CIS M365v6.0.1 SPO tests Chapter 7 by Mynster9361 · Pull Request #1755 · maester365/maester

Mynster9361 · 2026-05-08T21:12:54Z

📑 Description

(Currently Draft PR so we can see progress)
This PR is a followup/takeover off #1433
In agreement with @HenrikPiecha

Adds the following CIS tests/controls:
7.2.2
7.2.5
7.2.7
7.2.9
7.2.11
7.3.1

✅ Checks

My pull request adheres to the code style of this project.
My code requires changes to the documentation.
I have updated the documentation as required.
The build and unit tests pass after running /powershell/tests/pester.ps1 locally.

ℹ️ Additional Information

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…dItem.ps1 Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…dItem.ps1 Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…usFile.ps1 Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…dItem.ps1 Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

- Removed references to MT cmdlets along with the MT docs for these cmdlets as these are CIS tests and follows the CIS implementation. - Moved md and ps1 files to the correct folder - Deleted the single test file and split out to multiple for CIS - Updated .md files to allign with the others - Updated function names to Test-MtCis prefix For now i removed the connection part for sharepoint for Connect-Maester and removed the section in Installation as we are switching from 'Microsoft.Online.SharePoint.PowerShell' to 'PnP PowerShell' for cross platform compatibility Co-authored-by: Henrik <HenrikPiecha>

codacy-production · 2026-05-08T21:16:14Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

Copilot

Pull request overview

Adds CIS Microsoft 365 Foundations Benchmark v6.0.1 Chapter 7 SharePoint Online (SPO) controls to the Maester PowerShell module and its CIS Pester suite, providing new checks for tenant-level external sharing and security settings.

Changes:

Added six new CIS SPO test implementations (PowerShell) and matching Pester tests for controls 7.2.2, 7.2.5, 7.2.7, 7.2.9, 7.2.11, 7.3.1.
Added accompanying CIS guidance markdown pages for each new SPO control.
Extended Connect-Maester and the module manifest exports to include the new SPO checks.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
tests/cis/Test-MtCisSpoPreventDownloadMaliciousFile.Tests.ps1	Adds Pester coverage for CIS 7.3.1 SPO infected-file download setting.
tests/cis/Test-MtCisSpoGuestCannotShareUnownedItem.Tests.ps1	Adds Pester coverage for CIS 7.2.5 guest resharing restriction.
tests/cis/Test-MtCisSpoGuestAccessExpiry.Tests.ps1	Adds Pester coverage for CIS 7.2.9 guest access expiry.
tests/cis/Test-MtCisSpoDefaultSharingLinkPermission.Tests.ps1	Adds Pester coverage for CIS 7.2.11 default link permission.
tests/cis/Test-MtCisSpoDefaultSharingLink.Tests.ps1	Adds Pester coverage for CIS 7.2.7 default sharing link type.
tests/cis/Test-MtCisSpoB2BIntegration.Tests.ps1	Adds Pester coverage for CIS 7.2.2 Entra B2B integration.
powershell/public/Connect-Maester.ps1	Adds `SharePointOnline` as a selectable service (but connection implementation is incomplete).
powershell/public/cis/Test-MtCisSpoPreventDownloadMaliciousFile.ps1	Implements CIS 7.3.1 check using `Get-SPOTenant`.
powershell/public/cis/Test-MtCisSpoPreventDownloadMaliciousFile.md	Adds guidance content for CIS 7.3.1 (missing results placeholder; contains a dash typo).
powershell/public/cis/Test-MtCisSpoGuestCannotShareUnownedItem.ps1	Implements CIS 7.2.5 check using `Get-SPOTenant`.
powershell/public/cis/Test-MtCisSpoGuestCannotShareUnownedItem.md	Adds guidance content for CIS 7.2.5 (missing results placeholder).
powershell/public/cis/Test-MtCisSpoGuestAccessExpiry.ps1	Implements CIS 7.2.9 check using `Get-SPOTenant`.
powershell/public/cis/Test-MtCisSpoGuestAccessExpiry.md	Adds guidance content for CIS 7.2.9 (missing results placeholder).
powershell/public/cis/Test-MtCisSpoDefaultSharingLinkPermission.ps1	Implements CIS 7.2.11 check using `Get-SPOTenant`.
powershell/public/cis/Test-MtCisSpoDefaultSharingLinkPermission.md	Adds guidance content for CIS 7.2.11 (missing results placeholder).
powershell/public/cis/Test-MtCisSpoDefaultSharingLink.ps1	Implements CIS 7.2.7 check using `Get-SPOTenant`.
powershell/public/cis/Test-MtCisSpoDefaultSharingLink.md	Adds guidance content for CIS 7.2.7 (missing results placeholder).
powershell/public/cis/Test-MtCisSpoB2BIntegration.ps1	Implements CIS 7.2.2 check using `Get-SPOTenant`.
powershell/public/cis/Test-MtCisSpoB2BIntegration.md	Adds guidance content for CIS 7.2.2 (missing results placeholder).
powershell/Maester.psd1	Exports the six new SPO CIS functions.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…om/Mynster9361/maester into CIS-M365v6.0.1-SPO-tests-Chapter-7

Copilot

Pull request overview

Copilot reviewed 40 out of 40 changed files in this pull request and generated 5 comments.

@DataAndGoliath

I decided to revert my changes in regards to connection to sharepoint online and adopt the ones from maester365#1662 added @DataAndGoliath as a co-author on this adoption Only actual change between the 2 is the location for Get-MtSpo.ps1 i have chosen to place this in the powershell\public folder as it now will relate to both CIS and CISA tests. > Co-authored-by: Simon Albers <DataAndGoliath>

…om/Mynster9361/maester into CIS-M365v6.0.1-SPO-tests-Chapter-7

Mynster9361 · 2026-05-11T19:23:58Z

Did not see there already was a PR related to Sharepoint Online.
I decided to revert my changes in regards to connection to SharePoint online and adopt the ones from #1662 added @DataAndGoliath as a co-author on this adoption (Awesome work Simon!)

Only actual change between the 2 is the location for Get-MtSpo.ps1 i have chosen to place this in the powershell\public folder as it now will relate to both CIS and CISA tests.

Copilot

Pull request overview

Copilot reviewed 46 out of 46 changed files in this pull request and generated 7 comments.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 46 out of 46 changed files in this pull request and generated 7 comments.

Comments suppressed due to low confidence (1)

website/docs/connect-maester/readme.md:100

The docs reference -SharePointAdminUrl, but Connect-Maester doesn’t currently define/support that parameter. Either document the actual supported way to override the admin URL (if any), or implement -SharePointAdminUrl in Connect-Maester and update docs consistently.

+        #region SharePoint
+        if ($Service -contains 'SharePoint' -or $Service -contains 'All') {
+            $IsConnected = $false
+            try {
+                $MtConnections.SharePoint = Get-PnPConnection
+                $IsConnected = $null -ne ($MtConnections.SharePoint)
+            } catch {
+                Write-Debug "SharePoint: $false"
+            }
+            Write-Verbose "SharePoint: $IsConnected"
+            if (!$IsConnected) { $ConnectionState = $false }
+        }
+        #endregion SharePoint


+.EXAMPLE
+   Connect-Maester -Service Graph,SharePointOnline
+
+   Connects to Microsoft Graph and SharePoint Online. The SharePoint admin URL is auto-discovered from the tenant's initial domain via the Graph API. Optionally, specify -SharePointAdminUrl to override the auto-discovered URL (e.g. for custom domain or government cloud tenants).


 Connect-Maester [-SendMail] [-SendTeamsMessage] [-Privileged] [-UseDeviceCode] [[-Environment] <String>]
 [[-AzureEnvironment] <String>] [[-ExchangeEnvironmentName] <String>] [[-TeamsEnvironmentName] <String>]
- [[-Service] <String[]>] [[-TenantId] <String>] [[-GraphClientId] <String>]
+ [[-Service] <String[]>] [[-TenantId] <String>] [[-GraphClientId] <String>] [[-SharePointAdminUrl] <String>]


+### -SharePointAdminUrl
+
+The SharePoint admin center URL to connect to when using the SharePointOnline service (e.g.
+https://contoso-admin.sharepoint.com).
+If not specified, the URL is auto-discovered from the tenant's initial domain via the Microsoft Graph API.
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 8
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

HenrikPiecha · 2026-05-20T09:50:03Z

Thank you @Mynster9361 and @SamErde to get the SPO tests with PnP up and running!

…ds updated readme

…om/Mynster9361/maester into pr/1755

Mynster9361 · 2026-05-22T10:04:39Z

I believe everything is in place and docs is updated to reflect.
added a couple diffrent ways of registering the application for sharepoint.

@SamErde might need to run a new pr review from github copilot i can not trigger it my self.
But i believe most if not all is in place now :)

Copilot

Pull request overview

Copilot reviewed 45 out of 45 changed files in this pull request and generated 19 comments.

+        #region SharePoint
+        if ($Service -contains 'SharePoint' -or $Service -contains 'All') {
+            $IsConnected = $false
+            try {
+                $MtConnections.SharePoint = Get-PnPConnection
+                $IsConnected = $null -ne ($MtConnections.SharePoint)
+            } catch {
+                Write-Debug "SharePoint: $false"
+            }
+            Write-Verbose "SharePoint: $IsConnected"
+            if (!$IsConnected) { $ConnectionState = $false }
+        }
+        #endregion SharePoint


+                     $domains = Invoke-MtGraphRequest -RelativeUri "domains" -ApiVersion "v1.0"
+                     $initialDomain = ($domains | Where-Object { $_.isInitial -eq $true }).id
+                     $tenantPrefix = ($initialDomain -split '\.')[0]
+                     $spoAdminUrl = "https://$tenantPrefix-admin.sharepoint.com"
+                     Write-Verbose "Resolved SharePoint admin URL: $spoAdminUrl"


+               try {
+                  # Use the provided admin URL or auto-discover from the tenant's initial domain
+                  if ($SharePointAdminUrl) {
+                     $spoAdminUrl = $SharePointAdminUrl
+                     Write-Verbose "Using provided SharePoint admin URL: $spoAdminUrl"
+                  } else {
+                     $domains = Invoke-MtGraphRequest -RelativeUri "domains" -ApiVersion "v1.0"
+                     $initialDomain = ($domains | Where-Object { $_.isInitial -eq $true }).id
+                     $tenantPrefix = ($initialDomain -split '\.')[0]
+                     $spoAdminUrl = "https://$tenantPrefix-admin.sharepoint.com"
+                     Write-Verbose "Resolved SharePoint admin URL: $spoAdminUrl"
+                  }
+                  Import-Module PnP.PowerShell -ErrorAction Stop
+                  $pnpParams = @{
+                     Url      = $spoAdminUrl
+                     ClientId = $SharePointClientId
+                  }
+                  if ($SharePointCertificateThumbprint) {
+                     if (-not $TenantId) {
+                        Write-Host "`nThe -TenantId parameter is required when using -SharePointCertificateThumbprint." -ForegroundColor Red
+                     } else {
+                        $pnpParams['Thumbprint'] = $SharePointCertificateThumbprint
+                        $pnpParams['Tenant'] = $TenantId
+                     }
+                  } else {
+                     if ($UseDeviceCode) {
+                        $pnpParams['DeviceLogin'] = $true
+                     }
+                     if ($TenantId) {
+                        $pnpParams['Tenant'] = $TenantId
+                     }
+                  }
+                  Connect-PnPOnline @pnpParams
+               } catch [Management.Automation.CommandNotFoundException] {
+                  Write-Host "`nThe PnP.PowerShell module is not installed. Please install the module using the following command.`nFor more information see https://pnp.github.io/powershell/articles/installation.html" -ForegroundColor Red
+                  Write-Host "`nInstall-Module PnP.PowerShell -Scope CurrentUser`n" -ForegroundColor Yellow
+               } catch {
+                  Write-Host "`nFailed to connect to SharePoint Online: $($_.Exception.Message)" -ForegroundColor Red


+            Write-Verbose 'Connecting to SharePoint Online via PnP'
+
+            if (-not $SharePointClientId) {
+               Write-Host "`nSharePointOnline requires the -SharePointClientId parameter. You can use a dedicated PnP app (Register-PnPEntraIDAppForInteractiveLogin) or add an http://localhost redirect URI and AllSites.Read delegated permission to your existing Maester app registration.`nFor more information see https://maester.dev/docs/sections/create-entra-app" -ForegroundColor Red


+```powershell
+$params = @{
+  Service = "Graph,SharePointOnline"
+  SharePointClientId = "<App Client ID>"
+  SharePointCertificateThumbprint = "<Certificate Thumbprint>"
+  TenantId = "<Tenant ID or domain>"
+}
+Connect-Maester @params


+hide_title: false
+hide_table_of_contents: false
+custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtCisSpoGuestCannotShareUnownedItem.ps1
+---


+hide_title: false
+hide_table_of_contents: false
+custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtCisSpoGuestAccessExpiry.ps1
+---


+hide_title: false
+hide_table_of_contents: false
+custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtCisSpoDefaultSharingLinkPermission.ps1
+---


+hide_title: false
+hide_table_of_contents: false
+custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtCisSpoDefaultSharingLink.ps1
+---


+hide_title: false
+hide_table_of_contents: false
+custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtCisSpoB2BIntegration.ps1
+---


Henrik Piecha and others added 22 commits February 9, 2026 12:24

Added CIS M365v5 SPO tests

2fd993d

Update powershell/public/maester/spo/Test-MtSpoDefaultSharingLink.ps1

76e88b3

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update powershell/public/maester/spo/Test-MtSpoB2BIntegration.md

ac83443

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update website/docs/tests/maester/MT.1113.md

f7dd070

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update website/docs/tests/maester/MT.1118.md

7869165

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

changed invoke logic for spo tests

5c88be6

Updated CISM365v57-SPO

a6b37de

Merge branch 'main' into CISM365v57-SPO

6554161

removed test that has been flagged as obsolet by cis

ff61284

Merge branch

947e9bd

Update powershell/public/maester/spo/Test-MtSpoGuestAccessExpiry.ps1

f3dcbed

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update powershell/public/maester/spo/Test-MtSpoGuestCannotShareUnowne…

772b7c0

…dItem.ps1 Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update powershell/public/maester/spo/Test-MtSpoB2BIntegration.md

6850f8e

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update powershell/public/maester/spo/Test-MtSpoGuestCannotShareUnowne…

36ac2fa

…dItem.ps1 Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update powershell/public/maester/spo/Test-MtSpoPreventDownloadMalicio…

c3ac6d7

…usFile.ps1 Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update website/docs/tests/maester/MT.1113.md

7b6f32e

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update powershell/public/Connect-Maester.ps1

389f31a

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update powershell/public/maester/spo/Test-MtSpoGuestCannotShareUnowne…

6b2f02b

…dItem.ps1 Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update powershell/Maester.psd1

9ebb6be

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update powershell/public/Connect-Maester.ps1

328e18c

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update powershell/public/Connect-Maester.ps1

bbfc7e7

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Merge branch 'main' into CIS-M365v6.0.1-SPO-tests-Chapter-7

155a59d

SamErde requested a review from Copilot May 9, 2026 00:34

Copilot started reviewing on behalf of SamErde May 9, 2026 00:34 View session

Copilot AI reviewed May 9, 2026

View reviewed changes

Mynster9361 added 3 commits May 10, 2026 13:04

intial fixes to markdown files

e8f8ff6

Merge branch 'CIS-M365v6.0.1-SPO-tests-Chapter-7' of https://github.c…

8211d95

…om/Mynster9361/maester into CIS-M365v6.0.1-SPO-tests-Chapter-7

update command based help

7e33999

Copilot started reviewing on behalf of SamErde May 11, 2026 08:24 View session

Copilot AI reviewed May 11, 2026

View reviewed changes

SamErde requested changes May 11, 2026

View reviewed changes

Comment thread powershell/public/Connect-Maester.ps1 Outdated

Comment thread powershell/Maester.psd1 Outdated

Comment thread tests/cis/Test-MtCisSpoDefaultSharingLinkPermission.Tests.ps1

Comment thread website/docs/installation.md

This was referenced May 11, 2026

feat: add PnP.PowerShell support with all 8 CISA tests #1662

Draft

Generate command docs before website build #1764

Merged

Mynster9361 and others added 4 commits May 11, 2026 19:51

minor additions and fixes after feedback

ec00f86

Merge branch 'main' into CIS-M365v6.0.1-SPO-tests-Chapter-7

a839c3b

Merge branch 'CIS-M365v6.0.1-SPO-tests-Chapter-7' of https://github.c…

2f436ee

…om/Mynster9361/maester into CIS-M365v6.0.1-SPO-tests-Chapter-7

Merge branch 'main' into CIS-M365v6.0.1-SPO-tests-Chapter-7

85fd443

Mynster9361 mentioned this pull request May 12, 2026

Added CIS M365v5 SPO tests #1433

Closed

SamErde requested a review from Copilot May 18, 2026 15:33

Copilot started reviewing on behalf of SamErde May 18, 2026 15:34 View session

Copilot AI reviewed May 18, 2026

View reviewed changes

SamErde and others added 2 commits May 18, 2026 16:13

Potential fix for pull request finding

8189cb1

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Merge branch 'main' into CIS-M365v6.0.1-SPO-tests-Chapter-7

7b102e2

SamErde requested a review from Copilot May 18, 2026 20:14

Copilot started reviewing on behalf of SamErde May 18, 2026 20:15 View session

Copilot AI reviewed May 18, 2026

View reviewed changes

Mynster9361 and others added 2 commits May 19, 2026 09:17

Merge branch 'main' into CIS-M365v6.0.1-SPO-tests-Chapter-7

9e4f9dd

Potential fix for pull request finding

a2312fc

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

SamErde and others added 3 commits May 21, 2026 16:51

Merge branch 'main' into CIS-M365v6.0.1-SPO-tests-Chapter-7

362cc01

checked everything tested the 3 implementation / authentication metho…

97ba82f

…ds updated readme

Merge branch 'CIS-M365v6.0.1-SPO-tests-Chapter-7' of https://github.c…

a943a95

…om/Mynster9361/maester into pr/1755

SamErde requested a review from Copilot May 22, 2026 11:31

Copilot started reviewing on behalf of SamErde May 22, 2026 11:32 View session

Copilot AI reviewed May 22, 2026

View reviewed changes

Conversation

Mynster9361 commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📑 Description

✅ Checks

ℹ️ Additional Information

Uh oh!

codacy-production Bot commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mynster9361 commented May 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

HenrikPiecha commented May 20, 2026

Uh oh!

Mynster9361 commented May 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Mynster9361 commented May 8, 2026 •

edited

Loading

codacy-production Bot commented May 8, 2026 •

edited

Loading