2.1.0

What's Changed

• chore(deps): bump the npm_and_yarn group across 2 directories with 1 update by @dependabot[bot] in #1364
• Update maester.dev powershell docs by @github-actions[bot] in #1363
• chore(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in #1367
• chore(deps): bump peter-evans/create-pull-request from 7 to 8 by @dependabot[bot] in #1375
• chore(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in #1376
• chore(deps): bump actions/download-artifact from 6 to 7 by @dependabot[bot] in #1377
• Remove the check for the unused scope "RoleEligibilitySchedule.ReadWrite.Directory" by @mrdos010 in #1389
• Added DeviceManagementServiceConfig.Read.All to the Scope Catalogue by @dreadsend in #1395
• Add tests for privileged users linked to identities by @Cloud-Architekt in #1394
• Fix diagnostic settings retrieval to ensure array output by @SamErde in #1392
• Fix typo in comment-based help for Disconnect-Maester by @SamErde in #1397
• Add automatically updating tag documentation for web site by @SamErde in #1373
• Fix build-validation workflow blocking PRs without powershell changes by @Copilot in #1411
• Update docs navigation sidebar by @SamErde in #1382
• Delete .github/workflows/publish-website.yaml by @SamErde in #1409
• chore(deps-dev): bump qs from 6.14.0 to 6.14.1 in /report in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1387
• Update maester.dev powershell docs by @github-actions[bot] in #1403
• Fix npm ci working directory in versioned docs workflow by @Copilot in #1414
• Partially enable documentation update steps in workflow by @SamErde in #1408
• Add workflow_dispatch trigger to publish docs workflow by @SamErde in #1418
• Remove the check for unused scope "RoleEligibilitySchedule.ReadWrite.Directory" by @oed-metzb in #1413
• chore(deps): bump stefanzweifel/git-auto-commit-action from 7.0.0 to 7.1.0 by @dependabot[bot] in #1424
• chore(deps): bump actions/setup-node from 6.0.0 to 6.2.0 by @dependabot[bot] in #1423
• Fix circular SPF reference detection (A→B→A loops) by @mattcave in #1398
• refactor: Fix comma placement in sidebar.js by @SamErde in #1428
• Update Maester Action description to resolve release publishing error by @SamErde in #1427
• Update maester.dev powershell docs by @github-actions[bot] in #1426
• Fix API version condition for Microsoft Graph by @alexandair in #1437
• chore(deps): bump ghcr.io/devcontainers/features/powershell from 1.5.1 to 2.0.0 by @dependabot[bot] in #1442
• Update Service Plan ID for Customer Lockbox by @brianreidc7 in #1436
• Add tags and skip condition to test cases by @brianreidc7 in #1434
• Add Entitlement Management tests MT.1107-MT.1111 by @nicowyss in #1381
• Refactor MT.1076 to fix reported results by @SamErde in #1430
• Federated domains always fail password expiry check by @brianreidc7 in #1435
• Auto-update report template by @github-actions[bot] in #1445
• chore(deps): bump react-router from 7.9.6 to 7.12.0 in /report in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1420
• Fix timestamp field references in logon event queries by @Cloud-Architekt in #1452
• chore(deps): bump the npm_and_yarn group across 2 directories with 4 updates by @dependabot[bot] in #1451
• chore(deps): bump lodash-es from 4.17.21 to 4.17.23 in /website in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1456
• Update maester.dev powershell docs by @github-actions[bot] in #1446
• Auto-update report template by @github-actions[bot] in #1455
• Fix MT.1005 to exclude Agent Identity CA policies and add tests for Agent ID and Service Principals by @bubbletroubles in #1386
• chore(deps): bump the npm_and_yarn group across 2 directories with 1 update by @dependabot[bot] in #1459
• chore(deps-dev): bump minimatch from 3.1.2 to 3.1.4 in /report in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1463
• Fix custom config loading for unix and add tests by @fflaten in #1460
• chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in #1467
• chore(deps): bump actions/download-artifact from 7 to 8 by @dependabot[bot] in #1468
• Optimize Test-MtCisSharedMailboxSignIn.ps1 by @ricmestre in #1440
• Fix MT.1056 null parameter binding error when Azure root scope query returns null by @Copilot in #1478
• Fix MT.1073: Add OnPremDirectorySynchronization.Read.All scope and graceful 403 handling by @Copilot in #1477
• Fix formatting in privilegedPermissions.md by @SamErde in #1480
• chore(deps): bump actions/setup-node from 6.2.0 to 6.3.0 by @dependabot[bot] in #1475
• chore(deps): bump the npm_and_yarn group across 2 directories with 4 updates by @dependabot[bot] in #1470
• Fix for code scanning alert no. 136: Workflow does not contain permissions by @SamErde in #1483
• Fix for code scanning alert no. 108: Incomplete string escaping or encoding by @SamErde in #1482
• chore(deps): bump the npm_and_yarn group across 2 directories with 3 updates by @dependabot[bot] in #1481
• Refactor version check to prevent delays and NuGet prompts by @SamErde in #1479
• fix: correct env var typo MEASTER_FOLDER_DRIFT -> MAESTER_FOLDER_DRIFT by @kayasax in #1493
• Refactor hasPolicies check for approval policies by @DanielBradley1 in #1491
• ci: Update GitHub Actions workflow for module docs by @SamErde in #1505
• ci: Pin action to commit SHA in update-tag-documentation.yml by @SamErde in #1504
• Update build-docs workflow to use pinned actions by @SamErde in #1506
• Update and pin action version in build-report.yaml by @SamErde in #1507
• Pin GitHub actions to specific version in publish-module-preview by @SamErde in #1508
• ci: Pin action to commit SHA in publish-module by @SamErde in #1509
• chore(deps): bump dorny/paths-filter from 3.0.2 to 4.0.1 by @dependabot[bot] in #1488
• chore(deps): bump dorny/test-reporter from 2 to 3 by @dependabot[bot] in #1502
• chore(deps-dev): bump Node.js from 18 to 20 to ensure compatibility across modules and dependencies by @dependabot[bot] in #1500
• chore(deps): bump actions/setup-node from 3.8.2 to 6.3.0 by @dependabot[bot] in #1489
• Build report by @SamErde in #1514
• Auto-update report template by @github-actions[bot] in #1511
• chore(deps): bump the npm_and_yarn group across 2 directories with 1 update by @dependabot[bot] in #1515
• docs: add warning about known issue with ExchangeOnlineManagement v3.9.2 by @SamErde in #1517
• Readme by @SamErde in #1518
• Dependency management by @SamErde in #1519
• chore(deps): bump actions/checkout from 6.0.0 to 6.0.2 by @dependabot[bot] in #1520
• chore(deps): bump the icons group in /report with 2 updates by @dependabot[bot] in #1522
• chore(deps): bump the icons group in /website with 5 updates by @dependabot[bot] in #1523
• chore(deps): bump the minor-and-patch group in /report with 4 updates by @dependabot[bot] in #1528
• chore(deps): bump the minor-and-patch group across 1 directory with 2 updates by @dependabot[bot] in #1524
• Remove npm audit step from build report workflow by @SamErde in #1536
• Fix pinned SHA for dorny/test-reporter by @SamErde in #1537
• chore(deps): bump yaml from 2.7.0 to 2.8.3 in /report in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1516
• chore(deps): bump @headlessui/react from 2.2.0 to 2.2.9 in /report in the ui-components group by @dependabot[bot] in #1521
• chore(deps): bump clsx from 1.2.1 to 2.1.1 in /website by @dependabot[bot] in #1525
• chore(deps): bump the typescript-tooling group across 1 directory with 3 updates by @dependabot[bot] in #1526
• chore(deps): bump react-markdown from 9.1.0 to 10.1.0 in /report by @dependabot[bot] in #1529
• chore(deps): bump react-dom from 18.3.1 to 19.2.4 in /website by @dependabot[bot] in #1530
• chore(deps): bump react from 18.3.1 to 19.2.4 in /website by @dependabot[bot] in #1527
• chore(deps): bump tailwind-merge from 2.6.0 to 3.5.0 in /report by @dependabot[bot] in #1534
• chore(deps): bump react-dom and @types/react-dom in /report by @dependabot[bot] in #1532
• chore(deps): bump @vitejs/plugin-react from 4.7.0 to 6.0.1 in /report by @dependabot[bot] in #1531
• chore(deps): bump react and @types/react in /report by @dependabot[bot] in #1533
• chore(deps): bump vite from 6.4.1 to 8.0.3 in /report by @dependabot[bot] in #1535
• Fix missing permission check by @nicolonsky in #1465
• Major version dependency updates by @SamErde in #1541
• Fix container image and resync package lock files by @SamErde in #1544
• deps: use full commit SHA for pinned deps by @SamErde in #1547
• Make fully featured dev container easier to get started with by @SamErde in #1471
• Update authentication examples to OAuth token-based method by @SebastianClaesson in #1495
• chore(deps): bump @types/node from 24.12.0 to 25.5.0 in /report in the typescript-tooling group by @dependabot[bot] in #1552
• chore(deps): bump tailwind-variants from 0.3.1 to 3.2.2 in /report by @dependabot[bot] in #1553
• chore(deps): bump react-dom and @types/react-dom in /report by @dependabot[bot] in #1555
• chore(deps): bump shadcn from 3.8.5 to 4.1.1 in /report by @dependabot[bot] in #1556
• Move all comment-based help headers inside function bodies by @SamErde in #1568
• chore(deps): bump react and @types/react in /report by @dependabot[bot] in #1554
• chore(deps): bump tailwindcss from 3.4.19 to 4.2.2 in /report by @dependabot[bot] in #1557
• Feature/azdo by @SebastianClaesson in #1371
• Add CIS tests by @oed-metzb in #1432
• Update maester.dev powershell docs by @github-actions[bot] in #1573
• Fix report dependencies and broken link in blog by @SamErde in #1574
• Fix Azure DevOps test consistency across blog, config, and test files by @SebastianClaesson in #1577
• Add support for Microsoft Exo Hybrid domain in DKIM by @brianreidc7 in #1464
• Add Copilot Studio support to Maester by @lnfernux in #1441
• Suppress PSUseSingularNouns for AI agent test functions by @SamErde in #1591
• chore(deps): bump vite from 8.0.3 to 8.0.5 in /report by @dependabot[bot] in #1587
• chore(deps): bump the typescript-tooling group across 1 directory with 2 updates by @dependabot[bot] in #1588
• chore(deps): bump react-router-dom from 7.13.2 to 7.14.0 in /report by @dependabot[bot] in #1590
• chore(deps): bump tailwindcss from 3.4.19 to 4.2.2 in /report by @dependabot[bot] in #1589
• chore(deps): bump lodash from 4.17.23 to 4.18.1 in /report by @dependabot[bot] in #1596
• chore(deps): bump lodash from 4.17.23 to 4.18.1 in /website by @dependabot[bot] in #1597
• fix: Resolve report build issues and 4 CodeQL security alerts in report bundle by @SamErde in #1601
• chore(deps): bump @hono/node-server from 1.19.12 to 1.19.13 in /report by @dependabot[bot] in #1605
• chore(deps): bump hono from 4.12.9 to 4.12.12 in /report by @dependabot[bot] in #1606
• Feature/multi tenant report by @SebastianClaesson in #1558
• Add MT.1123 - BitLocker Full Disk Encryption Check by @OfirGavish in #1583
• Update maester.dev powershell docs by @github-actions[bot] in #1593
• Update logic for AS04 check in EIDSCA and format of cmdlet header by @Cloud-Architekt in #1584
• Update maester.dev powershell docs by @github-actions[bot] in #1618
• Auto-update report template by @github-actions[bot] in #1619
• Update docs to the descriptions in Foundations document to streamline all of them and reference to CIS Microsoft 365 Foundations Benchmark v6.0.1 in Tests by @Mynster9361 in #1585
• New Skill: Maester Test Expert by @SamErde in #1608
• Update maester.dev powershell docs by @github-actions[bot] in #1620
• Update MTD Connector IDs and Names by @Mynster9361 in #1614
• Test-MtCaGroupsRestricted ignores report-only Conditional Access policies by @mrdos010 in #1607
• Feature/azdo tests update by @SebastianClaesson in #1604
• Update maester.dev powershell docs by @github-actions[bot] in #1621
• Clarify Maester build report workflow and make it less noisy by @SamErde in #1622
• chore(deps): bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 by @dependabot[bot] in #1625
• chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in #1626
• chore(deps): bump follow-redirects from 1.15.11 to 1.16.0 in /website by @dependabot[bot] in #1638
• chore(deps): pin tailwindcss to v3.x, consolidate safe dependency updates in /report by @Copilot in #1640
• chore(website): update Docusaurus to 3.10.0, React to 19.2.5, and fix build issues by @Copilot in #1641
• Fix DMARC domain regex to handle hyphenated domain names by @Copilot in #1645
• Create a build script for all functions in a consolidated PSM1 file by @SamErde in #1586
• Fix typo in Bitbucket repository setup instructions by @SamErde in #1653
• ci: add PR-triggered website build validation by @SamErde in #1654
• Simplify example command to update Maester tests by @SamErde in #1655
• fix: replace %TestResult% placeholder in Test-MtCisaUnmanagedRoleAssignment by @Copilot in #1652
• Fix long org names overflowing sidebar header in HTML report by @Copilot in #1648
• Fix CISA.MS.AAD.1.1 to require legacy auth blocking policy scoped to all cloud apps by @Copilot in #1651
• Fix ORCA.110 to check EnableInternalSenderNotifications instead of EnableInternalSenderAdminNotifications by @Copilot in #1650
• Add severity info to markdown report output by @Copilot in #1647
• Update maester.dev powershell docs by @github-actions[bot] in #1649
• chore(deps): bump hono from 4.12.12 to 4.12.14 in /report by @dependabot[bot] in #1660
• Fix MT.1014: accept policies with compliantDevice OR domainJoinedDevice by @Copilot in #1646
• chore(deps): bump dompurify from 3.3.3 to 3.4.0 in /website by @dependabot[bot] in #1661
• chore(deps): bump @fortawesome/react-fontawesome from 3.3.0 to 3.3.1 in /website in the icons group by @dependabot[bot] in #1671
• chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by @dependabot[bot] in #1669
• chore(deps): bump the minor-and-patch group in /report with 4 updates by @dependabot[bot] in #1673
• chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 by @dependabot[bot] in #1670
• Fix copilot sync mail test results by @Mynster9361 in #1664
• updated exchange test to reflect it aligns with cis test 6.5.3 by @Mynster9361 in #1674
• Removed extensibility property which is not longer supported. by @brianveldman in #1678
• chore(deps): bump the typescript-tooling group across 1 directory with 2 updates by @dependabot[bot] in #1672
• Fix MT.1020: Support new OnPremisesDirectorySyncAccount role and service principal-based sync by @Mynster9361 in #1666
• chore(report): Remove unused dependencies and dead code by @SamErde in #1681
• chore(deps): bump postcss from 8.5.9 to 8.5.10 in /website by @dependabot[bot] in #1682
• fix: Remove invalid TimeGenerated column from OAuthAppInfo KQL projection (MT.1077-MT.1081) by @SamErde in #1683
• MtRoleInfo Automatic Updates md docs parsing by @Mynster9361 in #1665
• Automatically update MtRoleInfo and create an ArgumentCompleter for Role parameter validation by @SamErde in #1624
• Refine module build script and source manifest by @SamErde in #1663
• Updated community files for easier contributions by @SamErde in #1639
• fix: correct NotRunCount and InvestigateCount variable references in mail/Teams alerts by @SamErde in #1686
• fix: follow-up issues from MtRoleInfo auto-update (PRs #1624 / #1665) by @SamErde in #1685
• fix: prevent emergency access group loop when large group is auto-detected (#1227) by @SamErde in #1687
• Fix: Silently skip external GDAP groups in global admin role member checks by @SamErde in #1688
• Fix: Improve 404 detection to use Response.StatusCode (follow-up to #1688) by @SamErde in #1689
• ci: fix token-permissions code scanning findings by @SamErde in #1690
• fix: strip blockquote prefixes when parsing 'All roles' table in update-role-definitions workflow by @SamErde in #1691
• Improve MT.1058 result output formatting by @SamErde in #1696
• fix: preserve renamed Entra role compatibility aliases by @SamErde in #1697
• added investigate to the ui and skipped the places it was missing by @Mynster9361 in #1659
• Add MT.1147 check and improve Graph user filtering by @f-bader in #1693
• feat(report): add direct linking to individual test results via URL by @SamErde in #1699
• rebuilt the reporttemplate by @Mynster9361 in #1701
• fix(MT.1024): unwrap OData .value array from Graph response to fix malformed test name by @SamErde in #1702
• Fix for #1609 - AZDO tests not skipping by @merill in #1700
• chore(deps): bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 by @dependabot[bot] in #1705
• Added MDE Support by @bdrogja in #1017
• chore(deps): bump lucide-react from 1.8.0 to 1.11.0 in /report in the icons group by @dependabot[bot] in #1706
• Update maester.dev powershell docs by @github-actions[bot] in #1704
• chore(deps): bump vite from 8.0.9 to 8.0.10 in /report in the minor-and-patch group by @dependabot[bot] in #1707
• chore(deps): bump react-router-dom from 7.14.1 to 7.14.2 in /report by @dependabot[bot] in #1708
• Update maester.dev powershell docs by @github-actions[bot] in #1712
• security: add SECURITY.md and explicit CodeQL workflow by @SamErde in #1710
• fix: skip CIS.M365.1.3.6 when CustomerLockbox license is not available by @Copilot in #1716
• Blog post for 2.1.0 by @merill in #1720

New Contributors

• @mrdos010 made their first contribution in #1389
• @dreadsend made their first contribution in #1395
• @oed-metzb made their first contribution in #1413
• @alexandair made their first contribution in #1437
• @nicowyss made their first contribution in #1381
• @ricmestre made their first contribution in #1440
• @kayasax made their first contribution in #1493
• @lnfernux made their first contribution in #1441
• @OfirGavish made their first contribution in #1583
• @Mynster9361 made their first contribution in #1585
• @bdrogja made their first contribution in #1017

Full Changelog: 2.0.0...2.1.0