Built on Maester, the open source Microsoft 365 test framework by Merill Fernando, Thomas Naunheim and the other Maester contributors (MIT). SimpleMaester is an independent browser port and not affiliated with the Maester project.

Connect to your tenant

Sign in with an admin account of the tenant you want to test. The tests read settings through Microsoft Graph, as you. SimpleMaester only reads; it changes nothing.

Delegated permissions asked at sign-in:

  • Directory.Read.All, Policy.Read.All, RoleManagement.Read.Directory tenant, policy and role settings
  • Application.Read.All app registrations and service principals
  • UserAuthenticationMethod.Read.All, AuditLog.Read.All, Reports.Read.All MFA registration and sign-in activity

Asked only before a scan that includes tests needing them: OrgSettings-Forms.Read.All, OrgSettings-AppsAndServices.Read.All, SecurityEvents.Read.All, SharePointTenantSettings.Read.All, DeviceManagement*.Read.All (Intune), AccessReview.Read.All, EntitlementManagement.Read.All, InformationProtectionPolicy.Read, and Azure Resource Manager for the Azure tests. The Global Reader role is enough for most tests.

No results yet

Run tests on the Run tab first.

Trend over time

Scans are kept in this browser only. Pick a tenant to see how its posture changed.

No history yet

Every scan you run is stored here, so you can compare runs.

Per-test history

Open a test to see its last result and how it changed across your scans.

Test Last result Pass rate Runs Last 10

Test catalog

The Maester tests ported to the browser so far. Tests that cannot run from a browser yet are listed too, so the gap is visible. The full reference is at maester.dev.

About SimpleMaester

SimpleMaester runs the Maester security tests for Microsoft 365 from your browser, without PowerShell. It is a port of the Maester PowerShell module by Merill Fernando, Thomas Naunheim and the other Maester contributors. All credit for the tests goes to them.

What is implemented

  • EIDSCA: the full set of EIDSCA controls.
  • Maester: Entra tests that can be checked over Graph, such as privileged role MFA, app secret expiry, emergency access accounts and conditional access baselines.
  • CISA and CIS: the controls reachable through Graph, Azure Resource Manager and DNS.
  • Intune and governance: compliance, access reviews, entitlement management, sensitivity labels and Azure RBAC.

What is not implemented

Tests that need the Exchange Online, Teams, Defender or Purview admin APIs. Microsoft does not allow those APIs to be called from a web page (no CORS), so they are listed in the catalog as not implemented and report Skipped. Run them with the Maester PowerShell module.

Where your data goes

  • Settings are read from graph.microsoft.com and, for the Azure tests, management.azure.com, with your own delegated access.
  • The SPF, DKIM and DMARC tests look up your tenant's mail domain names in DNS through Cloudflare DNS-over-HTTPS (cloudflare-dns.com), directly from your browser. Only the domain names are sent, no token.
  • Nothing goes to a server of ours.

What is stored in this browser

Every scan is saved in this browser's IndexedDB (localStorage if IndexedDB is blocked) so the History tab can compare runs: tenant id and domain, per test the status, reason and observed value, and a preview of up to 5 API responses per test, cut at 500 characters. Those previews can contain names, UPNs and policy settings from your tenant. Nothing is sent anywhere, and history is kept until you remove it with Clear history on the History tab. Your last custom test selection is kept as well. Sign-in tokens are not part of the history.

Credits

Maester © the Maester contributors, maester.dev, MIT licensed. SimpleMaester is an independent web port and not affiliated with the Maester project. Bugs in SimpleMaester are ours, not theirs.