Maester Maester Cloud

Getting started

Subscribing to Self-Hosted lets you set Maester Cloud up straight away, in your own Azure subscription. Sign in to your account after checkout and start setup: the steps below are what the setup app walks you through.

Prefer that we run it for you? Hosted Maester Cloud is coming soon: join the waitlist.

1 · Subscribe

Complete checkout from the pricing page (payments are handled by Polar, our merchant of record). You are taken straight to your Maester Cloud account, where you can start setup.

2 · Start the setup app

Start setup from your account to run the Maester Cloud Setup app in your browser, or run the same app from PowerShell with Start-MaesterCloudSetup, which signs in with Microsoft's own Azure CLI and Microsoft Graph PowerShell apps instead. Either way it opens on your Maester Cloud instances, where you can deploy a new one or open one you already have. Setup permissions lists every role and permission each step needs.

3 · Deploy to Azure

Sign in to Azure, then pick the tenant, subscription, region, and resource group for your instance. Your reports and history are stored only in that region. Review the plan, confirm, and watch the deployment finish with live progress. You need Contributor on the resource group, or on the subscription if setup should create the resource group.

4 · Configure portal sign-in

Your portal signs users in with an app registered in your tenant. Setup offers two ways to get it:

  • Automatic: sign in to Microsoft Graph with an account that can create app registrations, and setup creates the app, seeds you as the first Owner, and grants the deployment's runner identity access to it (see Assignment required).
  • Use an existing app: if your identity team owns app registrations, they create it from the manual steps setup shows, including the runner identity's access, and you attach its IDs. Setup then never needs permission to create apps.

Either way the result is the same: a single-tenant app named Maester Cloud with no client secret, no Microsoft Graph permissions, and no app roles. It exposes one delegated scope, access_as_user, so it never needs admin consent.

Who can see what is decided inside Maester Cloud. A new user has no role and sees nothing until an Owner grants one on the Access page.

Assignment required

If you also want Entra to refuse the sign-in outright, turn on Assignment required on the Maester Cloud enterprise application. It is optional and fully supported. Once it is on, Entra issues tokens only to assigned users, groups, and service principals, and that includes the Maester Cloud runner, which signs in to the app with your deployment's managed identity (id-<workload>-runner) to claim each run. Without an assignment, every managed run fails at Starting runner with AADSTS501051.

Turn it on in this order:

  1. Assign the runner identity. Automatic setup does this for you. For an app your identity team created, or an instance set up before this was automatic, open the instance in the setup app, go to Portal sign-in, and choose Assign the runner identity. Or have an Entra administrator run the script setup shows, which has your deployment's IDs filled in. The Entra admin center can't assign a managed identity to an app, so it has to be one of these.
  2. Assign the people and groups who should sign in under Entra admin center → Enterprise applications → Maester Cloud → Users and groups. Automation uploaders need an assignment too; the Access page generates their script.
  3. Turn on Assignment required under the enterprise application's Properties.

5 · Email reports (optional)

Pick the shared mailbox reports are sent from, and setup lets your deployment's managed identity send as that one mailbox. This step needs the Exchange Administrator role and can be skipped and done later. Drift emails covers what arrives.

6 · Connect a tenant and run your first check

Setup verifies the instance and opens it. From the Tenants blade, create the runner app that reads your tenant, then sign in to the portal with your work account. The built-in Maester Cloud Runner runs your first Maester tests for you. The moment it lands, the Overview lights up with real numbers; the second run activates drift.

You can also send reports yourself from your own pipelines with one PowerShell command (Sending reports). Uploading needs the Uploader permission, which is off for everyone at first, Owners included: tick it for yourself on the Access page before your first upload. New releases are applied by re-running setup; see Self-hosting.