M365Advisor - PowerShell Commands

Overview

This page lists all the commands available in the M365Advisor PowerShell module.

The M365Advisor PowerShell module is a collection of commands that help you write Pester tests to validate your Microsoft 365 tenant configuration. You can view the Graph API calls for these commands in the M365Advisor GitHub repository's src folder. You can also select the Edit this page link found in the command's documentation to view the source code for the command.

See the writing M365Advisor tests guide for more information on how to write your own tests using these commands.

M365Advisor Commands

• M365Advisor Commands Overview
• Add-MtM365AdvisorAppFederatedCredentialAdds a federated credential to a M365Advisor application for GitHub Actions authentication.
• Add-MtTestResultDetailAdd detailed information about a test so that it can be displayed in the test results report.
• Clear-MtDnsCacheResets the local cache of DNS lookups.
• Clear-MtExoCacheResets the local cache of Exchange Online queries.
• Clear-MtGraphCacheResets the local cache of Graph API calls.
• Compare-MtJsonObjectCompares two PowerShell objects (typically JSON objects) and returns a list of differences.
• Compare-MtTestResultCompares M365Advisor test result JSON files
• Connect-M365AdvisorHelper method to connect to Microsoft Graph using Connect-MgGraph with the required permission scopes as well as other services such as Azure and Exchange Online.
• Convert-MtResultsToFlatObjectConvert M365Advisor test results to a flattened object that can be exported to CSV or Excel.
• ConvertFrom-MailAuthenticationRecordDkimReturns structured RFC compliant object from DKIM record
• ConvertFrom-MailAuthenticationRecordDmarcReturns structured RFC compliant object for a DMARC record
• ConvertFrom-MailAuthenticationRecordMxA simple wrapper for Resolve-DnsName
• ConvertFrom-MailAuthenticationRecordSpfReturns a structured RFC compliant object for the supplied SPF record
• Disconnect-M365AdvisorHelper method to sign out of the current Microsoft Graph session.
• Get-MailAuthenticationRecordObtains and converts the mail authentication records of a domain
• Get-MdeConfigurationGets information about your organization's Defender-protected devices and their policies
• Get-MdeDeviceCountCounts how many devices are protected by Microsoft Defender for Endpoint
• Get-MdePolicyConfigurationGets Microsoft Defender Antivirus policies that are assigned to devices
• Get-MdeSettingValueExtracts setting values from Graph API configuration policy responses
• Get-MtAdminPortalUrlGet the URL for the specific Microsoft admin portal based on the environment.
• Get-MtAuthenticationMethodPolicyConfigGet details of authentication methods
• Get-MtAzureManagementGroupReturns all Azure Management Groups in the tenant
• Get-MtConditionalAccessPolicyReturns all the conditional access policies in the tenant.
• Get-MtExoRetrieves cached response or requests from cmdlet
• Get-MtExoThreatPolicyMalwareRetrieves cached and extended (priority, enabled) of 'Get-MtExo -Request MalwareFilterPolicy'
• Get-MtGraphScopeReturns the list of Graph scopes required to run M365Advisor.
• Get-MtGroupMemberReturns all the members of the specific group ID.
• Get-MtHtmlReportGenerates a formatted html report using the M365AdvisorResults object created by ConvertTo-MtM365AdvisorResult
• Get-MtLicenseInformationGet license information for a Microsoft 365 product.
• Get-MtLinkServicePrincipalGet the deep link to the Microsoft Entra admin portal for a specific Graph object type.
• Get-MtM365AdvisorAppRetrieves M365Advisor applications from Azure AD/Entra ID.
• Get-MtRegistrableDomainGet the registrable domain for a given domain name.
• Get-MtRoleReturns all the role definitions in the tenant.
• Get-MtRoleMemberReturns all the members of a role.
• Get-MtSafeMarkdownEscapes text to be safe to use in markdown.
• Get-MtSessionGets the current M365Advisor session information which includes the current Graph base uri and other details.
• Get-MtSpoRetrieves SharePoint Online tenant settings via PnP with session caching.
• Get-MtTestInventoryDiscover Pester test inventory and associated tags.
• Get-MtUserGet a list of users from the tenant
• Get-MtUserAuthenticationMethodGet the authentication methods for the specified user
• Get-MtUserAuthenticationMethodInfoByTypeReturns DisplayName and IsMfa metadata about a specific user authentication method type
• Get-MtXspmAuthenticationArtifactIconGet the icon representation for a specific authentication artifact type.
• Get-MtXspmExposedAuthenticationArtifactCheck data from Exposure Management for exposed token artifacts.
• Get-MtXspmPrivilegedClassificationIconGet the icon representation for a specific privileged classification level.
• Get-MtXspmUnifiedIdentityInfoCheck data from various XDR tables to identify users and workload identities with sensitive privileges and apply classification from community project EntraOps.
• Get-ObjectDifferenceThis function compares to object arrays
• Get-RelatedPolicyProvides MarkDown text for specific array of objects
• Import-MtM365AdvisorResultImports M365Advisor test result JSON files from disk into PowerShell objects.
• Import-SingleResultFileHelper: loads a single JSON file and adds valid results to the list.
• Install-M365AdvisorTestsInstalls the latest ready-made M365Advisor tests built by the M365Advisor team and the required Pester module.
• Invoke-M365AdvisorThis is the main M365Advisor command that runs the tests and generates a report of the results.
• Invoke-MtAzureRequestInvoke a REST API request to the Azure Management API.
• Invoke-MtAzureResourceGraphRequestInvoke a query request to the Azure Resource Graph.
• Invoke-MtGraphRequestEnhanced version of Invoke-MgGraphRequest that supports paging, batching and caching.
• Invoke-MtGraphSecurityQueryExecute KQL query in Microsoft 365 Defender Advanced Hunting by using Graph API Security endpoint to get results programmatically.
• Merge-MtM365AdvisorResultMerges multiple M365AdvisorResults objects into a single multi-tenant result for combined HTML reporting.
• New-MtM365AdvisorAppCreates a new M365Advisor application in Entra ID with required permissions.
• Resolve-SPFRecordReturns a list of all IP addresses from an SPF record.
• Send-MtMailSend an email with the summary of the M365Advisor test results
• Send-MtTeamsMessageSend an adaptive card in a teams channel with the summary of the M365Advisor test results
• Test-AzdoAllowExtensionsLocalNetworkAccessReturns a boolean depending on the configuration.
• Test-AzdoAllowRequestAccessTokenReturns a boolean depending on the configuration.
• Test-AzdoAllowTeamAdminsInvitationsAccessTokenReturns a boolean depending on the configuration.
• Test-AzdoArtifactsExternalPackageProtectionTokenReturns a boolean depending on the configuration.
• Test-AzdoAuditStreamReturns a boolean depending on the configuration.
• Test-AzdoDisableGlobalPATCreationReturns a boolean depending on the configuration.
• Test-AzdoDisablePATCreationReturns a boolean depending on the configuration.
• Test-AzdoEnableLeakedPersonalAccessTokenAutoRevocationReturns a boolean depending on the configuration.
• Test-AzdoEnforceAADConditionalAccessReturns a boolean depending on the configuration.
• Test-AzdoExternalGuestAccessReturns a boolean depending on the configuration.
• Test-AzdoFeedbackCollectionReturns a boolean depending on the configuration.
• Test-AzdoLogAuditEventReturns a boolean depending on the configuration.
• Test-AzdoOrganizationAutomaticEnrollmentAdvancedSecurityNewProjectReturns a boolean depending on the configuration.
• Test-AzdoOrganizationBadgesArePrivateReturns a boolean depending on the configuration.
• Test-AzdoOrganizationCreationClassicBuildPipelineReturns a boolean depending on the configuration.
• Test-AzdoOrganizationCreationClassicReleasePipelineReturns a boolean depending on the configuration.
• Test-AzdoOrganizationCreationRestrictionReturns a boolean depending on the configuration.
• Test-AzdoOrganizationLimitJobAuthorizationScopeNonReleasePipelineReturns a boolean depending on the configuration.
• Test-AzdoOrganizationLimitJobAuthorizationScopeReleasePipelineReturns a boolean depending on the configuration.
• Test-AzdoOrganizationLimitVariablesAtQueueTimeReturns a boolean depending on the configuration.
• Test-AzdoOrganizationOwnerReturns a boolean depending on the configuration.
• Test-AzdoOrganizationProtectAccessToRepositoryReturns a boolean depending on the configuration.
• Test-AzdoOrganizationRepositorySettingsDisableCreationTFVCRepoReturns a boolean depending on the configuration.
• Test-AzdoOrganizationRepositorySettingsGravatarImageReturns a boolean depending on the configuration.
• Test-AzdoOrganizationStageChooserReturns a boolean depending on the configuration.
• Test-AzdoOrganizationStorageUsageReturns a boolean depending on the configuration.
• Test-AzdoOrganizationTaskRestrictionsDisableMarketplaceTaskReturns a boolean depending on the configuration.
• Test-AzdoOrganizationTaskRestrictionsDisableNode6TaskReturns a boolean depending on the configuration.
• Test-AzdoOrganizationTaskRestrictionsShellTaskArgumentValidationReturns a boolean depending on the configuration.
• Test-AzdoOrganizationTriggerPullRequestGitHubRepositoryReturns a boolean depending on the configuration.
• Test-AzdoProjectCollectionAdministratorReturns a list of all Project Collection Administrators.
• Test-AzdoPublicProjectReturns a boolean depending on the configuration.
• Test-AzdoResourceUsageProjectReturns a boolean depending on the configuration.
• Test-AzdoResourceUsageWorkItemTagReturns a boolean depending on the configuration.
• Test-AzdoRestrictFullScopePersonalAccessTokenReturns a boolean depending on the configuration.
• Test-AzdoRestrictPersonalAccessTokenLifespanReturns a boolean depending on the configuration.
• Test-AzdoSSHAuthenticationReturns a boolean depending on the configuration.
• Test-AzdoThirdPartyAccessViaOauthReturns a boolean depending on the configuration.
• Test-AzdoValidateSshKeyExpirationReturns a boolean depending on the configuration.
• Test-M365AdvisorResultValidHelper: validates that a result object has the required properties.
• Test-MdePolicyComplianceTests policy compliance for an MDE setting across all assigned policies
• Test-MdePolicyHasAssignmentChecks if a configuration policy is assigned to any groups or devices
• Test-MdeSettingComplianceTests compliance for a specific MDE setting value
• Test-MtAIAgentAuthorAuthenticationTests if AI agents use author (maker) authentication for their connector tools.
• Test-MtAIAgentBroadSharingTests if AI agents are shared too broadly.
• Test-MtAIAgentDormantTests if AI agents are dormant.
• Test-MtAIAgentEmailExfiltrationTests if AI agents can send email with AI-controlled inputs.
• Test-MtAIAgentHardCodedCredentialsTests if AI agents have hard-coded credentials in topic definitions.
• Test-MtAIAgentMcpToolsTests if AI agents are configured with MCP server tools.
• Test-MtAIAgentMissingInstructionsTests if AI agents with generative orchestration have custom instructions.
• Test-MtAIAgentNoAuthenticationTests if AI agents require user authentication.
• Test-MtAIAgentOrphanedTests if AI agents are orphaned.
• Test-MtAIAgentRiskyHttpConfigTests if AI agents have risky HTTP configurations.
• Test-MtAndroidEnterpriseConnectionCheck the health of the Android Enterprise connection for Intune.
• Test-MtAppManagementPolicyEnabledChecks if the default app management policy is enabled.
• Test-MtAppRegistrationOwnersWithoutMFATests if app registration owners have Multi-Factor Authentication (MFA) enabled.
• Test-MtAppRegistrationsWithSecretsCheck if any service principals are still using secrets instead of certificates or managed identities.
• Test-MtAppleAutomatedDeviceEnrollmentTokenCheck the validity of the Apple Automated Device Enrollment (ADE) token for Intune.
• Test-MtApplePushNotificationCertificateCheck the validity of the Apple Push Notification Service (APNS) Certificate for Intune.
• Test-MtAppleVolumePurchaseProgramTokenCheck the validity of the Apple Volume Purchase Program (VPP) token for Intune.
• Test-MtAuthenticationPolicyReferencedObjectsExistChecks if authentication method policies reference valid groups that exist in the tenant.
• Test-MtBitLockerFullDiskEncryptionEnsure at least one Intune Disk Encryption policy enforces BitLocker with full disk encryption type.
• Test-MtCaAgentRiskBlockPolicyChecks if the tenant has at least one conditional access policy that blocks agent identities based on their risk level.
• Test-MtCaAllAppsExistsChecks if the tenant has at least one fallback policy targeting All Apps and All Users.
• Test-MtCaApplicationEnforcedRestrictionChecks if the tenant has at least one conditional access policy is configured to enable application enforced restrictions
• Test-MtCaApprovedClientAppChecks if the tenant has no conditional access policy that requires an approved client app.
• Test-MtCaAzureDevOpsChecks if any conditional access policy explicitly includes Azure DevOps
• Test-MtCaBlockLegacyExchangeActiveSyncAuthenticationChecks if the tenant has at least one conditional access policy that blocks legacy authentication for Exchange Active Sync authentication.
• Test-MtCaBlockLegacyOtherAuthenticationChecks if the tenant has at least one conditional access policy that blocks legacy authentication.
• Test-MtCaBlockUnknownOrUnsupportedDevicePlatformChecks if the tenant has at least one Conditional Access policy is configured to block access for unknown or unsupported device platforms
• Test-MtCaDeviceCodeFlowChecks if the tenant has at least one conditional access policy that includes Authentication Flows - Device Code Flow as a condition.
• Test-MtCaDeviceComplianceAdminsExistsChecks if the tenant has at least one conditional access policy requiring device compliance for admins.
• Test-MtCaDeviceComplianceExistsChecks if the tenant has at least one conditional access policy requiring device compliance.
• Test-MtCaEmergencyAccessExistsChecks if the tenant has at least one emergency/break glass account or account group excluded from all conditional access policies
• Test-MtCaEnforceNonPersistentBrowserSessionChecks if the tenant has at least one conditional access policy enforcing non persistent browser session
• Test-MtCaEnforceSignInFrequencyChecks if the tenant has at least one conditional access policy enforcing sign-in frequency for non-corporate devices
• Test-MtCaExclusionForDirectorySyncAccountChecks if all conditional access policies scoped to all cloud apps and all users exclude the directory synchronization accounts
• Test-MtCaGapThis function checks if all objects found in policy exclusions are found in policy inclusions.
• Test-MtCaGroupsRestrictedChecks if groups used in Conditional Access are protected by either Restricted Management Administrative Units or Role Assignable Groups.
• Test-MtCaLicenseUtilizationTest Conditional Access License Utilization and return stats on usage for the specific license.
• Test-MtCaMfaForAdminChecks if the tenant has at least one conditional access policy requiring MFA for admins
• Test-MtCaMfaForAdminManagementChecks if the tenant has at least one conditional access policy requiring multifactor authentication to access Azure management.
• Test-MtCaMfaForAllUsersChecks if the tenant has at least one conditional access policy requiring multifactor authentication for all users
• Test-MtCaMfaForGuestChecks if the tenant has at least one conditional access policy requiring multifactor authentication for all guest users.
• Test-MtCaMfaForRiskySignInChecks if the tenant has at least one conditional access policy requiring multifactor authentication for risky sign-ins.
• Test-MtCaMisconfiguredIDProtectionChecks for common misconfigurations in Conditional Access - both user risk and sign-in risk are configured in one policy.
• Test-MtCaReferencedGroupsExistChecks if any conditional access policies include or exclude groups that have been deleted.
• Test-MtCaReferencedObjectsExistChecks if any conditional access policies reference non-existent users, groups, or roles.
• Test-MtCaRequirePasswordChangeForHighUserRiskChecks if the tenant has at least one conditional access policy requiring password change for high user risk.
• Test-MtCaSecureSecurityInfoRegistrationChecks if the tenant has at least one conditional access policy securing security info registration.
• Test-MtCaWIFBlockLegacyAuthenticationChecks if the user is blocked from using legacy authentication
• Test-MtCertificateConnectorsCheck Intune Certificate Connectors Health and Version
• Test-MtCis365PublicGroupChecks if there are public groups
• Test-MtCisAdminConsentWorkflowEnabledChecks if the admin consent workflow is enabled
• Test-MtCisAttachmentFilterChecks if the default common attachment types filter is enabled
• Test-MtCisAttachmentFilterComprehensiveChecks if the common attachment types filter is comprehensive
• Test-MtCisAuditLogSearchChecks if audit log search is enabled
• Test-MtCisCalendarSharingChecks state of sharing policies
• Test-MtCisCloudAdminChecks if Global Admins are cloud users
• Test-MtCisCommunicateInitiateExternalTeamsUsersEnsure external Teams users cannot initiate conversations
• Test-MtCisCommunicateWithUnmanagedTeamsUsersEnsure communication with unmanaged Teams users is disabled
• Test-MtCisConnectionFilterSafeListChecks if connection filter IPs are allow listed
• Test-MtCisCreateTenantDisallowedChecks if non-admin users are restricted from creating tenants
• Test-MtCisCustomerLockBoxChecks if the customer lockbox feature is enabled
• Test-MtCisDevicesWithoutCompliancePolicyMarkedChecks if devices without a compliance policy assigned are marked "not compliant".
• Test-MtCisDkimChecks state of DKIM for all EXO domains
• Test-MtCisEnsureGuestAccessRestrictedChecks if guest user access is restricted.
• Test-MtCisEnsureGuestUserDynamicGroupChecks if minimum one dynamic group exists with a membership rule targeting guest users.
• Test-MtCisEnsureUserConsentToAppsDisallowedChecks if user consent to applications is disallowed.
• Test-MtCisExoAdditionalStorageProviderChecks if additional storage providers are restricted in Outlook on the web
• Test-MtCisFormsPhishingProtectionEnabledChecks if the internal phishing protection for Microsoft Forms is enabled.
• Test-MtCisGlobalAdminCountChecks if the number of Global Admins is between 2 and 4
• Test-MtCisHostedConnectionFilterPolicyChecks if connection filter IPs are allow listed
• Test-MtCisInternalMalwareNotificationChecks if notifications for internal users sending malware are enabled
• Test-MtCisOutboundSpamFilterPolicyChecks if Exchange Online Spam Policies are set to notify administrators
• Test-MtCisPasswordExpiryChecks if passwords are set to expire
• Test-MtCisSafeAntiPhishingPolicyChecks if the anti-phishing policy matches CIS recommendations
• Test-MtCisSafeAttachmentChecks if the Safe Attachments policy is enabled
• Test-MtCisSafeAttachmentsAtpPolicyChecks if Safe Attachments for SharePoint, OneDrive, and Microsoft Teams are enabled
• Test-MtCisSafeLinkChecks if safe links for office applications are Enabled
• Test-MtCisSharedMailboxSignInChecks if shared mailboxes allow sign-ins
• Test-MtCisSpoB2BIntegrationEnsure SharePoint and OneDrive integration with Azure AD B2B is enabled
• Test-MtCisSpoDefaultSharingLinkEnsure link sharing is restricted in SharePoint and OneDrive
• Test-MtCisSpoDefaultSharingLinkPermissionEnsure the SharePoint default sharing link permission is set
• Test-MtCisSpoGuestAccessExpiryEnsure guest access to a site or OneDrive will expire automatically
• Test-MtCisSpoGuestCannotShareUnownedItemEnsure that SharePoint guest users cannot share items they don't own
• Test-MtCisSpoPreventDownloadMaliciousFileEnsure Office 365 SharePoint infected files are disallowed for download
• Test-MtCisTeamsLobbyBypassEnsure only people in my org can bypass the lobby
• Test-MtCisTeamsReportSecurityConcernsEnsure users can report security concerns in Teams to internal destination
• Test-MtCisThirdPartyAndCustomAppsEnsure all or a majority of third-party and custom apps are blocked
• Test-MtCisThirdPartyApplicationsDisallowedChecks if users are not allowed to register applications.
• Test-MtCisThirdPartyFileSharingEnsure third-party file sharing cloud services in Teams are disabled
• Test-MtCisThirdPartyStorageServicesRestrictedChecks if users are restricted to store and share files in third-party storage services in Microsoft 365 on the web.
• Test-MtCisUserOwnedAppsRestrictedChecks if users are restricted to install add-ins from the Office Store and start trials on behalf of the organization.
• Test-MtCisWeakAuthenticationMethodsDisabledChecks if weak authentication methods (SMS, voice call, email OTP) are disabled in the tenant.
• Test-MtCisZAPChecks if the Zero-hour auto purge (ZAP) for Microsoft Teams is enabled
• Test-MtCisaActivationNotificationChecks for notification on role activation
• Test-MtCisaAntiSpamAllowListChecks state of anti-spam policies
• Test-MtCisaAntiSpamSafeListChecks state of anti-spam policies
• Test-MtCisaAppAdminConsentChecks if admin consent workflow is configured with reviewers
• Test-MtCisaAppGroupOwnerConsentChecks if group owners can consent to apps
• Test-MtCisaAppRegistrationChecks if user app registration is prevented
• Test-MtCisaAppUserConsentChecks if user app consent is prevented
• Test-MtCisaAssignmentNotificationChecks for notification on role assignments
• Test-MtCisaAttachmentFileTypeChecks state of preset security policies
• Test-MtCisaAttachmentFilterChecks state of preset security policies
• Test-MtCisaAuditLogChecks state of purview
• Test-MtCisaAuditLogPremiumChecks state of purview
• Test-MtCisaAuditLogRetentionChecks state of purview
• Test-MtCisaAuthenticatorContextChecks if the Authentication Methods policy for Microsoft Authenticator is set appropriately
• Test-MtCisaAutoExternalForwardingChecks ...
• Test-MtCisaBlockExecutableChecks state of preset security policies
• Test-MtCisaBlockHighRiskSignInChecks if Sign-In Risk Based Policies - MS.AAD.2.3 is set to 'blocked'
• Test-MtCisaBlockHighRiskUserChecks if User Risk Based Policies - MS.AAD.2.1 is set to 'blocked'
• Test-MtCisaBlockLegacyAuthChecks if Baseline Policies Legacy Authentication - MS.AAD.1.1v1 is set to 'blocked'
• Test-MtCisaCalendarSharingChecks state of sharing policies
• Test-MtCisaCloudGlobalAdminChecks if Global Admins are cloud users
• Test-MtCisaContactSharingChecks state of sharing policies
• Test-MtCisaCrossTenantInboundDefaultChecks cross-tenant default inbound access configuration
• Test-MtCisaDiagnosticSettingsChecks for configuration of Entra diagnostic settings
• Test-MtCisaDkimChecks state of DKIM for all EXO domains
• Test-MtCisaDlpChecks state of DLP for EXO
• Test-MtCisaDlpAlternateThis will always return $null
• Test-MtCisaDlpBaselineRuleChecks state of baseline CISA rules for DLP in EXO
• Test-MtCisaDlpPiiChecks state of DLP for EXO
• Test-MtCisaDmarcAggregateCisaChecks state of DMARC records for all exo domains
• Test-MtCisaDmarcRecordExistChecks state of DMARC records for all exo second level domains
• Test-MtCisaDmarcRecordRejectChecks state of DMARC records for all exo domains
• Test-MtCisaDmarcReportChecks state of DMARC records for all exo domains
• Test-MtCisaEmailFilterAlternativePlaceholder
• Test-MtCisaExoAlertChecks state of alerts
• Test-MtCisaExoAlertSiemChecks state of alerts
• Test-MtCisaExternalSenderWarningChecks state of transport policies
• Test-MtCisaGlobalAdminCountChecks if Global Admins is an acceptable number
• Test-MtCisaGlobalAdminRatioChecks the ratio of global admins to privileged roles
• Test-MtCisaGuestInvitationChecks if guest invitations are restricted to admins
• Test-MtCisaGuestUserAccessChecks if guests use proper role template
• Test-MtCisaImpersonationChecks state of preset security policies
• Test-MtCisaImpersonationTipChecks state of preset security policies
• Test-MtCisaMailboxAuditingChecks state of mailbox auditing
• Test-MtCisaMailboxIntelligenceChecks state of preset security policies
• Test-MtCisaMalwareActionChecks state of preset security policies
• Test-MtCisaMalwareZapChecks state of preset security policies
• Test-MtCisaManagedDeviceChecks if Conditional Access Policy requiring managed device is enabled
• Test-MtCisaManagedDeviceRegistrationChecks if a policy is enabled requiring a managed device for registration
• Test-MtCisaMethodsMigrationChecks if migration to Authentication Methods is complete
• Test-MtCisaMfaChecks if Conditional Access Policy requiring MFA is enabled
• Test-MtCisaNotifyHighRiskChecks if Risk Based Policies - MS.AAD.2.2v1 has recipients
• Test-MtCisaPasswordExpirationChecks if passwords are set to not expire
• Test-MtCisaPermanentRoleAssignmentChecks for permanent active role assingments
• Test-MtCisaPhishResistantChecks if Conditional Access Policy using Phishing-Resistant Authentication Strengths is enabled
• Test-MtCisaPrivilegedPhishResistantChecks if Conditional Access Policy requiring phishing resistant authentication methods for privileged roles is enabled
• Test-MtCisaRequireActivationApprovalChecks for approval requirement on activation of Gloabl Admin role
• Test-MtCisaSafeLinkChecks state of URL block list
• Test-MtCisaSafeLinkClickTrackingChecks state of URL direct download scans
• Test-MtCisaSafeLinkDownloadScanChecks state of URL direct download scans
• Test-MtCisaSmtpAuthenticationChecks state of SMTP authentication in Exchange Online.
• Test-MtCisaSpamActionChecks state of spam filter
• Test-MtCisaSpamAlternativeChecks state of spam filter
• Test-MtCisaSpamBypassChecks state of spam filter
• Test-MtCisaSpamFilterChecks state of spam filter
• Test-MtCisaSpfDirectiveChecks state of SPF records for all exo domains
• Test-MtCisaSpfRestrictionChecks state of SPF records for all exo domains
• Test-MtCisaSpoSharingChecks state of SharePoint Online sharing
• Test-MtCisaSpoSharingAllowedDomainChecks state of SharePoint Online sharing
• Test-MtCisaUnmanagedRoleAssignmentChecks for active role assingments with no start time
• Test-MtCisaWeakFactorChecks if weak Authentication Methods are disabled
• Test-MtConditionalAccessWhatIfTests Conditional Access evaluation with What If for a given scenario.
• Test-MtConnectionChecks if the current session is connected to the specified service.
• Test-MtDeviceComplianceSettingsEnsure the built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant'
• Test-MtDeviceRegistrationLocalAdminsGlobalAdminTests whether global administrators are configured as local administrators on devices during Microsoft Entra join.
• Test-MtDeviceRegistrationLocalAdminsRegisteringUserTests whether registering users are configured as local administrators on devices during Microsoft Entra join.
• Test-MtDeviceRegistrationMfaConflictThis function checks if MFA during device registration is being enforced in Entra ID settings and in conditional access policies.
• Test-MtDomainsDmarcRecordMaturityChecks maturity of policies and percentage values in DMARC records for all Entra registered domains.
• Test-MtEidscaAF01Checks if Authentication Method - FIDO2 security key - State is set to 'enabled'
• Test-MtEidscaAF02Checks if Authentication Method - FIDO2 security key - Allow self-service set up is set to 'true'
• Test-MtEidscaAF03Checks if Authentication Method - FIDO2 security key - Enforce attestation is set to 'true'
• Test-MtEidscaAF04Checks if Authentication Method - FIDO2 security key - Enforce key restrictions is set to 'true'
• Test-MtEidscaAF05Checks if Authentication Method - FIDO2 security key - Restricted is set to 'true'
• Test-MtEidscaAF06Checks if Authentication Method - FIDO2 security key - Restrict specific keys is set to 'true'
• Test-MtEidscaAG01Checks if Authentication Method - General Settings - Manage migration is set to @('migrationComplete', '')
• Test-MtEidscaAG02Checks if Authentication Method - General Settings - Report suspicious activity - State is set to 'enabled'
• Test-MtEidscaAG03Checks if Authentication Method - General Settings - Report suspicious activity - Included users/groups is set to 'all_users'
• Test-MtEidscaAM01Checks if Authentication Method - Microsoft Authenticator - State is set to 'enabled'
• Test-MtEidscaAM02Checks if Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP is set to 'false'
• Test-MtEidscaAM03Checks if Authentication Method - Microsoft Authenticator - Require number matching for push notifications is set to 'enabled'
• Test-MtEidscaAM04Checks if Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications is set to 'all_users'
• Test-MtEidscaAM06Checks if Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications is set to 'enabled'
• Test-MtEidscaAM07Checks if Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications is set to 'all_users'
• Test-MtEidscaAM09Checks if Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications is set to 'enabled'
• Test-MtEidscaAM10Checks if Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications is set to 'all_users'
• Test-MtEidscaAP01Checks if Default Authorization Settings - Enabled Self service password reset for administrators is set to 'false'
• Test-MtEidscaAP04Checks if Default Authorization Settings - Guest invite restrictions is set to @('adminsAndGuestInviters','none')
• Test-MtEidscaAP05Checks if Default Authorization Settings - Sign-up for email based subscription is set to 'false'
• Test-MtEidscaAP06Checks if Default Authorization Settings - User can join the tenant by email validation is set to 'false'
• Test-MtEidscaAP07Checks if Default Authorization Settings - Guest user access is set to '2af84b1e-32c8-42b7-82bc-daa82404023b'
• Test-MtEidscaAP08Checks if Default Authorization Settings - User consent policy assigned for applications is set to 'ManagePermissionGrantsForSelf.microsoft-user-default-low'
• Test-MtEidscaAP09Checks if Default Authorization Settings - Allow user consent on risk-based apps is set to 'false'
• Test-MtEidscaAP10Checks if Default Authorization Settings - Default User Role Permissions - Allowed to create Apps is set to 'false'
• Test-MtEidscaAP14Checks if Default Authorization Settings - Default User Role Permissions - Allowed to read other users is set to 'true'
• Test-MtEidscaAS04Checks if Authentication Method - SMS - Use for sign-in is set to 'false'
• Test-MtEidscaAT01Checks if Authentication Method - Temporary Access Pass - State is set to 'enabled'
• Test-MtEidscaAT02Checks if Authentication Method - Temporary Access Pass - One-time is set to 'true'
• Test-MtEidscaAV01Checks if Authentication Method - Voice call - State is set to 'disabled'
• Test-MtEidscaCP01Checks if Default Settings - Consent Policy Settings - Group owner consent for apps accessing data is set to 'False'
• Test-MtEidscaCP03Checks if Default Settings - Consent Policy Settings - Block user consent for risky apps is set to 'true'
• Test-MtEidscaCP04Checks if Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to is set to 'true'
• Test-MtEidscaCR01Checks if Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature is set to 'true'
• Test-MtEidscaCR02Checks if Consent Framework - Admin Consent Request - Reviewers will receive email notifications for requests is set to 'true'
• Test-MtEidscaCR03Checks if Consent Framework - Admin Consent Request - Reviewers will receive email notifications when admin consent requests are about to expire is set to 'true'
• Test-MtEidscaCR04Checks if Consent Framework - Admin Consent Request - Consent request duration (days) is set to 30
• Test-MtEidscaControlTests your environment for compliance with the specified EIDSCA control
• Test-MtEidscaPR01Checks if Default Settings - Password Rule Settings - Password Protection - Mode is set to 'Enforce'
• Test-MtEidscaPR02Checks if Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory is set to 'True'
• Test-MtEidscaPR03Checks if Default Settings - Password Rule Settings - Enforce custom list is set to 'True'
• Test-MtEidscaPR05Checks if Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds is set to 60
• Test-MtEidscaPR06Checks if Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold is set to 10
• Test-MtEidscaST08Checks if Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner is set to 'false'
• Test-MtEidscaST09Checks if Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content is set to 'True'
• Test-MtEntitlementManagementDeletedGroupsChecks if Entra ID Governance access packages or catalogs reference deleted groups
• Test-MtEntitlementManagementInactivePoliciesChecks if access packages have inactive or orphaned assignment policies
• Test-MtEntitlementManagementOrphanedResourcesChecks if catalogs contain unused resources without associated access packages
• Test-MtEntitlementManagementValidApproversChecks if access package approval workflows have valid approvers
• Test-MtEntitlementManagementValidResourceRolesValidates catalog resources have no stale app roles or deleted service principals
• Test-MtEntraDeviceJoinRestrictedTests if Entra ID device join is restricted to selected users/groups or disabled.
• Test-MtEntraIDConnectSssoEnsure Microsoft Entra seamless single sign-on is disabled for all domains.
• Test-MtEntraIDConnectSyncSoftHardMatchingEnsure soft and hard matching for on-premises synchronization objects is blocked
• Test-MtExoDelicensingResiliencyChecks if Delicensing Resiliency is enabled in Exchange Online
• Test-MtExoMailTipChecks if MailTips are enabled for end users
• Test-MtExoModernAuthChecks if modern authentication for Exchange Online is enabled
• Test-MtExoMoeraMailActivityChecks the sent mail activity for MOERA addresses in the past 7 days.
• Test-MtExoOutlookAddinChecks if users installing Outlook add-ins is not allowed
• Test-MtExoRejectDirectSendChecks if direct send is configured to reject
• Test-MtExoSetSclChecks if Spam confidence level (SCL) is configured in mail transport rules with specific domains
• Test-MtFeatureUpdatePolicyCheck whether a Windows Feature Update Policy in Intune is using unsupported builds.
• Test-MtGroupCreationRestrictedChecks if Microsoft 365 Group creation is restricted to approved users.
• Test-MtHighRiskAppPermissionsCheck if any applications or service principals have high risk Graph permissions that can lead to direct or indirect paths
• Test-MtIntuneASRRulesEnsure the Microsoft Defender ASR Standard Protection baseline rules are configured in Block or Audit mode.
• Test-MtIntuneAppControlEnsure at least one Intune App Control for Business policy is configured.
• Test-MtIntuneDiagnosticSettingsCheck the Intune Diagnostic Settings for Audit Logs.
• Test-MtIntuneLAPSConfigurationEnsure at least one Intune LAPS policy is configured to back up local admin passwords to Entra ID.
• Test-MtIntuneManagedInstallerRulesEnsure at least one Intune App Control for Business policy has Managed Installer enabled.
• Test-MtIntuneRbacGroupsProtectedChecks if Intune RBAC groups are protected by Restricted Management Administrative Units or Role Assignable Groups.
• Test-MtKrbtgtAzureADNotSyncedEnsure krbtgt_AzureAD is not synchronized from on-premises Active Directory.
• Test-MtLimitOnMicrosoftDomainUsageEnsure mailboxes do not use the .onmicrosoft.com domain as primary SMTP address
• Test-MtManagedDeviceCleanupSettingsEnsure device clean-up rule is configured
• Test-MtManagementGroupWriteRequirementChecks if write permissions are required to create new management groups
• Test-MtMdeArchiveScanningChecks if archive scanning is enabled in Microsoft Defender Antivirus policies
• Test-MtMdeBehaviorMonitoringChecks if behavior monitoring is enabled in Microsoft Defender Antivirus policies
• Test-MtMdeCatchupFullScanChecks if catch-up full scan is disabled to avoid additional system load
• Test-MtMdeCatchupQuickScanChecks if catch-up quick scan is disabled to avoid additional system load
• Test-MtMdeCloudBlockLevelChecks if cloud block level is set to High or higher
• Test-MtMdeCloudExtendedTimeoutChecks if cloud extended timeout is configured between 30-50 seconds
• Test-MtMdeCloudProtectionChecks if cloud protection is enabled in Microsoft Defender Antivirus policies
• Test-MtMdeCpuLoadFactorChecks if the average CPU load factor is configured between 20-30%
• Test-MtMdeDisableLocalAdminMergeChecks if local admin merge is disabled to block local exclusions
• Test-MtMdeEmailScanningChecks if email scanning is enabled in Microsoft Defender Antivirus policies
• Test-MtMdeMappedDriveScanningChecks if full scan on mapped network drives is disabled in Microsoft Defender Antivirus policies
• Test-MtMdeNetworkFileScanningChecks if scanning network files is enabled in Microsoft Defender Antivirus policies
• Test-MtMdeNetworkProtectionChecks if Network Protection is enabled in block or audit mode
• Test-MtMdePuaProtectionChecks if PUA (Potentially Unwanted Applications) protection is enabled
• Test-MtMdeQuickScanTimeChecks that quick scan time configuration is not required
• Test-MtMdeRealtimeMonitoringChecks if real-time monitoring is enabled in Microsoft Defender Antivirus policies
• Test-MtMdeRealtimeScanDirectionChecks if real-time scan direction is set to monitor both incoming and outgoing files
• Test-MtMdeRemovableDriveScanningChecks if full scan of removable drives is enabled in Microsoft Defender Antivirus policies
• Test-MtMdeRetainCleanedMalwareChecks if cleaned malware is retained for at least 30 days for forensic analysis
• Test-MtMdeScheduleScanDayChecks if a scheduled scan day is configured
• Test-MtMdeScriptScanningChecks if script scanning is enabled in Microsoft Defender Antivirus policies
• Test-MtMdeSignatureBeforeScanChecks if signature checking before scan is enabled for zero-day protection
• Test-MtMdeSignatureUpdateIntervalChecks if signature update interval is configured between 1-4 hours
• Test-MtMdeSubmitSamplesConsentChecks if sample submission consent is configured to send safe samples automatically
• Test-MtMdmAuthorityCheck the MDM Authority for Intune.
• Test-MtMobileThreatDefenseConnectorsCheck the Intune Mobile Threat Defense Connectors.
• Test-MtOperationApprovalPoliciesCheck for the usage of Intune Multi Admin Approval Policies
• Test-MtPimAlertsExistsChecks if PIM alerts exists
• Test-MtPrivPermanentDirectoryRoleChecks if Permanent Assignments for Entra ID roles exists
• Test-MtSecurityGroupCreationRestrictedTests if security group creation is restricted to admin users.
• Test-MtServicePrincipalsForAllUsersThis test checks if you have any third party service principals that are open to all users.
• Test-MtSpExchangeAppAccessPolicyCheck if service principals with Exchange permissions have application access policies configured.
• Test-MtTeamsRestrictParticipantGiveRequestControlChecks if Teams is configured to only allow users with presenter rights to share content during meetings.
• Test-MtTenantCreationRestrictedTests if Entra ID tenant creation is restricted to admin users.
• Test-MtTenantCustomizationCheck the Intune Tenant Customization.
• Test-MtUserAccessAdminChecks if any Global Admins have User Access Control permissions at the Root Scope
• Test-MtVaultSoftDeleteChecks if all Recovery Services Vaults have Soft Delete enabled
• Test-MtWindowsDataProcessorCheck the Intune Windows Data Processor settings.
• Test-MtXspmAppRegWithPrivilegedApiAndOwnersTests if app registration owners with privileged API permissions have delegated ownership.
• Test-MtXspmAppRegWithPrivilegedRolesAndOwnersTests if app registration owners with highly privileged Entra ID roles have delegated ownership.
• Test-MtXspmAppRegWithPrivilegedUnusedPermissionsTests if app registration have assigned privileged API permissions which are unused.
• Test-MtXspmCriticalCredentialsOnNonCredGuardProtectedDevicesFind devices with critical credentials stored on devices not protected by Credential Guard.
• Test-MtXspmCriticalCredentialsOnNonTpmProtectedDevicesTest to find devices that have critical credentials stored on devices that are not protected by TPM.
• Test-MtXspmCriticalCredsOnDevicesWithNonCriticalAccountsTest to find devices with critical and non-critical user credentials on the same device
• Test-MtXspmEnabledPrivilegedUsersLinkedToDisabledIdentityTests if enabled privileged users with assigned high privileged Entra ID roles or criticality level (<= 1) are linked to a disabled identity in Microsoft Defender XDR.
• Test-MtXspmExposedCredentialsForPrivilegedUsersTests if exposed credentials for highly privileged users are present on vulnerable endpoints with high risk or exposure score.
• Test-MtXspmHybridUsersWithAssignedEntraIdRolesTests if hybrid users have been assigned eligible or permanent to Entra ID roles.
• Test-MtXspmPendingApprovalCriticalAssetManagementTests for pending approval for Critical Asset Management.
• Test-MtXspmPrivilegedUsersLinkedToIdentityTests if privileged users with assigned high privileged Entra ID roles are linked to an identity.
• Test-MtXspmPublicRemotelyExploitableHighExposureDevicesTest to find public exposed devices with remotely exploitable, highly likely to be exploited, high or critical severity CVE's
• Test-ORCA100Bulk Complaint Level threshold is between 4 and 6.
• Test-ORCA101Bulk is marked as spam.
• Test-ORCA102Advanced Spam filter options are turned off.
• Test-ORCA103Outbound spam filter policy settings configured.
• Test-ORCA104High Confidence Phish action set to Quarantine message.
• Test-ORCA105Safe Links Synchronous URL detonation is enabled.
• Test-ORCA106Quarantine retention period is 30 days.
• Test-ORCA107End-user spam notification is enabled.
• Test-ORCA108DKIM signing is set up for all your custom domains.
• Test-ORCA108_1DNS Records have been set up to support DKIM.
• Test-ORCA109Senders are not being allow listed in an unsafe manner.
• Test-ORCA110Internal Sender notifications are disabled.
• Test-ORCA111Anti-phishing policy exists and EnableUnauthenticatedSender is true.
• Test-ORCA112Anti-spoofing protection action is configured to Move message to the recipients' Junk Email folders in Anti-phishing policy.
• Test-ORCA113AllowClickThrough is disabled in Safe Links policies.
• Test-ORCA114No IP Allow Lists have been configured.
• Test-ORCA115Mailbox intelligence based impersonation protection is enabled in anti-phishing policies.
• Test-ORCA116Mailbox intelligence based impersonation protection action set to move message to junk mail folder.
• Test-ORCA118_1Domains are not being allow listed in an unsafe manner in Anti-Spam Policies.
• Test-ORCA118_2Domains are not being allow listed in an unsafe manner in Transport Rules.
• Test-ORCA118_3Your own domains are not being allow listed in an unsafe manner in Anti-Spam Policies.
• Test-ORCA118_4Your own domains are not being allow listed in an unsafe manner in Transport Rules.
• Test-ORCA119Similar Domains Safety Tips is enabled.
• Test-ORCA120_malwareZero Hour Autopurge Enabled for Malware.
• Test-ORCA120_phishZero Hour Autopurge Enabled for Phish.
• Test-ORCA120_spamZero Hour Autopurge Enabled for Spam.
• Test-ORCA121Supported filter policy action used.
• Test-ORCA123Unusual Characters Safety Tips is enabled.
• Test-ORCA124Safe attachments unknown malware response set to block messages.
• Test-ORCA139Spam action set to move message to junk mail folder or quarantine.
• Test-ORCA140High Confidence Spam action set to Quarantine message.
• Test-ORCA141Bulk action set to Move message to Junk Email Folder.
• Test-ORCA142Phish action set to Quarantine message.
• Test-ORCA143Safety Tips are enabled.
• Test-ORCA156Safe Links Policies are tracking when user clicks on safe links.
• Test-ORCA158Safe Attachments is enabled for SharePoint and Teams.
• Test-ORCA179Safe Links is enabled intra-organization.
• Test-ORCA180Anti-phishing policy exists and EnableSpoofIntelligence is true.
• Test-ORCA189Safe Attachments is not bypassed.
• Test-ORCA189_2Safe Links is not bypassed.
• Test-ORCA205Common attachment type filter is enabled.
• Test-ORCA220Advanced Phish filter Threshold level is adequate.
• Test-ORCA221Mailbox intelligence is enabled in anti-phishing policies.
• Test-ORCA222Domain Impersonation action is set to move to Quarantine.
• Test-ORCA223User impersonation action is set to move to Quarantine.
• Test-ORCA224Similar Users Safety Tips is enabled.
• Test-ORCA225Safe Documents is enabled for Office clients.
• Test-ORCA226Each domain has a Safe Link policy applied to it.
• Test-ORCA227Each domain has a Safe Attachments policy applied to it.
• Test-ORCA228No trusted senders in Anti-phishing policy.
• Test-ORCA229No trusted domains in Anti-phishing policy.
• Test-ORCA230Each domain has a Anti-phishing policy applied to it, or the default policy is being used.
• Test-ORCA231Each domain has a anti-spam policy applied to it, or the default policy is being used.
• Test-ORCA232Each domain has a malware filter policy applied to it, or the default policy is being used.
• Test-ORCA233Domains are pointed directly at EOP or enhanced filtering is used.
• Test-ORCA233_1Domains are pointed directly at EOP or enhanced filtering is configured on all default connectors.
• Test-ORCA234Click through is disabled for Safe Documents.
• Test-ORCA235SPF records is set up for all your custom domains.
• Test-ORCA236Safe Links is enabled for emails.
• Test-ORCA237Safe Links is enabled for teams messages.
• Test-ORCA238Safe Links is enabled for office documents.
• Test-ORCA239No exclusions for the built-in protection policies.
• Test-ORCA240Outlook is configured to display external tags for external emails.
• Test-ORCA241Anti-phishing policy exists and EnableFirstContactSafetyTips is true.
• Test-ORCA242Important protection alerts responsible for AIR activities are enabled.
• Test-ORCA243Authenticated Receive Chain is set up for domains not pointing to EOP/MDO, or all domains point to EOP/MDO.
• Test-ORCA244Policies are configured to honor sending domains DMARC.
• Update-M365AdvisorTestsUpdates the specified folder with the latest ready-made M365Advisor tests built by the M365Advisor team.
• Update-MtM365AdvisorAppUpdates an existing M365Advisor application with the latest required permissions.