'
• Test-MtEidscaAF03Checks if Authentication Method - FIDO2 security key - Enforce attestation is set to 'true'
• Test-MtEidscaAF04Checks if Authentication Method - FIDO2 security key - Enforce key restrictions is set to 'true'
• Test-MtEidscaAF05Checks if Authentication Method - FIDO2 security key - Restricted is set to 'true'
• Test-MtEidscaAF06Checks if Authentication Method - FIDO2 security key - Restrict specific keys is set to 'true'
• Test-MtEidscaAG01Checks if Authentication Method - General Settings - Manage migration is set to @('migrationComplete', '')
• Test-MtEidscaAG02Checks if Authentication Method - General Settings - Report suspicious activity - State is set to 'enabled'
• Test-MtEidscaAG03Checks if Authentication Method - General Settings - Report suspicious activity - Included users/groups is set to 'all_users'
• Test-MtEidscaAM01Checks if Authentication Method - Microsoft Authenticator - State is set to 'enabled'
• Test-MtEidscaAM02Checks if Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP is set to 'false'
• Test-MtEidscaAM03Checks if Authentication Method - Microsoft Authenticator - Require number matching for push notifications is set to 'enabled'
• Test-MtEidscaAM04Checks if Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications is set to 'all_users'
• Test-MtEidscaAM06Checks if Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications is set to 'enabled'
• Test-MtEidscaAM07Checks if Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications is set to 'all_users'
• Test-MtEidscaAM09Checks if Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications is set to 'enabled'
• Test-MtEidscaAM10Checks if Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications is set to 'all_users'
• Test-MtEidscaAP01Checks if Default Authorization Settings - Enabled Self service password reset for administrators is set to 'false'
• Test-MtEidscaAP04Checks if Default Authorization Settings - Guest invite restrictions is set to @('adminsAndGuestInviters','none')
• Test-MtEidscaAP05Checks if Default Authorization Settings - Sign-up for email based subscription is set to 'false'
• Test-MtEidscaAP06Checks if Default Authorization Settings - User can join the tenant by email validation is set to 'false'
• Test-MtEidscaAP07Checks if Default Authorization Settings - Guest user access is set to '2af84b1e-32c8-42b7-82bc-daa82404023b'
• Test-MtEidscaAP08Checks if Default Authorization Settings - User consent policy assigned for applications is set to 'ManagePermissionGrantsForSelf.microsoft-user-default-low'
• Test-MtEidscaAP09Checks if Default Authorization Settings - Allow user consent on risk-based apps is set to 'false'
• Test-MtEidscaAP10Checks if Default Authorization Settings - Default User Role Permissions - Allowed to create Apps is set to 'false'
• Test-MtEidscaAP14Checks if Default Authorization Settings - Default User Role Permissions - Allowed to read other users is set to 'true'
• Test-MtEidscaAS04Checks if Authentication Method - SMS - Use for sign-in is set to 'false'
• Test-MtEidscaAT01Checks if Authentication Method - Temporary Access Pass - State is set to 'enabled'
• Test-MtEidscaAT02Checks if Authentication Method - Temporary Access Pass - One-time is set to 'true'
• Test-MtEidscaAV01Checks if Authentication Method - Voice call - State is set to 'disabled'
• Test-MtEidscaCP01Checks if Default Settings - Consent Policy Settings - Group owner consent for apps accessing data is set to 'False'
• Test-MtEidscaCP03Checks if Default Settings - Consent Policy Settings - Block user consent for risky apps is set to 'true'
• Test-MtEidscaCP04Checks if Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to is set to 'true'
• Test-MtEidscaCR01Checks if Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature is set to 'true'
• Test-MtEidscaCR02Checks if Consent Framework - Admin Consent Request - Reviewers will receive email notifications for requests is set to 'true'
• Test-MtEidscaCR03Checks if Consent Framework - Admin Consent Request - Reviewers will receive email notifications when admin consent requests are about to expire is set to 'true'
• Test-MtEidscaCR04Checks if Consent Framework - Admin Consent Request - Consent request duration (days) is set to 30
• Test-MtEidscaControlTests your environment for compliance with the specified EIDSCA control
• Test-MtEidscaPR01Checks if Default Settings - Password Rule Settings - Password Protection - Mode is set to 'Enforce'
• Test-MtEidscaPR02Checks if Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory is set to 'True'
• Test-MtEidscaPR03Checks if Default Settings - Password Rule Settings - Enforce custom list is set to 'True'
• Test-MtEidscaPR05Checks if Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds is set to 60
• Test-MtEidscaPR06Checks if Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold is set to 10
• Test-MtEidscaST08Checks if Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner is set to 'false'
• Test-MtEidscaST09Checks if Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content is set to 'True'
• Test-MtEntitlementManagementDeletedGroupsChecks if Entra ID Governance access packages or catalogs reference deleted groups
• Test-MtEntitlementManagementInactivePoliciesChecks if access packages have inactive or orphaned assignment policies
• Test-MtEntitlementManagementOrphanedResourcesChecks if catalogs contain unused resources without associated access packages
• Test-MtEntitlementManagementValidApproversChecks if access package approval workflows have valid approvers
• Test-MtEntitlementManagementValidResourceRolesValidates catalog resources have no stale app roles or deleted service principals
• Test-MtEntraDeviceJoinRestrictedTests if Entra ID device join is restricted to selected users/groups or disabled.
• Test-MtEntraIDConnectSssoEnsure Microsoft Entra seamless single sign-on is disabled for all domains.
• Test-MtEntraIDConnectSyncOnPremisesObjectIdentifierUpdatesBlockedChecks if the temporary bypass for onPremisesObjectIdentifier updates is disabled
• Test-MtEntraIDConnectSyncSoftHardMatchingEnsure soft and hard matching for on-premises synchronization objects is blocked
• Test-MtExoDelicensingResiliencyChecks if Delicensing Resiliency is enabled in Exchange Online
• Test-MtExoMailTipChecks if MailTips are enabled for end users
• Test-MtExoModernAuthChecks if modern authentication for Exchange Online is enabled
• Test-MtExoMoeraMailActivityChecks the sent mail activity for MOERA addresses in the past 7 days.
• Test-MtExoOutlookAddinChecks if users installing Outlook add-ins is not allowed
• Test-MtExoRejectDirectSendChecks if direct send is configured to reject
• Test-MtExoSetSclChecks if Spam confidence level (SCL) is configured in mail transport rules with specific domains
• Test-MtFeatureUpdatePolicyCheck whether a Windows Feature Update Policy in Intune is using unsupported builds.
• Test-MtGroupCreationRestrictedChecks if Microsoft 365 Group creation is restricted to approved users.
• Test-MtHighRiskAppPermissionsCheck if any applications or service principals have high risk Graph permissions that can lead to direct or indirect paths
• Test-MtIntuneASRRulesEnsure the Microsoft Defender ASR Standard Protection baseline rules are configured in Block or Audit mode.
• Test-MtIntuneAppControlEnsure at least one Intune App Control for Business policy is configured.
• Test-MtIntuneDiagnosticSettingsCheck the Intune Diagnostic Settings for Audit Logs.
• Test-MtIntuneLAPSConfigurationEnsure at least one Intune LAPS policy is configured to back up local admin passwords to Entra ID.
• Test-MtIntuneManagedInstallerRulesEnsure at least one Intune App Control for Business policy has Managed Installer enabled.
• Test-MtIntuneRbacGroupsProtectedChecks if Intune RBAC groups are protected by Restricted Management Administrative Units or Role Assignable Groups.
• Test-MtKrbtgtAzureADNotSyncedEnsure krbtgt_AzureAD is not synchronized from on-premises Active Directory.
• Test-MtLimitOnMicrosoftDomainUsageEnsure mailboxes do not use the .onmicrosoft.com domain as primary SMTP address
• Test-MtManagedDeviceCleanupSettingsEnsure device clean-up rule is configured
• Test-MtManagementGroupWriteRequirementChecks if write permissions are required to create new management groups
• Test-MtMdeArchiveScanningChecks if archive scanning is enabled in Microsoft Defender Antivirus policies
• Test-MtMdeBehaviorMonitoringChecks if behavior monitoring is enabled in Microsoft Defender Antivirus policies
• Test-MtMdeCatchupFullScanChecks if catch-up full scan is disabled to avoid additional system load
• Test-MtMdeCatchupQuickScanChecks if catch-up quick scan is disabled to avoid additional system load
• Test-MtMdeCloudBlockLevelChecks if cloud block level is set to High or higher
• Test-MtMdeCloudExtendedTimeoutChecks if cloud extended timeout is configured between 30-50 seconds
• Test-MtMdeCloudProtectionChecks if cloud protection is enabled in Microsoft Defender Antivirus policies
• Test-MtMdeCpuLoadFactorChecks if the average CPU load factor is configured between 20-30%
• Test-MtMdeDisableLocalAdminMergeChecks if local admin merge is disabled to block local exclusions
• Test-MtMdeEmailScanningChecks if email scanning is enabled in Microsoft Defender Antivirus policies
• Test-MtMdeMappedDriveScanningChecks if full scan on mapped network drives is disabled in Microsoft Defender Antivirus policies
• Test-MtMdeNetworkFileScanningChecks if scanning network files is enabled in Microsoft Defender Antivirus policies
• Test-MtMdeNetworkProtectionChecks if Network Protection is enabled in block or audit mode
• Test-MtMdePuaProtectionChecks if PUA (Potentially Unwanted Applications) protection is enabled
• Test-MtMdeQuickScanTimeChecks that quick scan time configuration is not required
• Test-MtMdeRealtimeMonitoringChecks if real-time monitoring is enabled in Microsoft Defender Antivirus policies
• Test-MtMdeRealtimeScanDirectionChecks if real-time scan direction is set to monitor both incoming and outgoing files
• Test-MtMdeRemovableDriveScanningChecks if full scan of removable drives is enabled in Microsoft Defender Antivirus policies
• Test-MtMdeRetainCleanedMalwareChecks if cleaned malware is retained for at least 30 days for forensic analysis
• Test-MtMdeScheduleScanDayChecks if a scheduled scan day is configured
• Test-MtMdeScriptScanningChecks if script scanning is enabled in Microsoft Defender Antivirus policies
• Test-MtMdeSignatureBeforeScanChecks if signature checking before scan is enabled for zero-day protection
• Test-MtMdeSignatureUpdateIntervalChecks if signature update interval is configured between 1-4 hours
• Test-MtMdeSubmitSamplesConsentChecks if sample submission consent is configured to send safe samples automatically
• Test-MtMdmAuthorityCheck the MDM Authority for Intune.
• Test-MtMobileThreatDefenseConnectorsCheck the Intune Mobile Threat Defense Connectors.
• Test-MtOperationApprovalPoliciesCheck for the usage of Intune Multi Admin Approval Policies
• Test-MtPimAlertsExistsChecks if PIM alerts exists
• Test-MtPrivPermanentDirectoryRoleChecks if Permanent Assignments for Entra ID roles exists
• Test-MtPurviewAiDlpPolicyEnsure a Microsoft Purview DLP policy is configured for the Microsoft 365 Copilot location.
• Test-MtPurviewAiInsiderRiskPolicyEnsure a Microsoft Purview Insider Risk Management policy from the Risky AI usage template is configured and enabled.
• Test-MtPurviewAiRetentionPolicyEnsure a Microsoft Purview retention policy is configured for Microsoft 365 Copilot interactions.
• Test-MtPurviewAiSensitivityLabelsForFilesEnsure Microsoft Purview sensitivity labels are published so Microsoft 365 Copilot and DSPM for AI honor and inherit them on AI-generated content.
• Test-MtPurviewAuditLogIngestionEnsure the Microsoft 365 unified audit log is enabled so tenant activity is captured for Microsoft Purview and downstream compliance controls.
• Test-MtSecurityGroupCreationRestrictedTests if security group creation is restricted to admin users.
• Test-MtServicePrincipalsForAllUsersThis test checks if you have any third party service principals that are open to all users.
• Test-MtSpExchangeAppAccessPolicyCheck if service principals with Exchange permissions have application access policies configured.
• Test-MtTeamsRestrictParticipantGiveRequestControlChecks if Teams is configured to only allow users with presenter rights to share content during meetings.
• Test-MtTenantCreationRestrictedTests if Entra ID tenant creation is restricted to admin users.
• Test-MtTenantCustomizationCheck the Intune Tenant Customization.
• Test-MtUserAccessAdminChecks if any Global Admins have User Access Control permissions at the Root Scope
• Test-MtVaultSoftDeleteChecks if all Recovery Services Vaults have Soft Delete enabled
• Test-MtWindowsDataProcessorCheck the Intune Windows Data Processor settings.
• Test-MtXspmAppRegWithPrivilegedApiAndOwnersTests if app registration owners with privileged API permissions have delegated ownership.
• Test-MtXspmAppRegWithPrivilegedRolesAndOwnersTests if app registration owners with highly privileged Entra ID roles have delegated ownership.
• Test-MtXspmAppRegWithPrivilegedUnusedPermissionsTests if app registration have assigned privileged API permissions which are unused.
• Test-MtXspmCriticalCredentialsOnNonCredGuardProtectedDevicesFind devices with critical credentials stored on devices not protected by Credential Guard.
• Test-MtXspmCriticalCredentialsOnNonTpmProtectedDevicesTest to find devices that have critical credentials stored on devices that are not protected by TPM.
• Test-MtXspmCriticalCredsOnDevicesWithNonCriticalAccountsTest to find devices with critical and non-critical user credentials on the same device
• Test-MtXspmEnabledPrivilegedUsersLinkedToDisabledIdentityTests if enabled privileged users with assigned high privileged Entra ID roles or criticality level (<= 1) are linked to a disabled identity in Microsoft Defender XDR.
• Test-MtXspmExposedCredentialsForPrivilegedUsersTests if exposed credentials for highly privileged users are present on vulnerable endpoints with high risk or exposure score.
• Test-MtXspmHybridUsersWithAssignedEntraIdRolesTests if hybrid users have been assigned eligible or permanent to Entra ID roles.
• Test-MtXspmPendingApprovalCriticalAssetManagementTests for pending approval for Critical Asset Management.
• Test-MtXspmPrivilegedUsersLinkedToIdentityTests if privileged users with assigned high privileged Entra ID roles are linked to an identity.
• Test-MtXspmPublicRemotelyExploitableHighExposureDevicesTest to find public exposed devices with remotely exploitable, highly likely to be exploited, high or critical severity CVE's
• Test-ORCA100Bulk Complaint Level threshold is between 4 and 6.
• Test-ORCA101Bulk is marked as spam.
• Test-ORCA102Advanced Spam filter options are turned off.
• Test-ORCA103Outbound spam filter policy settings configured.
• Test-ORCA104High Confidence Phish action set to Quarantine message.
• Test-ORCA105Safe Links Synchronous URL detonation is enabled.
• Test-ORCA106Quarantine retention period is 30 days.
• Test-ORCA107End-user spam notification is enabled.
• Test-ORCA108DKIM signing is set up for all your custom domains.
• Test-ORCA108_1DNS Records have been set up to support DKIM.
• Test-ORCA109Senders are not being allow listed in an unsafe manner.
• Test-ORCA110Internal Sender notifications are disabled.
• Test-ORCA111Anti-phishing policy exists and EnableUnauthenticatedSender is true.
• Test-ORCA112Anti-spoofing protection action is configured to Move message to the recipients' Junk Email folders in Anti-phishing policy.
• Test-ORCA113AllowClickThrough is disabled in Safe Links policies.
• Test-ORCA114No IP Allow Lists have been configured.
• Test-ORCA115Mailbox intelligence based impersonation protection is enabled in anti-phishing policies.
• Test-ORCA116Mailbox intelligence based impersonation protection action set to move message to junk mail folder.
• Test-ORCA118_1Domains are not being allow listed in an unsafe manner in Anti-Spam Policies.
• Test-ORCA118_2Domains are not being allow listed in an unsafe manner in Transport Rules.
• Test-ORCA118_3Your own domains are not being allow listed in an unsafe manner in Anti-Spam Policies.
• Test-ORCA118_4Your own domains are not being allow listed in an unsafe manner in Transport Rules.
• Test-ORCA119Similar Domains Safety Tips is enabled.
• Test-ORCA120_malwareZero Hour Autopurge Enabled for Malware.
• Test-ORCA120_phishZero Hour Autopurge Enabled for Phish.
• Test-ORCA120_spamZero Hour Autopurge Enabled for Spam.
• Test-ORCA121Supported filter policy action used.
• Test-ORCA123Unusual Characters Safety Tips is enabled.
• Test-ORCA124Safe attachments unknown malware response set to block messages.
• Test-ORCA139Spam action set to move message to junk mail folder or quarantine.
• Test-ORCA140High Confidence Spam action set to Quarantine message.
• Test-ORCA141Bulk action set to Move message to Junk Email Folder.
• Test-ORCA142Phish action set to Quarantine message.
• Test-ORCA143Safety Tips are enabled.
• Test-ORCA156Safe Links Policies are tracking when user clicks on safe links.
• Test-ORCA158Safe Attachments is enabled for SharePoint and Teams.
• Test-ORCA179Safe Links is enabled intra-organization.
• Test-ORCA180Anti-phishing policy exists and EnableSpoofIntelligence is true.
• Test-ORCA189Safe Attachments is not bypassed.
• Test-ORCA189_2Safe Links is not bypassed.
• Test-ORCA205Common attachment type filter is enabled.
• Test-ORCA220Advanced Phish filter Threshold level is adequate.
• Test-ORCA221Mailbox intelligence is enabled in anti-phishing policies.
• Test-ORCA222Domain Impersonation action is set to move to Quarantine.
• Test-ORCA223User impersonation action is set to move to Quarantine.
• Test-ORCA224Similar Users Safety Tips is enabled.
• Test-ORCA225Safe Documents is enabled for Office clients.
• Test-ORCA226Each domain has a Safe Link policy applied to it.
• Test-ORCA227Each domain has a Safe Attachments policy applied to it.
• Test-ORCA228No trusted senders in Anti-phishing policy.
• Test-ORCA229No trusted domains in Anti-phishing policy.
• Test-ORCA230Each domain has a Anti-phishing policy applied to it, or the default policy is being used.
• Test-ORCA231Each domain has a anti-spam policy applied to it, or the default policy is being used.
• Test-ORCA232Each domain has a malware filter policy applied to it, or the default policy is being used.
• Test-ORCA233Domains are pointed directly at EOP or enhanced filtering is used.
• Test-ORCA233_1Domains are pointed directly at EOP or enhanced filtering is configured on all default connectors.
• Test-ORCA234Click through is disabled for Safe Documents.
• Test-ORCA235SPF records is set up for all your custom domains.
• Test-ORCA236Safe Links is enabled for emails.
• Test-ORCA237Safe Links is enabled for teams messages.
• Test-ORCA238Safe Links is enabled for office documents.
• Test-ORCA239No exclusions for the built-in protection policies.
• Test-ORCA240Outlook is configured to display external tags for external emails.
• Test-ORCA241Anti-phishing policy exists and EnableFirstContactSafetyTips is true.
• Test-ORCA242Important protection alerts responsible for AIR activities are enabled.
• Test-ORCA243Authenticated Receive Chain is set up for domains not pointing to EOP/MDO, or all domains point to EOP/MDO.
• Test-ORCA244Policies are configured to honor sending domains DMARC.
• Update-MaesterTestsUpdates the specified folder with the latest ready-made Maester tests built by the Maester team.
• Update-MtMaesterAppUpdates an existing Maester application with the latest required permissions.