Feature/cisa spo remaining controls by DataAndGoliath · Pull Request #1498 · maester365/maester

DataAndGoliath · 2026-03-20T11:51:34Z

Description

Hey Maester Team,

I've been using the tool in the field for some time now and thoroughly appreciate what has been done. I've encountered requests for SPO integration a couple of times now, and especially since there's SCuBA tests for this that have not been completed. I've taken the liberty to add SPO through some not-perfect handling of PS5.1 through the Connect-SPOService module. Also thought about PnP, but that requires too much refactoring.

Implemented 6 of the 8 remaining CISA SCuBA SPO security controls that were previously listed as "Not Implemented". These controls require the Microsoft.Online.SharePoint.PowerShell module since the properties are not available via Microsoft Graph.

New test cmdlets:

Test-MtCisaSpoOneDriveSharing (MS.SHAREPOINT.1.2v1)
Test-MtCisaSpoDefaultSharingScope (MS.SHAREPOINT.2.1v1)
Test-MtCisaSpoDefaultSharingPermission (MS.SHAREPOINT.2.2v1)
Test-MtCisaSpoAnyoneLinkExpiration (MS.SHAREPOINT.3.1v1)
Test-MtCisaSpoAnyoneLinkPermission (MS.SHAREPOINT.3.2v1)
Test-MtCisaSpoVerificationCodeReauth (MS.SHAREPOINT.3.3v1)

Infrastructure:

Get-MtSpo caching helper (mirrors Get-MtExo pattern) with Clear-MtSpoCache
SharePointOnline added as a service in Connect-Maester, Disconnect-Maester, and Test-MtConnection
-SharePointAdminUrl parameter on Connect-Maester for manual override
-UseWindowsPowerShell on PS7 for SPO module compatibility
Module manifest updated with all new exported functions

Design decisions:

Section 2.x tests check both new and legacy property names for the Microsoft property name transition (DefaultSharingLinkType → CoreDefaultShareLinkScope, DefaultLinkPermission → CoreDefaultShareLinkRole)
Section 3.x tests auto-pass when sharing is more restrictive than the applicability threshold
All tests skip gracefully with a custom reason when SPO is not connected

Test plan

Module loads without errors
All 8 new functions exported
Tests skip gracefully when SPO not connected
Get-MtSpo caching works correctly
All 6 tests return boolean results against live tenant
Invoke-Maester -Path ./tests/cisa/spo/ generates HTML report
Connect/Disconnect/Test-MtConnection lifecycle works for SharePointOnline
UTF-8 BOM encoding on all new files

Contribution Checklist

Before submitting this PR, please confirm you have completed the following:

📖 Read the guidelines for contributing to this repository.
🧪 Ensure the build and unit tests pass by running /powershell/tests/pester.ps1 on your local system.

Join us at the Maester repository discussions 💬 or Entra Discord 🧑‍💻 for more help and conversations!

…2.2, 3.1, 3.2, 3.3) Implement 6 of the 8 remaining CISA SCuBA SharePoint Online security controls that were previously listed as "Not Implemented". These controls require the Microsoft.Online.SharePoint.PowerShell module since the properties are not available via Microsoft Graph. New test cmdlets: - Test-MtCisaSpoOneDriveSharing (MS.SHAREPOINT.1.2v1) - Test-MtCisaSpoDefaultSharingScope (MS.SHAREPOINT.2.1v1) - Test-MtCisaSpoDefaultSharingPermission (MS.SHAREPOINT.2.2v1) - Test-MtCisaSpoAnyoneLinkExpiration (MS.SHAREPOINT.3.1v1) - Test-MtCisaSpoAnyoneLinkPermission (MS.SHAREPOINT.3.2v1) - Test-MtCisaSpoVerificationCodeReauth (MS.SHAREPOINT.3.3v1) Infrastructure: - Add Get-MtSpo caching helper (mirrors Get-MtExo pattern) - Add Clear-MtSpoCache for session cache management - Add SpoCache to module session state - Add SharePointOnline as a service in Connect-Maester, Disconnect-Maester, and Test-MtConnection - Add -SharePointAdminUrl parameter to Connect-Maester for manual override - Use -UseWindowsPowerShell on PS7 for SPO module compatibility - Update module manifest with all new exported functions

Hey Maester Team, I've been using the tool in the field for some time now and thoroughly appreciate what has been done. I've encountered requests for SPO integration a couple of times now, and especially since there's SCuBA tests for this that have not been completed. I've taken the liberty to add SPO through some not-perfect handling of PS5.1 through the Connect-SPOService module. Also thought about PnP, but that requires too much refactoring. Implemented 6 of the 8 remaining CISA SCuBA SPO security controls that were previously listed as "Not Implemented". These controls require the Microsoft.Online.SharePoint.PowerShell module since the properties are not available via Microsoft Graph. New test cmdlets: * Test-MtCisaSpoOneDriveSharing (MS.SHAREPOINT.1.2v1) * Test-MtCisaSpoDefaultSharingScope (MS.SHAREPOINT.2.1v1) * Test-MtCisaSpoDefaultSharingPermission (MS.SHAREPOINT.2.2v1) * Test-MtCisaSpoAnyoneLinkExpiration (MS.SHAREPOINT.3.1v1) * Test-MtCisaSpoAnyoneLinkPermission (MS.SHAREPOINT.3.2v1) * Test-MtCisaSpoVerificationCodeReauth (MS.SHAREPOINT.3.3v1) Infrastructure: * Add Get-MtSpo caching helper (mirrors Get-MtExo pattern) * Add Clear-MtSpoCache for session cache management * Add SpoCache to module session state * Add SharePointOnline as a service in Connect-Maester, Disconnect-Maester, and Test-MtConnection * Add -SharePointAdminUrl parameter to Connect-Maester for manual override * Use -UseWindowsPowerShell on PS7 for SPO module compatibility * Update module manifest with all new exported functions

SamErde · 2026-03-21T14:54:41Z

Thanks for the helpful addition, @DataAndGoliath! There's a bit of a queue to review right now but we're excited to see this in action.

Copilot

Pull request overview

This PR adds SharePoint Online (SPO) support to Maester’s CISA SCuBA baseline coverage by introducing new SPO security control test cmdlets, plus connection/caching infrastructure and documentation updates.

Changes:

Added 6 new CISA SPO control tests (plus accompanying markdown docs and Pester tests).
Introduced SPO session caching (Get-MtSpo / Clear-MtSpoCache) and wired SPO into Connect-Maester, Disconnect-Maester, and Test-MtConnection.
Updated website docs to list the newly-implemented SPO controls.

Reviewed changes

Copilot reviewed 28 out of 28 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
website/versioned_docs/version-2.0.0/tests/cisa/spo.md	Updates versioned docs to list newly implemented SPO controls.
website/docs/tests/cisa/spo.md	Updates current docs to list newly implemented SPO controls.
tests/cisa/spo/Test-MtCisaSpoVerificationCodeReauth.Tests.ps1	Adds Pester coverage for MS.SHAREPOINT.3.3.
tests/cisa/spo/Test-MtCisaSpoOneDriveSharing.Tests.ps1	Adds Pester coverage for MS.SHAREPOINT.1.2.
tests/cisa/spo/Test-MtCisaSpoDefaultSharingScope.Tests.ps1	Adds Pester coverage for MS.SHAREPOINT.2.1.
tests/cisa/spo/Test-MtCisaSpoDefaultSharingPermission.Tests.ps1	Adds Pester coverage for MS.SHAREPOINT.2.2.
tests/cisa/spo/Test-MtCisaSpoAnyoneLinkPermission.Tests.ps1	Adds Pester coverage for MS.SHAREPOINT.3.2.
tests/cisa/spo/Test-MtCisaSpoAnyoneLinkExpiration.Tests.ps1	Adds Pester coverage for MS.SHAREPOINT.3.1.
powershell/public/Disconnect-Maester.ps1	Adds SPO disconnect lifecycle handling.
powershell/public/core/Test-MtConnection.ps1	Adds SPO connection verification support.
powershell/public/Connect-Maester.ps1	Adds SPO connection support and `-SharePointAdminUrl` parameter.
powershell/public/Clear-MtSpoCache.ps1	Adds cmdlet to clear cached SPO tenant settings.
powershell/public/cisa/spo/Test-MtCisaSpoVerificationCodeReauth.ps1	Implements MS.SHAREPOINT.3.3 control evaluation via SPO module.
powershell/public/cisa/spo/Test-MtCisaSpoVerificationCodeReauth.md	Adds end-user guidance/remediation doc for MS.SHAREPOINT.3.3.
powershell/public/cisa/spo/Test-MtCisaSpoOneDriveSharing.ps1	Implements MS.SHAREPOINT.1.2 control evaluation via SPO module.
powershell/public/cisa/spo/Test-MtCisaSpoOneDriveSharing.md	Adds end-user guidance/remediation doc for MS.SHAREPOINT.1.2.
powershell/public/cisa/spo/Test-MtCisaSpoDefaultSharingScope.ps1	Implements MS.SHAREPOINT.2.1 control evaluation (new/legacy property names).
powershell/public/cisa/spo/Test-MtCisaSpoDefaultSharingScope.md	Adds end-user guidance/remediation doc for MS.SHAREPOINT.2.1.
powershell/public/cisa/spo/Test-MtCisaSpoDefaultSharingPermission.ps1	Implements MS.SHAREPOINT.2.2 control evaluation (new/legacy property names).
powershell/public/cisa/spo/Test-MtCisaSpoDefaultSharingPermission.md	Adds end-user guidance/remediation doc for MS.SHAREPOINT.2.2.
powershell/public/cisa/spo/Test-MtCisaSpoAnyoneLinkPermission.ps1	Implements MS.SHAREPOINT.3.2 control evaluation via SPO module.
powershell/public/cisa/spo/Test-MtCisaSpoAnyoneLinkPermission.md	Adds end-user guidance/remediation doc for MS.SHAREPOINT.3.2.
powershell/public/cisa/spo/Test-MtCisaSpoAnyoneLinkExpiration.ps1	Implements MS.SHAREPOINT.3.1 control evaluation via SPO module.
powershell/public/cisa/spo/Test-MtCisaSpoAnyoneLinkExpiration.md	Adds end-user guidance/remediation doc for MS.SHAREPOINT.3.1.
powershell/public/cisa/spo/Get-MtSpo.ps1	Adds cached `Get-SPOTenant` helper used by SPO tests.
powershell/Maester.psm1	Adds `SpoCache` to module session state.
powershell/Maester.psd1	Exports new SPO cmdlets and helpers.
powershell/internal/Clear-ModuleVariable.ps1	Ensures SPO cache is cleared during module variable reset.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

website/docs/tests/cisa/spo.md

website/versioned_docs/version-2.0.0/tests/cisa/spo.md

Copilot · 2026-03-21T14:57:23Z

powershell/public/core/Test-MtConnection.ps1

        # Checks if the current session is connected to the specified service
-        [ValidateSet('All', 'Azure', 'ExchangeOnline', 'EOP', 'Graph', 'SecurityCompliance', 'Teams')]
+        [ValidateSet('All', 'Azure', 'ExchangeOnline', 'EOP', 'Graph', 'SecurityCompliance', 'SharePointOnline', 'Teams')]
        [Parameter(Position = 0)]
        [string[]]$Service = 'Graph',



The comment-based help for the Service parameter lists valid values but doesn’t mention the newly-added SharePointOnline option. Please update the help text so Get-Help Test-MtConnection stays accurate.

powershell/public/core/Test-MtConnection.ps1

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Yeah that's true, it's referring to 'tests' which is a plural object. Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

$MtConnections. for SPO module is indeed reffed in line 54, but never populated as the same check vocabulary. I'll use the handler for this to ensure consistency, and so it doesn't break the $MtConnections.all check. Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

DataAndGoliath

Validated through CoPilot check. Retrofitted a health-state check, that is now initialized alongside the other modules. There wasn't one previously for SharePoint, because the checks for SPO were running against Graph. Should be valid to check on Get-SPOTenant for the time being.

DataAndGoliath · 2026-03-23T20:40:09Z

Thanks for the helpful addition, @DataAndGoliath! There's a bit of a queue to review right now but we're excited to see this in action.

I completely understand :) I just saw that there wasn't anything in the docs with regards to getting SPO up and running, so I thought I'd take a jab at it. In my perfect dream world, this would've all be done on native Graph, but alas...

DataAndGoliath added 2 commits March 20, 2026 12:39

DataAndGoliath requested review from a team as code owners March 20, 2026 11:51

SamErde requested a review from Copilot March 21, 2026 14:53

Copilot started reviewing on behalf of SamErde March 21, 2026 14:54 View session

Copilot AI reviewed Mar 21, 2026

View reviewed changes

DataAndGoliath and others added 3 commits March 23, 2026 16:07

Update website/docs/tests/cisa/spo.md

65b8521

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update website/versioned_docs/version-2.0.0/tests/cisa/spo.md

9fe3eae

Yeah that's true, it's referring to 'tests' which is a plural object. Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

DataAndGoliath commented Mar 23, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature/cisa spo remaining controls#1498

Feature/cisa spo remaining controls#1498
DataAndGoliath wants to merge 5 commits intomaester365:mainfrom
DataAndGoliath:feature/cisa-spo-remaining-controls

DataAndGoliath commented Mar 20, 2026

Uh oh!

SamErde commented Mar 21, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 21, 2026

Uh oh!

Uh oh!

DataAndGoliath left a comment

Uh oh!

DataAndGoliath commented Mar 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

DataAndGoliath commented Mar 20, 2026

Description

Test plan

Contribution Checklist

Uh oh!

SamErde commented Mar 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

DataAndGoliath left a comment

Choose a reason for hiding this comment

Uh oh!

DataAndGoliath commented Mar 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants