Did you know that if you have Entra ID P1 there is a new way to block your stolen refresh token from being replayed by the attacker? Find out 🧵👇 1/7

Maester 2.3 is here 🚀 From AI agents to your Macs. Here's what's new 🧵

Have you checked out this week's Entra.News issue #169? Featuring @aaronguilmette, @benoit_hamet, @darrenjrobinson, @flaviomeyer_, @NiklasTinner, @LazyAdmin, @ShaunHardneck, @thomas_live and more!

Self-hosted Maester Cloud is ready 🔥 In July I shared that I'd left Microsoft to work on Maester full time, and launched Maester Cloud, the portal companion to Maester. Today you can buy it and run it in your own Azure subscription, with guided setup from start to finish. → Scheduled Maester runs with the built-in runner → Drift tracking and history, test by test → Email reports and drift alerts from a mailbox in your own tenant, with no Mail.Send granted in Entra → Your results stay in your Azure subscription, in the region you pick $99/month or $1,188/year. You can also buy it on Azure Marketplace and pay on your Azure bill, or get an annual quote in seconds. To the 70+ founding supporters and customers who backed this before it was finished: thank you. You're the reason I get to keep doing this, and every subscription keeps the Maester core tests open source and free for everyone. I'm running Maester Cloud office hours this week to set it up live and answer your questions. Pick a time: 30 Sep, 2PM PT: events.teams.microsoft.com/e… 1 Oct, 10AM BST: events.teams.microsoft.com/e… 1 Oct, 12PM AEST: events.teams.microsoft.com/e… maester.cloud/pricing

Developers wouldn't ship without tests. Identity teams ship changes to a 30-year-old directory every single day with nothing but a change ticket and hope. Maester now tests on-prem Active Directory: 269 checks, read-only, runs from your workstation. Built by Mike Soule, who joins @SamErde and me on this week's Entra.Chat to go through what it covers and how to run it safely. Let's bring Sec DevOps practices to Active Directory! There's no good reason not to have a baseline. Watch the full episode on entra.chat #ActiveDirectory #Maester #PowerShell #IdentitySecurity

Some awesome news on least privilege Graph permissions. There's a new Graph Permission coming soon. Introducing 🎺AppRegistration.Create🎺 Very soon you will no longer need to ask or grant the highly privileged 💥Application.ReadWrite.All💥 BUT hold your horses. It's only listed in the docs at learn.microsoft.com/en-us/gr… and not yet available in the Entra portal or through the API. But when it lands it's going to be good. Plus it's an opportunity to go back and update apps to the least privilege permission.

Love the weekly Entra.News? Meet its over-caffeinated sibling → Daily.Entra.News 👀💥🙀 Today I’m launching a new resource for truly hardcore Entra fans A faster way to see what changed on Microsoft Entra Bookmark it, share it, and let’s dig in 🧵👇

Folks, Maester 2.2 is here!! It was just a couple of months ago when we launched Maester 2.0 and the amazing Maester community has been SUPER busy. The biggest news is support for Active Directory is now in preview thanks to Mike Soule and we have some really cool plans for Active Directory with @PrzemyslawKlys and his awesome TestimoX AD suite. Stay tuned on this. We've added tests for so many new products (and sorry you need to sign in more times because not every Microsoft product uses Graph anymore 🤷‍♀️). That includes Copilot config, Dataverse, SharePoint, Github (as more folks move agentic devlops to GitHub this is going to be super important), new Intune and Entra ID checks and so much more. Here are the highlights 🔥 269 Active Directory checks across identity, policy, infrastructure, DNS, trusts, replication, and access control 🔥 5 Microsoft Purview checks to get your data security foundations ready for Copilot and AI 🔥 12 new SharePoint Online checks across the CIS and CISA baselines, now cross-platform with PnP.PowerShell 🔥 5 CIS GitHub organization controls and first-class GitHub connectivity 🔥 9 Global Secure Access checks for Private Access, forwarding profiles, Compliant Network, and Internet Access 🔥 4 Intune endpoint security checks for LAPS, attack surface reduction, App Control for Business, and Managed Installer 🔥 New Entra ID checks covering agent risk, directory sync safeguards, Conditional Access gaps, legacy MSOnline, and privileged first-party apps 🔥 A sharper report with markdown summaries, per-test durations, and critical findings sorted first 🔥 Contributor credits across maester.dev, so the people writing these tests get the recognition they deserve Huge thanks to our contributors Artem Borodai, @BrianReidC7, @cbrhh, Christopher Edwards, @fabian_bader, Henrik Piecha, @janbakker_, Jean-Philippe George, Jon Gross, Jonathan Hope, Loïc Michel, Massimo Mazzariol, Matthias F., Mike Soule, Morten Mynster Kristensen, Ofir Gavish, @SamErde, Simon Albers, Stephan van Rooij, @thomas_live, Thomas Schmidt, Travis McDade, Truls Dahlsveen (PS Please let me know if I've missed anyone) Plus a huge personal thank you from me to all the maester.cloud founding sponsors maester.cloud/founders who have helped me go full time on Maester. This release wouldn't have been possible without you. Learn all about this release at maester.dev/blog/maester-2-2

Putting the final touches on the upcoming 🔥 Maester 2.2 release and look at this! A new Contributors page dedicated to the awesome community of folks that make Maester what it is today. Check it out and click through to the detail page of each author. maester.dev/contributors BTW @fabian_bader had a neat idea. Soon we'll be handing out exclusive badges/credentials to folks who contribute Maester tests.

Why did I leave Microsoft? To work full time on 🔥 Maester. Over 40,000+ tenants today rely on Maester to monitor their tenants daily. I wanted to make sure that the tests they are running continue to be relevant and evolve as Microsoft 365 and the security landscape evolves. So today I'm announcing the launch of Maester.Cloud Maester Cloud is the portal companion to Maester that lets you track your results over time. It is multi tenant, runs in your cloud (or ours) and more → check out the site for all the features. More importantly Maester Cloud is a way for me to fund the continued development of the open source Maester core and the tests in Maester. That is our mission. In fact I worked with the core team @fabian_bader , @Thomas_Live , @MySnozzberries and @SamErde to create the Maester Manifesto (maester.cloud/manifesto). It is our promise to the community. If you value Maester and would like to support and ensure that Maester continues to grow and be healthy, I would be beyond thrilled if your organisation can sponsor this effort. I would also appreciate it very much if you can share this post with your network to spread awareness. Thanks!