Connect to your tenant
SimpleMaester runs entirely in your browser. It signs you in with Microsoft using PKCE and queries Microsoft Graph as you. Nothing is sent to a server we run.
The first sign in only asks for the basic Graph read scopes. SimpleMaester will ask for additional consent the first time a test needs it. This could happen multiple times depending on the API's / scopes the tests use
SimpleMaester does not write anything. It is read-only.
What do you want to test?
Pick a category to run those Maester tests, or build your own selection.
No results yet
Run some tests on the Run tab first.
Latest scan
| Status | Severity | Id | Title | Category | Duration |
|---|
Trend over time
All scans for this browser are kept in local storage. Pick a tenant to see how its posture has evolved.
Per-test history
Click any test below to see how its result has changed across all your scans.
| Test | Last result | Pass rate | Times run | Last 10 |
|---|
Test catalog
SimpleMaester ships with a curated subset of Maester's tests ported to JavaScript. Tests not yet implemented in the browser are listed too so you can see the gap. The full reference lives at maester.dev.
Debug log
About SimpleMaester
SimpleMaester is part of the LCToolkit by Lieben Consultancy. It is a browser-only port of the excellent Maester PowerShell module by Merill Fernando, Thomas Naunheim and the many other Maester contributors. All credit goes to them, this tool just tries to make running Maester a little easier for those unfamiliar with PowerShell.
The aim is to make all Maester tests run fully through a browser, without compromising on security.
What's implemented
- EIDSCA - the full set of EIDSCA controls
- Maester core - a curated set of Entra-focused tests (privileged role MFA, app secret expiry, emergency access account exists, conditional access baselines that can be checked over Graph).
- CISA
- CIS
What's NOT implemented yet
Anything that needs Exchange Online, Teams admin, Defender, Intune, Purview, Azure DevOps or Power Platform PowerShell modules is for now listed in the catalog with a "not implemented" tag so the gap is visible. Since Microsoft portals often block CORS, I'll have to implement a tiny proxy first. PRs welcome.
Privacy
Tokens stay in your browser's local storage. SimpleMaester does not have a backend and does not phone home. Outbound calls go directly to the Microsoft endpoints needed to run the tests you ran. Scan history is stored in IndexedDB on YOUR machine and never leaves it.
Credits
Maester © maester.dev, MIT licensed. SimpleMaester is an independent web port and is not affiliated with the Maester project. Bugs in SimpleMaester are mine, not theirs.