CIS M365v6.0.1 SPO tests Chapter 7 by Mynster9361 · Pull Request #1755 · maester365/maester

Mynster9361 · 2026-05-08T21:12:54Z

📑 Description

(Currently Draft PR so we can see progress)
This PR is a followup/takeover off #1433
In agreement with @HenrikPiecha

Adds the following CIS tests/controls:
7.2.2
7.2.5
7.2.7
7.2.9
7.2.11
7.3.1

✅ Checks

My pull request adheres to the code style of this project.
My code requires changes to the documentation.
I have updated the documentation as required.
The build and unit tests pass after running /powershell/tests/pester.ps1 locally.

ℹ️ Additional Information

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…dItem.ps1 Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…dItem.ps1 Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…usFile.ps1 Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…dItem.ps1 Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

- Removed references to MT cmdlets along with the MT docs for these cmdlets as these are CIS tests and follows the CIS implementation. - Moved md and ps1 files to the correct folder - Deleted the single test file and split out to multiple for CIS - Updated .md files to allign with the others - Updated function names to Test-MtCis prefix For now i removed the connection part for sharepoint for Connect-Maester and removed the section in Installation as we are switching from 'Microsoft.Online.SharePoint.PowerShell' to 'PnP PowerShell' for cross platform compatibility Co-authored-by: Henrik <HenrikPiecha>

codacy-production · 2026-05-08T21:16:14Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

Copilot

Pull request overview

Adds CIS Microsoft 365 Foundations Benchmark v6.0.1 Chapter 7 SharePoint Online (SPO) controls to the Maester PowerShell module and its CIS Pester suite, providing new checks for tenant-level external sharing and security settings.

Changes:

Added six new CIS SPO test implementations (PowerShell) and matching Pester tests for controls 7.2.2, 7.2.5, 7.2.7, 7.2.9, 7.2.11, 7.3.1.
Added accompanying CIS guidance markdown pages for each new SPO control.
Extended Connect-Maester and the module manifest exports to include the new SPO checks.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
tests/cis/Test-MtCisSpoPreventDownloadMaliciousFile.Tests.ps1	Adds Pester coverage for CIS 7.3.1 SPO infected-file download setting.
tests/cis/Test-MtCisSpoGuestCannotShareUnownedItem.Tests.ps1	Adds Pester coverage for CIS 7.2.5 guest resharing restriction.
tests/cis/Test-MtCisSpoGuestAccessExpiry.Tests.ps1	Adds Pester coverage for CIS 7.2.9 guest access expiry.
tests/cis/Test-MtCisSpoDefaultSharingLinkPermission.Tests.ps1	Adds Pester coverage for CIS 7.2.11 default link permission.
tests/cis/Test-MtCisSpoDefaultSharingLink.Tests.ps1	Adds Pester coverage for CIS 7.2.7 default sharing link type.
tests/cis/Test-MtCisSpoB2BIntegration.Tests.ps1	Adds Pester coverage for CIS 7.2.2 Entra B2B integration.
powershell/public/Connect-Maester.ps1	Adds `SharePointOnline` as a selectable service (but connection implementation is incomplete).
powershell/public/cis/Test-MtCisSpoPreventDownloadMaliciousFile.ps1	Implements CIS 7.3.1 check using `Get-SPOTenant`.
powershell/public/cis/Test-MtCisSpoPreventDownloadMaliciousFile.md	Adds guidance content for CIS 7.3.1 (missing results placeholder; contains a dash typo).
powershell/public/cis/Test-MtCisSpoGuestCannotShareUnownedItem.ps1	Implements CIS 7.2.5 check using `Get-SPOTenant`.
powershell/public/cis/Test-MtCisSpoGuestCannotShareUnownedItem.md	Adds guidance content for CIS 7.2.5 (missing results placeholder).
powershell/public/cis/Test-MtCisSpoGuestAccessExpiry.ps1	Implements CIS 7.2.9 check using `Get-SPOTenant`.
powershell/public/cis/Test-MtCisSpoGuestAccessExpiry.md	Adds guidance content for CIS 7.2.9 (missing results placeholder).
powershell/public/cis/Test-MtCisSpoDefaultSharingLinkPermission.ps1	Implements CIS 7.2.11 check using `Get-SPOTenant`.
powershell/public/cis/Test-MtCisSpoDefaultSharingLinkPermission.md	Adds guidance content for CIS 7.2.11 (missing results placeholder).
powershell/public/cis/Test-MtCisSpoDefaultSharingLink.ps1	Implements CIS 7.2.7 check using `Get-SPOTenant`.
powershell/public/cis/Test-MtCisSpoDefaultSharingLink.md	Adds guidance content for CIS 7.2.7 (missing results placeholder).
powershell/public/cis/Test-MtCisSpoB2BIntegration.ps1	Implements CIS 7.2.2 check using `Get-SPOTenant`.
powershell/public/cis/Test-MtCisSpoB2BIntegration.md	Adds guidance content for CIS 7.2.2 (missing results placeholder).
powershell/Maester.psd1	Exports the six new SPO CIS functions.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…om/Mynster9361/maester into CIS-M365v6.0.1-SPO-tests-Chapter-7

Mynster9361 · 2026-05-10T18:40:23Z

@SamErde @HenrikPiecha
I believe this one is ready for review.

Note for you @SamErde
I think for the action:
[Build Website / Build Docusaurus website 🏗️ (pull_request)]

That it should run either build-docs.yaml or update-module-docs.yaml first otherwise it will always fail when new cis commands are added as the docs pages are never built unless like in my case here i run the Update-CommandReference.ps1 manually and add the changed files i have modified. Not sure if there already is an issue on this?
reference:
https://github.com/maester365/maester/actions/runs/25636108975/job/75248154790?pr=1755

 Exhaustive list of all broken links found:
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.2.11:
     -> linking to /docs/commands/Test-MtCisSpoDefaultSharingLinkPermission
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.2.2:
     -> linking to /docs/commands/Test-MtCisSpoB2BIntegration
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.2.5:
     -> linking to /docs/commands/Test-MtCisSpoGuestCannotShareUnownedItem
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.2.7:
     -> linking to /docs/commands/Test-MtCisSpoDefaultSharingLink
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.2.9:
     -> linking to /docs/commands/Test-MtCisSpoGuestAccessExpiry
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.3.1:
     -> linking to /docs/commands/Test-MtCisSpoPreventDownloadMaliciousFile

SamErde · 2026-05-11T08:23:48Z

@SamErde @HenrikPiecha I believe this one is ready for review.

Note for you @SamErde I think for the action: [Build Website / Build Docusaurus website 🏗️ (pull_request)]

That it should run either build-docs.yaml or update-module-docs.yaml first otherwise it will always fail when new cis commands are added as the docs pages are never built unless like in my case here i run the Update-CommandReference.ps1 manually and add the changed files i have modified. Not sure if there already is an issue on this? reference: https://github.com/maester365/maester/actions/runs/25636108975/job/75248154790?pr=1755
 Exhaustive list of all broken links found:
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.2.11:
     -> linking to /docs/commands/Test-MtCisSpoDefaultSharingLinkPermission
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.2.2:
     -> linking to /docs/commands/Test-MtCisSpoB2BIntegration
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.2.5:
     -> linking to /docs/commands/Test-MtCisSpoGuestCannotShareUnownedItem
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.2.7:
     -> linking to /docs/commands/Test-MtCisSpoDefaultSharingLink
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.2.9:
     -> linking to /docs/commands/Test-MtCisSpoGuestAccessExpiry
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.3.1:
     -> linking to /docs/commands/Test-MtCisSpoPreventDownloadMaliciousFile

Great insight, @Mynster9361! Thanks for all of this work!

Copilot

Pull request overview

Copilot reviewed 40 out of 40 changed files in this pull request and generated 5 comments.

@DataAndGoliath

I decided to revert my changes in regards to connection to sharepoint online and adopt the ones from maester365#1662 added @DataAndGoliath as a co-author on this adoption Only actual change between the 2 is the location for Get-MtSpo.ps1 i have chosen to place this in the powershell\public folder as it now will relate to both CIS and CISA tests. > Co-authored-by: Simon Albers <DataAndGoliath>

…om/Mynster9361/maester into CIS-M365v6.0.1-SPO-tests-Chapter-7

Mynster9361 · 2026-05-11T19:23:58Z

Did not see there already was a PR related to Sharepoint Online.
I decided to revert my changes in regards to connection to SharePoint online and adopt the ones from #1662 added @DataAndGoliath as a co-author on this adoption (Awesome work Simon!)

Only actual change between the 2 is the location for Get-MtSpo.ps1 i have chosen to place this in the powershell\public folder as it now will relate to both CIS and CISA tests.

Copilot

Pull request overview

Copilot reviewed 46 out of 46 changed files in this pull request and generated 7 comments.

+Connect to SharePoint Online together with Microsoft Graph (the admin URL is auto-discovered from your tenant's initial domain):
+
+```powershell
+Connect-Maester -Service Graph,SharePointOnline
+```
+
+If auto-discovery does not work (e.g. in government or custom-domain tenants), supply the admin URL explicitly:
+
+```powershell
+Connect-Maester -Service Graph,SharePointOnline -SharePointAdminUrl 'https://contoso-admin.sharepoint.com'
+```
+


+### (Optional) Grant permissions to SharePoint Online
+
+SharePoint Online tests require the **PnP.PowerShell** module and a dedicated PnP Entra ID app registration. The standard Maester app registration does not cover SharePoint tenant admin operations — PnP requires its own app with `Sites.FullControl.All` permissions.
+


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 46 out of 46 changed files in this pull request and generated 7 comments.

Comments suppressed due to low confidence (1)

website/docs/connect-maester/readme.md:100

The docs reference -SharePointAdminUrl, but Connect-Maester doesn’t currently define/support that parameter. Either document the actual supported way to override the admin URL (if any), or implement -SharePointAdminUrl in Connect-Maester and update docs consistently.

+        #region SharePoint
+        if ($Service -contains 'SharePoint' -or $Service -contains 'All') {
+            $IsConnected = $false
+            try {
+                $MtConnections.SharePoint = Get-PnPConnection
+                $IsConnected = $null -ne ($MtConnections.SharePoint)
+            } catch {
+                Write-Debug "SharePoint: $false"
+            }
+            Write-Verbose "SharePoint: $IsConnected"
+            if (!$IsConnected) { $ConnectionState = $false }
+        }
+        #endregion SharePoint


+.EXAMPLE
+   Connect-Maester -Service Graph,SharePointOnline
+
+   Connects to Microsoft Graph and SharePoint Online. The SharePoint admin URL is auto-discovered from the tenant's initial domain via the Graph API. Optionally, specify -SharePointAdminUrl to override the auto-discovered URL (e.g. for custom domain or government cloud tenants).


+      'PnP.PowerShell' {
+         # SharePoint Online via PnP — must run AFTER Graph to avoid Microsoft.Graph.Core DLL conflict
+         if ($Service -contains 'SharePointOnline' -or $Service -contains 'All') {
+            Write-Verbose 'Connecting to SharePoint Online via PnP'
+
+            if (-not $SharePointClientId) {
+               Write-Host "`nSharePointOnline requires the -SharePointClientId parameter. Create a PnP app registration using Register-PnPEntraIDAppForInteractiveLogin.`nFor more information see https://maester.dev/docs/sections/create-entra-app" -ForegroundColor Red
+            } else {
+               try {
+                  # Resolve the SharePoint admin URL from the tenant's initial domain
+                  $domains = Invoke-MtGraphRequest -RelativeUri "domains" -ApiVersion "v1.0"
+                  $initialDomain = ($domains | Where-Object { $_.isInitial -eq $true }).id
+                  $tenantPrefix = ($initialDomain -split '\.')[0]
+                  $spoAdminUrl = "https://$tenantPrefix-admin.sharepoint.com"
+                  Write-Verbose "Resolved SharePoint admin URL: $spoAdminUrl"


+Connect to SharePoint Online together with Microsoft Graph (the admin URL is auto-discovered from your tenant's initial domain):
+
+```powershell
+Connect-Maester -Service Graph,SharePointOnline
+```


 Connect-Maester [-SendMail] [-SendTeamsMessage] [-Privileged] [-UseDeviceCode] [[-Environment] <String>]
 [[-AzureEnvironment] <String>] [[-ExchangeEnvironmentName] <String>] [[-TeamsEnvironmentName] <String>]
- [[-Service] <String[]>] [[-TenantId] <String>] [[-GraphClientId] <String>]
+ [[-Service] <String[]>] [[-TenantId] <String>] [[-GraphClientId] <String>] [[-SharePointAdminUrl] <String>]


+### -SharePointAdminUrl
+
+The SharePoint admin center URL to connect to when using the SharePointOnline service (e.g.
+https://contoso-admin.sharepoint.com).
+If not specified, the URL is auto-discovered from the tenant's initial domain via the Microsoft Graph API.
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 8
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

HenrikPiecha · 2026-05-20T09:50:03Z

Thank you @Mynster9361 and @SamErde to get the SPO tests with PnP up and running!

Henrik Piecha and others added 22 commits February 9, 2026 12:24

Added CIS M365v5 SPO tests

2fd993d

Update powershell/public/maester/spo/Test-MtSpoDefaultSharingLink.ps1

76e88b3

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update powershell/public/maester/spo/Test-MtSpoB2BIntegration.md

ac83443

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update website/docs/tests/maester/MT.1113.md

f7dd070

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update website/docs/tests/maester/MT.1118.md

7869165

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

changed invoke logic for spo tests

5c88be6

Updated CISM365v57-SPO

a6b37de

Merge branch 'main' into CISM365v57-SPO

6554161

removed test that has been flagged as obsolet by cis

ff61284

Merge branch

947e9bd

Update powershell/public/maester/spo/Test-MtSpoGuestAccessExpiry.ps1

f3dcbed

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update powershell/public/maester/spo/Test-MtSpoGuestCannotShareUnowne…

772b7c0

…dItem.ps1 Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update powershell/public/maester/spo/Test-MtSpoB2BIntegration.md

6850f8e

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update powershell/public/maester/spo/Test-MtSpoGuestCannotShareUnowne…

36ac2fa

…dItem.ps1 Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update powershell/public/maester/spo/Test-MtSpoPreventDownloadMalicio…

c3ac6d7

…usFile.ps1 Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update website/docs/tests/maester/MT.1113.md

7b6f32e

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update powershell/public/Connect-Maester.ps1

389f31a

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update powershell/public/maester/spo/Test-MtSpoGuestCannotShareUnowne…

6b2f02b

…dItem.ps1 Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update powershell/Maester.psd1

9ebb6be

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update powershell/public/Connect-Maester.ps1

328e18c

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update powershell/public/Connect-Maester.ps1

bbfc7e7

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Merge branch 'main' into CIS-M365v6.0.1-SPO-tests-Chapter-7

155a59d

SamErde requested a review from Copilot May 9, 2026 00:34

Copilot started reviewing on behalf of SamErde May 9, 2026 00:34 View session

Copilot AI reviewed May 9, 2026

View reviewed changes

Mynster9361 added 3 commits May 10, 2026 13:04

intial fixes to markdown files

e8f8ff6

Merge branch 'CIS-M365v6.0.1-SPO-tests-Chapter-7' of https://github.c…

8211d95

…om/Mynster9361/maester into CIS-M365v6.0.1-SPO-tests-Chapter-7

update command based help

7e33999

Mynster9361 marked this pull request as ready for review May 10, 2026 18:35

Mynster9361 requested review from a team as code owners May 10, 2026 18:35

Merge branch 'main' into CIS-M365v6.0.1-SPO-tests-Chapter-7

c24c1a7

SamErde requested a review from Copilot May 11, 2026 08:24

Copilot started reviewing on behalf of SamErde May 11, 2026 08:24 View session

Copilot AI reviewed May 11, 2026

View reviewed changes

SamErde requested changes May 11, 2026

View reviewed changes

Comment thread powershell/public/Connect-Maester.ps1 Outdated

Comment thread powershell/Maester.psd1 Outdated

Comment thread tests/cis/Test-MtCisSpoDefaultSharingLinkPermission.Tests.ps1

Comment thread website/docs/installation.md

This was referenced May 11, 2026

feat: add PnP.PowerShell support with all 8 CISA tests #1662

Draft

Generate command docs before website build #1764

Merged

Mynster9361 and others added 4 commits May 11, 2026 19:51

minor additions and fixes after feedback

ec00f86

Merge branch 'main' into CIS-M365v6.0.1-SPO-tests-Chapter-7

a839c3b

Merge branch 'CIS-M365v6.0.1-SPO-tests-Chapter-7' of https://github.c…

2f436ee

…om/Mynster9361/maester into CIS-M365v6.0.1-SPO-tests-Chapter-7

Merge branch 'main' into CIS-M365v6.0.1-SPO-tests-Chapter-7

85fd443

Mynster9361 mentioned this pull request May 12, 2026

Added CIS M365v5 SPO tests #1433

Closed

SamErde requested a review from Copilot May 18, 2026 15:33

Copilot started reviewing on behalf of SamErde May 18, 2026 15:34 View session

Copilot AI reviewed May 18, 2026

View reviewed changes

SamErde and others added 2 commits May 18, 2026 16:13

Potential fix for pull request finding

8189cb1

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Merge branch 'main' into CIS-M365v6.0.1-SPO-tests-Chapter-7

7b102e2

SamErde requested a review from Copilot May 18, 2026 20:14

Copilot started reviewing on behalf of SamErde May 18, 2026 20:15 View session

Copilot AI reviewed May 18, 2026

View reviewed changes

Mynster9361 and others added 2 commits May 19, 2026 09:17

Merge branch 'main' into CIS-M365v6.0.1-SPO-tests-Chapter-7

9e4f9dd

Potential fix for pull request finding

a2312fc

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

		### (Optional) Grant permissions to SharePoint Online

		SharePoint Online tests require the PnP.PowerShell module and a dedicated PnP Entra ID app registration. The standard Maester app registration does not cover SharePoint tenant admin operations — PnP requires its own app with `Sites.FullControl.All` permissions.

Conversation

Mynster9361 commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📑 Description

✅ Checks

ℹ️ Additional Information

Uh oh!

codacy-production Bot commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mynster9361 commented May 10, 2026

Uh oh!

SamErde commented May 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mynster9361 commented May 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

HenrikPiecha commented May 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Mynster9361 commented May 8, 2026 •

edited

Loading

codacy-production Bot commented May 8, 2026 •

edited

Loading