Maester Tests
These tests are maintained by the Maester community and validate Microsoft 365, Microsoft Entra, Defender, Intune, and related security configurations.
Tests
| Test ID | Title | Severity | Category |
|---|---|---|---|
| AZDO.1000 | Azure DevOps OAuth apps can access resources in your organization through OAuth. | High | Azure DevOps |
| AZDO.1001 | Identities can connect to your organization's Git repos through SSH. | High | Azure DevOps |
| AZDO.1002 | Log Audit Events. | High | Azure DevOps |
| AZDO.1003 | Restrict public projects. | High | Azure DevOps |
| AZDO.1004 | Additional protections when using public package registries. | High | Azure DevOps |
| AZDO.1005 | IP Conditional Access policy validation. | High | Azure DevOps |
| AZDO.1006 | External Users access. | High | Azure DevOps |
| AZDO.1007 | Team and project administrator are allowed to invite new users. | High | Azure DevOps |
| AZDO.1008 | Request access to Azure DevOps by e-mail notifications to administrators. | Medium | Azure DevOps |
| AZDO.1009 | Feedback Collection. | Info | Azure DevOps |
| AZDO.1010 | Audit streaming. | High | Azure DevOps |
| AZDO.1011 | Project Resource Limits. | Info | Azure DevOps |
| AZDO.1012 | Work Items Tags Limits. | Info | Azure DevOps |
| AZDO.1013 | Organization Owner should not be an individual. | High | Azure DevOps |
| AZDO.1014 | Anonymous access to pipeline badges. | Medium | Azure DevOps |
| AZDO.1015 | Limit variables that can be set at queue time. | High | Azure DevOps |
| AZDO.1016 | Limit job authorization scope to current project for non-release pipelines. | High | Azure DevOps |
| AZDO.1017 | Limit job authorization scope to current project for classic release pipelines. | High | Azure DevOps |
| AZDO.1018 | Protect access to repositories in YAML pipelines. | High | Azure DevOps |
| AZDO.1019 | Stage chooser. | Medium | Azure DevOps |
| AZDO.1020 | Creation of classic build pipelines. | Medium | Azure DevOps |
| AZDO.1021 | Creation of classic release pipelines. | Medium | Azure DevOps |
| AZDO.1022 | Limit building pull requests from forked GitHub repositories. | High | Azure DevOps |
| AZDO.1023 | Disable Marketplace tasks. | High | Azure DevOps |
| AZDO.1024 | Disable Node 6 tasks. | Medium | Azure DevOps |
| AZDO.1025 | Enable shell tasks arguments validation. | High | Azure DevOps |
| AZDO.1026 | Enable automatic enrollment to Advanced Security for Azure DevOps. | Medium | Azure DevOps |
| AZDO.1027 | Disable showing Gravatar images for users outside of your enterprise. | Medium | Azure DevOps |
| AZDO.1028 | Disable creation of TFVC repositories. | Medium | Azure DevOps |
| AZDO.1029 | Storage Usage Limit. | Medium | Azure DevOps |
| AZDO.1030 | Project Collection Administrators. | Critical | Azure DevOps |
| AZDO.1031 | Validate SSH Key Expiration. | High | Azure DevOps |
| AZDO.1032 | (Tenant) Restrict creation of global Personal Access Tokens. | High | Azure DevOps |
| AZDO.1033 | (Tenant) Enable automatic revocation of leaked Personal Access Tokens. | Critical | Azure DevOps |
| AZDO.1034 | (Tenant) Restrict creation of new Azure DevOps organizations. | High | Azure DevOps |
| AZDO.1035 | (Tenant) Restrict Personal Access Token lifespan. | High | Azure DevOps |
| AZDO.1036 | (Tenant) Restrict Personal Access Token full scope. | High | Azure DevOps |
| AZDO.1037 | (Organization) Restrict Personal Access Token creation. | High | Azure DevOps |
| AZDO.1038 | (Organization) Disallow extensions from accessing resources on the local network. | Medium | Azure DevOps |
| AZDO.1039 | (Organization) Secret Protection: new repositories enrolled automatically. | Medium | Azure DevOps |
| AZDO.1040 | (Organization) Secret Protection: existing repositories enrolled. | High | Azure DevOps |
| AZDO.1041 | (Organization) Secret Protection: push protection blocks secret commits. | High | Azure DevOps |
| AZDO.1042 | (Organization) Code Security: new repositories enrolled automatically. | Medium | Azure DevOps |
| AZDO.1043 | (Organization) Code Security: existing repositories enrolled. | Medium | Azure DevOps |
| AZDO.1044 | (Organization) Code Security: dependency and CodeQL alerts enabled. | Medium | Azure DevOps |
| AZDO.1045 | (Organization) Copilot code review: allowed for repositories. | Info | Azure DevOps |
| MT.1001 | At least one Conditional Access policy is configured with device compliance. | Medium | Maester/Entra |
| MT.1002 | App management restrictions on applications and service principals is configured and enabled. | High | Maester/Entra |
| MT.1003 | At least one Conditional Access policy is configured with All Apps. | High | Maester/Entra |
| MT.1004 | At least one Conditional Access policy is configured with All Apps and All Users. | High | Maester/Entra |
| MT.1005 | All Conditional Access policies are configured to exclude at least one emergency/break glass account or group. | High | Maester/Entra |
| MT.1006 | At least one Conditional Access policy is configured to require MFA for admins. | High | Maester/Entra |
| MT.1007 | At least one Conditional Access policy is configured to require MFA for all users. | High | Maester/Entra |
| MT.1008 | At least one Conditional Access policy is configured to require MFA for Azure management. | High | Maester/Entra |
| MT.1009 | At least one Conditional Access policy is configured to block other legacy authentication. | High | Maester/Entra |
| MT.1010 | At least one Conditional Access policy is configured to block legacy authentication for Exchange ActiveSync. | High | Maester/Entra |
| MT.1011 | At least one Conditional Access policy is configured to secure security info registration only from a trusted location. | High | Maester/Entra |
| MT.1012 | At least one Conditional Access policy is configured to require MFA for risky sign-ins. | High | Maester/Entra |
| MT.1013 | At least one Conditional Access policy is configured to require new password when user risk is high. | High | Maester/Entra |
| MT.1014 | At least one Conditional Access policy is configured to require compliant or Entra hybrid joined devices for admins. | High | Maester/Entra |
| MT.1015 | At least one Conditional Access policy is configured to block access for unknown or unsupported device platforms. | Medium | Maester/Entra |
| MT.1016 | At least one Conditional Access policy is configured to require MFA for guest access. | High | Maester/Entra |
| MT.1017 | At least one Conditional Access policy is configured to enforce non persistent browser session for non-corporate devices. | High | Maester/Entra |
| MT.1018 | At least one Conditional Access policy is configured to enforce sign-in frequency for non-corporate devices. | Medium | Maester/Entra |
| MT.1019 | At least one Conditional Access policy is configured to enable application enforced restrictions. | Medium | Maester/Entra |
| MT.1020 | All Conditional Access policies are configured to exclude Directory/OnPremises synchronization accounts or do not scope them. | High | Maester/Entra |
| MT.1021 | Security Defaults are enabled. | High | Maester/Entra |
| MT.1022 | All users utilizing a P1 license should be licensed. | Medium | Maester/Entra |
| MT.1023 | All users utilizing a P2 license should be licensed. | Medium | Maester/Entra |
| MT.1024 | Entra recommendations should be completed. | Medium | Maester/Entra |
| MT.1025 | No external user with permanent role assignment on Control Plane. | High | Maester/Entra |
| MT.1026 | No hybrid user with permanent role assignment on Control Plane. | High | Maester/Entra |
| MT.1027 | No Service Principal with Client Secret and permanent role assignment on Control Plane. | High | Maester/Entra |
| MT.1028 | No user with mailbox and permanent role assignment on Control Plane. | High | Maester/Entra |
| MT.1029 | Stale accounts are not assigned to privileged roles. | High | Maester/Entra |
| MT.1030 | Eligible role assignments on Control Plane are in use by administrators. | High | Maester/Entra |
| MT.1031 | Privileged role on Control Plane are managed by PIM only. | High | Maester/Entra |
| MT.1032 | Limited number of Global Admins are assigned. | High | Maester/Entra |
| MT.1033 | Users should be blocked from using legacy authentication. | High | Maester/Entra |
| MT.1034 | Emergency access users should not be blocked. | High | Maester/Entra |
| MT.1035 | All security groups assigned to Conditional Access Policies should be protected by RMAU. | High | Maester/Entra |
| MT.1036 | All excluded objects should have a fallback include in another policy. | Medium | Maester/Entra |
| MT.1037 | Only users with Presenter role are allowed to present in Teams meetings | High | Maester/Teams |
| MT.1038 | Conditional Access policies should not include or exclude deleted groups. | Medium | Maester/Entra |
| MT.1039 | Ensure MailTips are enabled for end users | Low | Maester/Exchange |
| MT.1041 | Ensure users installing Outlook add-ins is not allowed | High | Maester/Exchange |
| MT.1042 | Restrict dial-in users from bypassing a meeting lobby | Medium | Maester/Teams |
| MT.1043 | Ensure Spam confidence level (SCL) is configured in mail transport rules with specific domains | Medium | Maester/Exchange |
| MT.1044 | Ensure modern authentication for Exchange Online is enabled | High | Maester/Exchange |
| MT.1045 | Only invited users should be automatically admitted to Teams meetings | Medium | Maester/Teams |
| MT.1046 | Restrict anonymous users from joining meetings | Medium | Maester/Teams |
| MT.1047 | Restrict anonymous users from starting Teams meetings | Medium | Maester/Teams |
| MT.1048 | Limit external participants from having control in a Teams meeting | Medium | Maester/Teams |
| MT.1049 | Conditional Access policies for User Risk and Sign-in Risk should be configured separately. | High | Maester/Entra |
| MT.1050 | Apps with high-risk permissions having a direct path to Global Administrator | High | Maester/Entra |
| MT.1051 | Apps with high-risk permissions having an indirect path to Global Administrator | High | Maester/Entra |
| MT.1052 | At least one Conditional Access policy is targeting the Device Code authentication flow. | High | Maester/Entra |
| MT.1053 | Ensure intune device clean-up rule is configured | Medium | Maester/Intune |
| MT.1054 | Ensure built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant' | Medium | Maester/Intune |
| MT.1055 | Microsoft 365 Group (and Team) creation should be restricted to approved users. | Medium | Maester/Entra |
| MT.1056 | Ensure that no person has permanent access to all Azure subscriptions at the root scope | High | AzureConfig |
| MT.1057 | App registrations should no longer use secrets. | Medium | Maester/Entra |
| MT.1058 | Exchange application access policies must be configured. | Medium | Maester/Entra |
| MT.1059 | Microsoft Defender for Identity health issues should be resolved | Medium | Defender for Identity health issues |
| MT.1060 | Drift folders should match their baseline. | Medium | Maester/Drift |
| MT.1061 | Device registration MFA control conflicts with Conditional Access policies. | Medium | Maester/Entra |
| MT.1062 | Ensure Direct Send is set to be rejected | Medium | Maester/Exchange |
| MT.1063 | All App registration owners should have MFA registered | High | Maester/Entra |
| MT.1064 | Ensure that write permissions are required to create new management groups | High | AzureConfig |
| MT.1065 | Ensure all Recovery Services Vaults have soft delete enabled | High | AzureConfig |
| MT.1066 | Conditional Access policies should not reference non-existent users, groups, or roles. | Medium | Maester/Entra |
| MT.1067 | Authentication method policies should not reference non-existent groups. | Medium | Maester/Entra |
| MT.1068 | Restrict non-admin users from creating tenants. | Medium | Maester/Entra |
| MT.1069 | Restrict non-admin users from creating security groups. | Low | Maester/Entra |
| MT.1070 | Restrict device join to selected users/groups or none. | Medium | Maester/Entra |
| MT.1071 | At least one Conditional Access policy explicitly includes Azure DevOps. | Medium | Maester/Entra |
| MT.1072 | Conditional Access policies should not use the deprecated Approved Client App grant. | High | Maester/Entra |
| MT.1073 | Soft- and hard-matching of synchronized objects should be blocked. | Medium | Maester/Entra |
| MT.1074 | Ensure no more than 100 outbound mails per day are sent using the .onmicrosoft.com domain | Medium | Maester/Exchange |
| MT.1075 | Require explicit assignment of Third Party Entra Apps. | Medium | Maester/Entra |
| MT.1076 | MOERA SHOULD NOT be used for sent mail | High | Maester/Exchange |
| MT.1077 | App registrations with privileged API permissions should not have owners. | Medium | Exposure Management |
| MT.1078 | App registrations with highly privileged directory roles should not have owners. | Medium | Exposure Management |
| MT.1079 | Privileged API permissions on service principals should not remain unused. | Medium | Exposure Management |
| MT.1080 | Credentials, tokens, or cookies from highly privileged users should not be exposed on vulnerable endpoints. | Medium | Exposure Management |
| MT.1081 | Hybrid users should not be assigned Entra ID role assignments. | Medium | Exposure Management |
| MT.1083 | Ensure Delicensing Resiliency is enabled | Low | Maester/Exchange |
| MT.1084 | Microsoft Entra seamless single sign-on should be disabled for all domains in EntraID Connect servers. | High | Maester/Entra |
| MT.1085 | Pending approvals for Critical Asset Management should not be present. | Medium | Exposure Management |
| MT.1086 | Devices should not share both critical and non-critical user credentials. | Low | Exposure Management |
| MT.1087 | Devices should not be publicly exposed with remotely exploitable, highly likely to be exploited, high or critical severity CVE's. | High | Exposure Management |
| MT.1088 | Devices with critical credentials should be protected by TPM. | Medium | Exposure Management |
| MT.1089 | Devices with critical credentials should be protected by Credential Guard. | Medium | Exposure Management |
| MT.1090 | Global Administrator role should not be added as local administrator on the device during Microsoft Entra join | Medium | Maester/Entra |
| MT.1091 | Registering user should not be added as local administrator on the device during Microsoft Entra join | Medium | Maester/Entra |
| MT.1092 | Intune APNS certificate should be valid for more than 30 days | High | Maester/Intune |
| MT.1093 | Apple Automated Device Enrollment Tokens should be valid for more than 30 days | High | Maester/Intune |
| MT.1094 | Apple Volume Purchase Program Tokens should be valid for more than 30 days | High | Maester/Intune |
| MT.1095 | Android Enterprise account connection should be healthy | High | Maester/Intune |
| MT.1096 | Ensure at least one Intune Multi Admin Approval policy is configured | Medium | Maester/Intune |
| MT.1097 | Ensure all Intune Certificate Connectors are healthy and running supported versions | High | Maester/Intune |
| MT.1098 | Mobile Threat Defense Connectors should be healthy | Critical | Maester/Intune |
| MT.1099 | Windows Diagnostic Data Processing should be enabled | Low | Maester/Intune |
| MT.1100 | Intune Diagnostic Settings should include Audit Logs | High | Maester/Intune |
| MT.1101 | Default Branding Profile should be customized | Low | Maester/Intune |
| MT.1102 | Windows Feature Update Policy Settings should not reference end of support builds | High | Maester/Intune |
| MT.1103 | Ensure Intune RBAC groups are protected by Restricted Management Administrative Units or Role Assignable groups | High | Maester/Intune |
| MT.1105 | Ensure MDM Authority is set to Intune | Low | Maester/Intune |
| MT.1106 | Catalog resources must have valid roles (no stale / removed app roles or SPNs). | Medium | Maester/Entra |
| MT.1107 | Access packages and catalogs should not reference deleted groups. | Medium | Maester/Entra |
| MT.1108 | Access packages should not reference inactive or orphaned assignment policies. | Medium | Maester/Entra |
| MT.1109 | Access package approval workflows must have valid approvers. | Medium | Maester/Entra |
| MT.1110 | No catalog should contain resources without any associated access packages. | Medium | Maester/Entra |
| MT.1111 | High privileged user should be linked to an identity. | Low | Exposure Management |
| MT.1112 | Privileged user accounts should not remain enabled when the linked primary account is disabled. | Medium | Exposure Management |
| MT.1113 | AI agents should not be shared with broad access control policies. | High | Copilot Studio Agent Security |
| MT.1114 | AI agents should require user authentication. | High | Copilot Studio Agent Security |
| MT.1115 | AI agents should not have risky HTTP configurations. | Medium | Copilot Studio Agent Security |
| MT.1116 | AI agents should not send email with AI-controlled inputs. | High | Copilot Studio Agent Security |
| MT.1117 | Published AI agents should not be dormant. | Low | Copilot Studio Agent Security |
| MT.1118 | AI agents should not use author (maker) authentication for connections. | Medium | Copilot Studio Agent Security |
| MT.1119 | AI agents should not have hard-coded credentials in topics. | High | Copilot Studio Agent Security |
| MT.1120 | AI agents should not use MCP server tools without review. | Medium | Copilot Studio Agent Security |
| MT.1121 | AI agents with generative orchestration should have custom instructions. | Medium | Copilot Studio Agent Security |
| MT.1122 | AI agents should not have orphaned ownership. | Medium | Copilot Studio Agent Security |
| MT.1123 | Ensure BitLocker full disk encryption is configured | High | Maester/Intune |
| MT.1147 | Do not sync krbtgt_AzureAD to Entra ID. | High | Maester/Entra |
| MT.1148 | Archive Scanning should be enabled. | High | Maester/Defender |
| MT.1149 | Behavior Monitoring should be enabled. | High | Maester/Defender |
| MT.1150 | Cloud Protection should be enabled. | High | Maester/Defender |
| MT.1151 | Email Scanning should be enabled. | High | Maester/Defender |
| MT.1152 | Script Scanning should be enabled. | High | Maester/Defender |
| MT.1153 | Real-time Monitoring should be enabled. | High | Maester/Defender |
| MT.1154 | Full Scan Removable Drives should be enabled. | High | Maester/Defender |
| MT.1155 | Full Scan Mapped Drives should be disabled for performance. | High | Maester/Defender |
| MT.1156 | Scanning Network Files should be enabled. | High | Maester/Defender |
| MT.1157 | CPU Load Factor should be optimized (20-30%). | High | Maester/Defender |
| MT.1158 | Scan should be scheduled. | High | Maester/Defender |
| MT.1159 | Quick Scan Time configuration is not required. | High | Maester/Defender |
| MT.1160 | Signatures should be checked before scan. | High | Maester/Defender |
| MT.1161 | Cloud Block Level should be High or higher. | High | Maester/Defender |
| MT.1162 | Cloud Extended Timeout should be 30-50 seconds. | High | Maester/Defender |
| MT.1163 | Signature Update Interval should be 1-4 hours. | High | Maester/Defender |
| MT.1164 | PUA Protection should be enabled. | High | Maester/Defender |
| MT.1165 | Network Protection should be enabled. | High | Maester/Defender |
| MT.1166 | Local Admin Merge should be disabled. | High | Maester/Defender |
| MT.1167 | Real-Time Scan Direction should cover both directions. | High | Maester/Defender |
| MT.1168 | Cleaned Malware should be retained for at least 30 days. | High | Maester/Defender |
| MT.1169 | Catch-up Full Scan should be disabled. | High | Maester/Defender |
| MT.1170 | Catch-up Quick Scan should be disabled. | High | Maester/Defender |
| MT.1171 | Sample Submission should send safe samples automatically. | High | Maester/Defender |
| MT.1172 | Unified audit log ingestion is enabled. | High | Maester/Purview |
| MT.1173 | Sensitivity labels are published for files used by Microsoft 365 Copilot. | Medium | Maester/Purview |
| MT.1174 | Insider Risk Management policy for Risky AI usage is enabled. | Medium | Maester/Purview |
| MT.1175 | DLP policy is configured for the Microsoft 365 Copilot location. | High | Maester/Purview |
| MT.1176 | Retention policy is configured for the Microsoft Copilot location. | Medium | Maester/Purview |
| MT.1177 | Ensure LAPS Configuration Policy is properly set. | Medium | Maester/Intune |
| MT.1178 | Ensure ASR Rules are configured correctly. | High | Maester/Intune |
| MT.1179 | Ensure App Control for Business is enabled. | High | Maester/Intune |
| MT.1180 | Ensure Managed Installer Rules are configured correctly. | Medium | Maester/Intune |
| MT.1181 | Conditional Access policy is present that blocks high agent risk sign-ins. | High | Maester/Entra |
| MT.1182 | Mature DMARC policy SHALL be published for every Entra managed and verified domain. | Medium | Maester/Entra |
| MT.1183 | Temporary bypass for onPremisesObjectIdentifier updates should be disabled. | Medium | Maester/Entra |
| MT.1184 | Conditional Access policy without any target resources configured. | Medium | Maester/Entra |
| MT.1185 | Block legacy MSOnline (MSOL) PowerShell module. | High | Maester/Entra |
| MT.1186 | Require explicit assignment of high-privilege first-party Entra Apps. | High | Maester/Entra |
| MT.1187 | The Microsoft 365 traffic forwarding profile in Global Secure Access should be enabled. | Medium | Maester/Entra |
| MT.1188 | Entra Private Access applications should be covered by a Conditional Access policy that requires a managed device. | Medium | Maester/Entra |
| MT.1189 | Groups assigned to Global Secure Access traffic forwarding profiles should not be nested. | Medium | Maester/Entra |
| MT.1190 | Entra Private Access applications should not use the Default connector group. | Medium | Maester/Entra |
| MT.1191 | Break-glass accounts should be excluded from the Compliant Network Conditional Access policy. | Medium | Maester/Entra |
| MT.1192 | Groups assigned to Entra Private Access applications should not be nested. | Medium | Maester/Entra |
| MT.1193 | Entra Private Access application segments should avoid broad or risky destinations. | Medium | Maester/Entra |
| MT.1194 | The baseline Global Secure Access security profile should enforce a threat-intelligence floor. | Medium | Maester/Entra |
| MT.1195 | The Quick Access app should not be subject to a sign-in frequency Conditional Access control. | Medium | Maester/Entra |
| MT.1196 | Review who can change attributes used by dynamic group rules. | Medium | Maester/Entra |
| MT.1197 | Remove memberOf rules. | High | Maester/Entra |
| MT.1198 | App registration certificates should not have excessive validity periods. | Medium | Maester/Entra |
| MT.1199 | App registration credentials should not be expired or expiring soon. | Medium | Maester/Entra |
| MT.1200 | Agent Identities should have an active Agent Identity Blueprint Principal (Preview). | Medium | Maester/Entra |
| MT.1201 | Agent Users should have an existing parent Agent Identity (Preview). | Medium | Maester/Entra |
| MT.1203 | Agent Identity Blueprint Principals should have an existing Blueprint (Preview). | Medium | Maester/Entra |
| MT.1204 | Agent Identities, Blueprint Principals, and Blueprints should have active, enabled owners (Preview). | Medium | Maester/Entra |
| MT.1205 | Agent Identity Blueprints and Blueprint Principals should have assigned sponsors (Preview). | Medium | Maester/Entra |
| MT.1206 | Enabled Agent Identities should have active sign-in activity within the last 180 days (Preview). | Medium | Maester/Entra |
| MT.1207 | Foreign or multi-tenant Agent Blueprint Principals and Agent Identities should not hold privileged directory roles (Preview). | High | Maester/Entra |
| MT.1208 | Agent Identity Blueprints should not have expired, excessive, or long-lived client credentials (Preview). | High | Maester/Entra |
| MT.1209 | Agent Identities and Blueprint Principals should not be assigned privileged Entra directory roles (Preview). | High | Maester/Entra |
| MT.1210 | Agent Users should not have privileged directory roles or membership in role-assignable groups (Preview). | High | Maester/Entra |
| MT.1211 | Agent Identity Blueprints should not use the allAllowed inheritance pattern for delegated scopes or application roles (Preview). | High | Maester/Entra |
| MT.1212 | Agent Identity Blueprint Principals should require assignment for the application roles they expose (Preview). | Medium | Maester/Entra |
| MT.1213 | Agent Identity Blueprints should not use wildcard or plain-http redirect URIs (Preview). | High | Maester/Entra |
| MT.1214 | Ensure macOS compliance policy requires System Integrity Protection. | Medium | Maester/Intune |
| MT.1215 | Ensure Gatekeeper restricts macOS app download locations. | Medium | Maester/Intune |
| MT.1216 | Ensure macOS compliance policy requires a Defender machine risk score level. | Medium | Maester/Intune |
| MT.1217 | Ensure macOS LAPS is configured on Automated Device Enrollment profiles. | High | Maester/Intune |
| MT.1223 | Agent Identities should not have high-risk Microsoft Graph permissions (Preview). | High | Maester/Entra |