Maester Cloud documentation
Maester Cloud is the evidence layer for Microsoft 365 security. You run Maester and the Zero Trust Assessment wherever you already run them (GitHub Actions, Azure DevOps, Azure Automation, a scheduled task) and push the results to your dedicated Maester Cloud environment. The portal turns those snapshots into a living record: what passed, what failed, what changed since the last run, and how each Microsoft product in your tenant is trending.
How it fits together
- Run your Maester or Zero Trust Assessment as usual.
- Send: today, the built-in Maester Cloud Runner runs your tests for you over your Microsoft Graph connection. Sending results yourself with one PowerShell command (Sending reports) is on the roadmap.Roadmap
- Parse: every test in the report becomes a stored, queryable result with a Microsoft product attached.
- Diff: each run is compared with the previous run of the same kind (How drift works).
- See it all in the portal (The portal), including raw and daily reports. Getting told when something regresses by email (Drift emails) is on the roadmap.Roadmap
Running SharePoint Online checks in Maester? Create your PnP app first
using the official
PnP PowerShell app-registration guide.
The quickest path there is
Register-PnPEntraIDAppForInteractiveLogin; the resulting
Application (client) ID is the value Maester expects for
-SharePointClientId.
Two ways to run it
| Self-hosted | Hosted |
|---|---|
| Private preview. You deploy the stack into your own Azure subscription, guided from your account, with deployment support from the team. Self-hosted. | Coming soon. We run a dedicated environment for you, with its own isolated Azure resources, never shared with another customer. Getting started. |
Design principles
- Your identity, your control. Sign-in uses an Entra app registered in your tenant; only users you assign can get in. No app or token is shared across customers. Security model.
- No secrets, no certificates, nothing to rotate. Managed identities and workload identity federation wherever Microsoft supports it.
- Evidence is kept, not summarized away. Raw report files are stored alongside the parsed results and downloadable any time.
- Honest by default. If a panel has no real data behind it yet, it says so. Nothing in the portal is fabricated.