Branding fix conditional access no acronyms - #2046
Conversation
📝 WalkthroughWalkthroughThis PR standardizes “Conditional Access” terminology across PowerShell help, test metadata, rendered results, current documentation, and versioned documentation. It also updates related markdown formatting and adds IPv4/IPv6 IP-fencing guidance. ChangesConditional Access terminology and documentation
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ast-grep (0.45.0)powershell/assets/ReportTemplate.htmlast-grep timed out on this file Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Up to standards ✅🟢 Issues
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
Note
Due to the large number of review comments, Critical, Major severity comments were prioritized as inline comments.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
powershell/public/maester/entra/Test-MtCaExclusionForDirectorySyncAccount.ps1 (1)
54-60: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winUpdate the service-principal CA claim for ABA sync accounts.
Conditional Access can apply to workload identities/service principals under Entra Workload ID Premium. Narrow the comment/test output to this check’s current scope, e.g., “user-scoped policies,” or make workload-identity coverage intentionally out of scope. Also updates the “no CA exclusions are required” result at lines 54-66 and 120-124.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@powershell/public/maester/entra/Test-MtCaExclusionForDirectorySyncAccount.ps1` around lines 54 - 60, Update the service-principal classification and related assertions in Test-MtCaExclusionForDirectorySyncAccount so the check explicitly covers only user-scoped Conditional Access policies, or intentionally excludes workload-identity coverage. Revise the comments, test output, and “no CA exclusions are required” results to avoid claiming service principals are never subject to Conditional Access, while preserving the existing user-account behavior.website/docs/tests/maester/readme.md (1)
140-140: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winAvoid raw angle-bracket GFM email syntax in Docusaurus MDX docs.
website/docs/tests/readme.md:140contains<reports@dmarc.cyber.dhs.gov>, and the versioned copy has the same string; MDX can parse this as JSX rather than Markdown/link text. Replace it with plain email text or an explicitmailto:link.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@website/docs/tests/maester/readme.md` at line 140, Update the affected Docusaurus MDX readme content, including the versioned copy, to replace raw angle-bracket email syntax such as <reports@dmarc.cyber.dhs.gov> with plain email text or an explicit mailto link; preserve the surrounding documentation text and formatting.Source: MCP tools
🟡 Minor comments (13)
build/aitools/test-metadata/test-results.json-10258-10258 (1)
10258-10258: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winFix the grammar in the test description.
Use “Modifying group membership outside of Conditional Access Administrator or other privileged roles can lead to bypassing Conditional Access policies.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@build/aitools/test-metadata/test-results.json` at line 10258, Update the TestDescription entry for the Conditional Access group protection test to replace “Modify group membership” with the grammatically correct “Modifying group membership,” preserving the rest of the description unchanged.report/src/lib/testResults.ts-4189-4189 (1)
4189-4189: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winStandardize Conditional Access branding in rendered results.
Both messages retain lowercase
conditional access, contrary to the title-cased terminology used by this PR.
report/src/lib/testResults.ts#L4189-L4189: change the MT.1001 rendered label toConditional Access.report/src/lib/testResults.ts#L4352-L4352: change the MT.1005 rendered label toConditional Access.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@report/src/lib/testResults.ts` at line 4189, Standardize the rendered Conditional Access labels in both MT.1001 at report/src/lib/testResults.ts:4189-4189 and MT.1005 at report/src/lib/testResults.ts:4352-4352 by replacing lowercase “conditional access” with title-cased “Conditional Access”; make no other changes.powershell/public/cis/Test-MtCisDevicesWithoutCompliancePolicyMarked.md-15-17 (1)
15-17: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winState the final setting value explicitly.
The revised guidance names Mark devices with no compliance policy assigned as but does not say which value to select. Clarify that the setting should be set to Not compliant before enabling Conditional Access policies that enforce compliance actions.
Suggested wording
-After the environment's device compliance is better understood it is then appropriate to finally align with **Mark devices with no compliance policy assigned as** and enable any Conditional Access policies that enforce actions based on device compliance. +After the environment's device compliance is better understood, set **Mark devices with no compliance policy assigned as** to **Not compliant**, then enable Conditional Access policies that enforce actions based on device compliance.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@powershell/public/cis/Test-MtCisDevicesWithoutCompliancePolicyMarked.md` around lines 15 - 17, Update the guidance in Test-MtCisDevicesWithoutCompliancePolicyMarked to explicitly instruct users to set “Mark devices with no compliance policy assigned as” to “Not compliant” before enabling Conditional Access policies that enforce device-compliance actions.powershell/public/cisa/entra/Test-MtCisaBlockLegacyAuth.ps1-12-12 (1)
12-12: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winAlign the help text with the actual success condition.
Line 12 says one or more policies are sufficient, but
$testResultbecomes true only when both legacy-auth client-app categories are covered. Document that requirement or change the implementation.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@powershell/public/cisa/entra/Test-MtCisaBlockLegacyAuth.ps1` at line 12, Update the help text for Test-MtCisaBlockLegacyAuth to state that the result is true only when Conditional Access policies block both legacy-auth client-app categories, matching the existing $testResult success condition.powershell/public/maester/entra/Test-MtCaReferencedGroupsExist.ps1-7-9 (1)
7-9: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winCorrect the deleted-group sentence.
Use “Assignments remain visible in Microsoft Graph even if a group is deleted.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@powershell/public/maester/entra/Test-MtCaReferencedGroupsExist.ps1` around lines 7 - 9, Update the introductory documentation in Test-MtCaReferencedGroupsExist to replace the deleted-group sentence with “Assignments remain visible in Microsoft Graph even if a group is deleted.”powershell/public/maester/entra/Test-MtCaWIFBlockLegacyAuthentication.md-1-1 (1)
1-1: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winFix subject–verb agreement.
Change “Conditional Access policies ... is active and used” to “Conditional Access policies ... are active and used.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@powershell/public/maester/entra/Test-MtCaWIFBlockLegacyAuthentication.md` at line 1, Update the introductory description in Test-MtCaWIFBlockLegacyAuthentication so “Conditional Access policies” uses the plural verb “are,” producing “are active and used.”website/docs/commands/Test-MtCaGroupsRestricted.mdx-23-27 (1)
23-27: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winPolish the remediation guidance grammar.
Use “Modifying group membership outside of Conditional Access Administrator or other privileged roles can lead to bypassing Conditional Access policies” and “Role-assignable groups should be used in combination with assignments to Entra ID roles.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@website/docs/commands/Test-MtCaGroupsRestricted.mdx` around lines 23 - 27, Update the remediation guidance prose in Test-MtCaGroupsRestricted: change “Modify group membership” to “Modifying group membership,” and revise “Role Assignable Group should be used in combination of assignments” to “Role-assignable groups should be used in combination with assignments,” preserving the surrounding guidance.website/docs/tests/maester/MT.1033.md-3-3 (1)
3-3: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winUse the plural verb for “policies.”
Both changed descriptions say “Conditional Access policies ... is active”; change this to “Conditional Access policies ... are active and used.”
Also applies to: 26-26
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@website/docs/tests/maester/MT.1033.md` at line 3, Update the descriptions in the affected entries, including MT.1033 and the additionally referenced entry, to use “are active and used” after “Conditional Access policies” instead of “is active and used.”website/versioned_docs/version-2.2.0/tests/readme.md-140-140 (1)
140-140: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winEscape the angle brackets if they are intended to be visible.
Raw
<reports@dmarc.cyber.dhs.gov>is parsed as an email autolink, so rendered markdown will show a mailto link without visible brackets. Use<reports@dmarc.cyber.dhs.gov>if the brackets need to remain in the UI.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@website/versioned_docs/version-2.2.0/tests/readme.md` at line 140, Update the CISA.MS.EXO.4.3 table entry so the reports email address uses escaped angle brackets, preserving the brackets visibly in rendered Markdown instead of creating an email autolink.website/versioned_docs/version-2.2.0/tests/maester/MT.1033.md-3-3 (1)
3-3: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winFix subject–verb agreement in the MT.1033 wording.
Because the subject is plural (
policies), both descriptions should sayare active and used.Proposed fix
-description: "Checks if the Conditional Access policies for blocking legacy authentication is active and used. See Block legacy authentication - Microsoft Learn" +description: "Checks if the Conditional Access policies for blocking legacy authentication are active and used. See Block legacy authentication - Microsoft Learn" ... -Checks if the Conditional Access policies for blocking legacy authentication is active and used. +Checks if the Conditional Access policies for blocking legacy authentication are active and used.Also applies to: 26-26
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@website/versioned_docs/version-2.2.0/tests/maester/MT.1033.md` at line 3, Update the MT.1033 description wording so the plural subject “Conditional Access policies” uses “are active and used” instead of “is active and used.” Apply the same correction to the additional matching occurrence.website/versioned_docs/version-2.2.0/contributing.md-131-131 (1)
131-131: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winAdd the period after
etc.Change
etc)toetc.)in this user-facing checklist sentence.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@website/versioned_docs/version-2.2.0/contributing.md` at line 131, Update the checklist sentence containing “multiple objects” so the parenthetical example ends with “etc.)” rather than “etc)”, preserving the rest of the text unchanged.Source: Linters/SAST tools
website/versioned_docs/version-2.2.0/tests/maester/MT.1050.md-69-69 (1)
69-69: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winUse the correct heading level for Remediation action.
This heading jumps from
##to####; use### Remediation actionto preserve document hierarchy and accessibility.Proposed fix
-#### Remediation action +### Remediation action🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@website/versioned_docs/version-2.2.0/tests/maester/MT.1050.md` at line 69, Update the “Remediation action” heading in MT.1050.md from level four to level three, using `### Remediation action` to preserve the document hierarchy.Source: Linters/SAST tools
website/docs/writing-tests/formatting-test-results.md-169-169 (1)
169-169: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winHyphenate “out-of-the-box”.
Use “out-of-the-box” in this sentence for correct compound-adjective formatting.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@website/docs/writing-tests/formatting-test-results.md` at line 169, Update the sentence introducing the alternative Maester cmdlet version to hyphenate “out-of-the-box” when it modifies “Maester cmdlets.”Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@build/aitools/test-metadata/test-results.json`:
- Line 7909: Redact real tenant and emergency-access details from the generated
TestResult metadata in build/aitools/test-metadata/test-results.json at lines
7909 and 10335, replacing user names, GUIDs, directory locations, and Entra CA
policy links with anonymized fixtures or placeholders while preserving the
metadata structure.
In `@website/docs/commands/Test-AzdoEnforceAADConditionalAccess.mdx`:
- Around line 23-24: Update the source PowerShell command/help text used by
build/Update-CommandReference.ps1 rather than editing
Test-AzdoEnforceAADConditionalAccess.mdx directly, then run the
command-reference generation pipeline to regenerate the documentation file with
the wording change.
In `@website/docs/commands/Test-MtCaReferencedGroupsExist.mdx`:
- Around line 23-25: Update the PowerShell help/source for
Test-MtCaReferencedGroupsExist and Test-MtCisaBlockLegacyAuth, then regenerate
both command references:
website/docs/commands/Test-MtCaReferencedGroupsExist.mdx lines 23-25 and
website/docs/commands/Test-MtCisaBlockLegacyAuth.mdx line 33. Do not edit the
generated MDX files directly.
In
`@website/versioned_docs/version-2.2.0/commands/Test-AzdoEnforceAADConditionalAccess.mdx`:
- Line 24: Update the comment-based help/source for the cmdlets
Test-AzdoEnforceAADConditionalAccess, Test-MtCaGroupsRestricted,
Test-MtCaReferencedGroupsExist, Test-MtCisaBlockLegacyAuth,
Test-MtCisaManagedDevice, Test-MtCisaMfa, Test-MtCisaPhishResistant, and
Test-MtCisaPrivilegedPhishResistant, then regenerate the affected documentation.
Do not edit generated files directly:
website/versioned_docs/version-2.2.0/commands/Test-AzdoEnforceAADConditionalAccess.mdx#L24-L24,
Test-MtCaGroupsRestricted.mdx#L23-L28,
Test-MtCaReferencedGroupsExist.mdx#L23-L25,
Test-MtCisaBlockLegacyAuth.mdx#L33-L33, Test-MtCisaManagedDevice.mdx#L3-L13,
Test-MtCisaMfa.mdx#L3-L13, Test-MtCisaPhishResistant.mdx#L3-L13, and
Test-MtCisaPrivilegedPhishResistant.mdx#L3-L13 require regenerated updates
reflecting the requested descriptions, grammar, wording, return text, and
“phishing-resistant” terminology.
In `@website/versioned_docs/version-2.2.0/commands/Test-MtCisaManagedDevice.mdx`:
- Line 3: Update the source PowerShell cmdlet comment-based help for
Test-MtCisaManagedDevice with both requested wording changes, then regenerate
the versioned command documentation so the generated file reflects those source
updates. Do not edit files under website/versioned_docs/*/commands directly.
In `@website/versioned_docs/version-2.2.0/commands/Test-MtCisaMfa.mdx`:
- Line 3: Update the Test-MtCisaMfa PowerShell cmdlet source or its
comment-based help with the revised description, then regenerate the
corresponding versioned command documentation so the generated file reflects the
change without being edited manually.
In `@website/versioned_docs/version-2.2.0/commands/Test-MtCisaPhishResistant.mdx`:
- Line 3: Update the capitalization in the PowerShell comment-based help/source
for Test-MtCisaPhishResistant, then regenerate the versioned command
documentation so the generated file reflects the source change; do not edit the
versioned MDX file directly.
In
`@website/versioned_docs/version-2.2.0/commands/Test-MtCisaPrivilegedPhishResistant.mdx`:
- Line 3: Update the PowerShell source comment-based help for
Test-MtCisaPrivilegedPhishResistant so its synopsis uses “phishing-resistant
authentication methods,” then regenerate the versioned command documentation
through the standard docs pipeline; do not edit the generated versioned MDX
directly.
---
Outside diff comments:
In
`@powershell/public/maester/entra/Test-MtCaExclusionForDirectorySyncAccount.ps1`:
- Around line 54-60: Update the service-principal classification and related
assertions in Test-MtCaExclusionForDirectorySyncAccount so the check explicitly
covers only user-scoped Conditional Access policies, or intentionally excludes
workload-identity coverage. Revise the comments, test output, and “no CA
exclusions are required” results to avoid claiming service principals are never
subject to Conditional Access, while preserving the existing user-account
behavior.
In `@website/docs/tests/maester/readme.md`:
- Line 140: Update the affected Docusaurus MDX readme content, including the
versioned copy, to replace raw angle-bracket email syntax such as
<reports@dmarc.cyber.dhs.gov> with plain email text or an explicit mailto link;
preserve the surrounding documentation text and formatting.
---
Minor comments:
In `@build/aitools/test-metadata/test-results.json`:
- Line 10258: Update the TestDescription entry for the Conditional Access group
protection test to replace “Modify group membership” with the grammatically
correct “Modifying group membership,” preserving the rest of the description
unchanged.
In `@powershell/public/cis/Test-MtCisDevicesWithoutCompliancePolicyMarked.md`:
- Around line 15-17: Update the guidance in
Test-MtCisDevicesWithoutCompliancePolicyMarked to explicitly instruct users to
set “Mark devices with no compliance policy assigned as” to “Not compliant”
before enabling Conditional Access policies that enforce device-compliance
actions.
In `@powershell/public/cisa/entra/Test-MtCisaBlockLegacyAuth.ps1`:
- Line 12: Update the help text for Test-MtCisaBlockLegacyAuth to state that the
result is true only when Conditional Access policies block both legacy-auth
client-app categories, matching the existing $testResult success condition.
In `@powershell/public/maester/entra/Test-MtCaReferencedGroupsExist.ps1`:
- Around line 7-9: Update the introductory documentation in
Test-MtCaReferencedGroupsExist to replace the deleted-group sentence with
“Assignments remain visible in Microsoft Graph even if a group is deleted.”
In `@powershell/public/maester/entra/Test-MtCaWIFBlockLegacyAuthentication.md`:
- Line 1: Update the introductory description in
Test-MtCaWIFBlockLegacyAuthentication so “Conditional Access policies” uses the
plural verb “are,” producing “are active and used.”
In `@report/src/lib/testResults.ts`:
- Line 4189: Standardize the rendered Conditional Access labels in both MT.1001
at report/src/lib/testResults.ts:4189-4189 and MT.1005 at
report/src/lib/testResults.ts:4352-4352 by replacing lowercase “conditional
access” with title-cased “Conditional Access”; make no other changes.
In `@website/docs/commands/Test-MtCaGroupsRestricted.mdx`:
- Around line 23-27: Update the remediation guidance prose in
Test-MtCaGroupsRestricted: change “Modify group membership” to “Modifying group
membership,” and revise “Role Assignable Group should be used in combination of
assignments” to “Role-assignable groups should be used in combination with
assignments,” preserving the surrounding guidance.
In `@website/docs/tests/maester/MT.1033.md`:
- Line 3: Update the descriptions in the affected entries, including MT.1033 and
the additionally referenced entry, to use “are active and used” after
“Conditional Access policies” instead of “is active and used.”
In `@website/docs/writing-tests/formatting-test-results.md`:
- Line 169: Update the sentence introducing the alternative Maester cmdlet
version to hyphenate “out-of-the-box” when it modifies “Maester cmdlets.”
In `@website/versioned_docs/version-2.2.0/contributing.md`:
- Line 131: Update the checklist sentence containing “multiple objects” so the
parenthetical example ends with “etc.)” rather than “etc)”, preserving the rest
of the text unchanged.
In `@website/versioned_docs/version-2.2.0/tests/maester/MT.1033.md`:
- Line 3: Update the MT.1033 description wording so the plural subject
“Conditional Access policies” uses “are active and used” instead of “is active
and used.” Apply the same correction to the additional matching occurrence.
In `@website/versioned_docs/version-2.2.0/tests/maester/MT.1050.md`:
- Line 69: Update the “Remediation action” heading in MT.1050.md from level four
to level three, using `### Remediation action` to preserve the document
hierarchy.
In `@website/versioned_docs/version-2.2.0/tests/readme.md`:
- Line 140: Update the CISA.MS.EXO.4.3 table entry so the reports email address
uses escaped angle brackets, preserving the brackets visibly in rendered
Markdown instead of creating an email autolink.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 8ce432ab-d97e-47a0-a9b9-13a0cffaad18
📒 Files selected for processing (56)
build/Update-TagsDocumentation.ps1build/aitools/test-metadata/maester-config.jsonbuild/aitools/test-metadata/test-results.jsonpowershell/assets/ReportTemplate.htmlpowershell/public/Get-MtUser.ps1powershell/public/cis/Test-MtCisDevicesWithoutCompliancePolicyMarked.mdpowershell/public/cisa/entra/Test-MtCisaBlockLegacyAuth.ps1powershell/public/maester/azuredevops/Test-AzdoEnforceAADConditionalAccess.mdpowershell/public/maester/azuredevops/Test-AzdoEnforceAADConditionalAccess.ps1powershell/public/maester/entra/Test-MtCaExclusionForDirectorySyncAccount.ps1powershell/public/maester/entra/Test-MtCaGroupsRestricted.mdpowershell/public/maester/entra/Test-MtCaGroupsRestricted.ps1powershell/public/maester/entra/Test-MtCaReferencedGroupsExist.ps1powershell/public/maester/entra/Test-MtCaWIFBlockLegacyAuthentication.mdpowershell/public/maester/entra/Test-MtDeviceRegistrationMfaConflict.ps1powershell/public/maester/entra/Test-MtHighRiskAppPermissions.mdpowershell/tests/functions/Get-MtUser.Tests.ps1powershell/tests/functions/Test-MtCaEnforceNonPersistentBrowserSession.Tests.ps1powershell/tests/functions/Test-MtCaExclusionForDirectorySyncAccount.Tests.ps1report/src/lib/testResults.tstests/Maester/AzureDevOps/Test-Azdo.Tests.ps1tests/Maester/Entra/Test-ConditionalAccessBaseline.Tests.ps1tests/maester-config.jsonwebsite/blog/2026-04-01-azuredevops-tests-maester/index.mdwebsite/docs/commands/Test-AzdoEnforceAADConditionalAccess.mdxwebsite/docs/commands/Test-MtCaGroupsRestricted.mdxwebsite/docs/commands/Test-MtCaReferencedGroupsExist.mdxwebsite/docs/commands/Test-MtCisaBlockLegacyAuth.mdxwebsite/docs/contributing.mdwebsite/docs/tests/cis/CIS.M365.4.1.mdwebsite/docs/tests/maester/MT.1033.mdwebsite/docs/tests/maester/MT.1035.mdwebsite/docs/tests/maester/MT.1050.mdwebsite/docs/tests/maester/MT.1051.mdwebsite/docs/tests/maester/readme.mdwebsite/docs/tests/readme.mdwebsite/docs/writing-tests/formatting-test-results.mdwebsite/src/data/contributors.jsonwebsite/versioned_docs/version-2.2.0/commands/Test-AzdoEnforceAADConditionalAccess.mdxwebsite/versioned_docs/version-2.2.0/commands/Test-MtCaGroupsRestricted.mdxwebsite/versioned_docs/version-2.2.0/commands/Test-MtCaReferencedGroupsExist.mdxwebsite/versioned_docs/version-2.2.0/commands/Test-MtCisaBlockLegacyAuth.mdxwebsite/versioned_docs/version-2.2.0/commands/Test-MtCisaManagedDevice.mdxwebsite/versioned_docs/version-2.2.0/commands/Test-MtCisaMfa.mdxwebsite/versioned_docs/version-2.2.0/commands/Test-MtCisaPhishResistant.mdxwebsite/versioned_docs/version-2.2.0/commands/Test-MtCisaPrivilegedPhishResistant.mdxwebsite/versioned_docs/version-2.2.0/contributing.mdwebsite/versioned_docs/version-2.2.0/tests/cis/CIS.M365.4.1.mdwebsite/versioned_docs/version-2.2.0/tests/eidsca/EIDSCA.AT01.mdwebsite/versioned_docs/version-2.2.0/tests/maester/MT.1033.mdwebsite/versioned_docs/version-2.2.0/tests/maester/MT.1035.mdwebsite/versioned_docs/version-2.2.0/tests/maester/MT.1050.mdwebsite/versioned_docs/version-2.2.0/tests/maester/MT.1051.mdwebsite/versioned_docs/version-2.2.0/tests/maester/readme.mdwebsite/versioned_docs/version-2.2.0/tests/readme.mdwebsite/versioned_docs/version-2.2.0/writing-tests/formatting-test-results.md
👮 Files not reviewed due to content moderation or server errors (1)
- powershell/assets/ReportTemplate.html
| "ResultDetail": { | ||
| "TestTitle": "MT.1005: All Conditional Access policies are configured to exclude at least one emergency/break glass account or group. See https://maester.dev/docs/tests/MT.1005", | ||
| "TestResult": "\nAutomatically detected emergency access user: Merill Fernando (513f3db2-044c-41be-af14-431bf88a2b3e)\n\nThese conditional access policies don't have the emergency access user excluded:\n\n - [SharePoint - DLP Unmanaged devices](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/2fb9f832-9af7-4ad9-8468-30035ad62a7e)\n - [ACSC - L2](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/dd4e567d-47ae-4d1f-acaa-6d4ff1cd14e4)\n - [O365](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/31181d5c-dd6b-4679-aea2-e6f0ad30757a)\n - [Register device](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/c9d0080b-86e0-464a-9e25-8ca4e186fb5a)\n - [nestedgroup count](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/9e6a9793-e3ae-451e-9011-0a9bbbcfdc9b)\n - [App Protect - Mobiles :Disabled: This policy caused outage on Android devices for Outlook users. Needs further investigation to identify root cause.](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/5a5ee06f-4164-4112-9960-fe0903c2ccee)\n - [MFA CA Policy](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/e589544c-0c92-432e-86ae-4e4ef103eac8)\n - [Force Password Change](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/5848211d-96f2-40ae-92a4-af1aa8f48572)\n - [No persistence](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/ff9b569d-329f-4d8b-a984-b8da833e19ea)\n - [Require multifactor authentication for Microsoft admin portals](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/db73ea6f-4017-4b04-97e9-c5f6fedec0d0)\n - [j-test admin](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/6c0ef46a-3b58-43a9-b451-7464a16d91d7)\n - [Device compliancy](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/206c9071-89d7-4b57-adaf-87f78a4bd7f5)\n - [Device compliance #1](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/2965e1d4-6146-41a5-abae-5219abf7d68f)\n - [Guest 10 hr MFA](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/bcc1a12e-c68d-419e-a6c4-6d4bdfa8bfc8)\n - [Guest-Meferna-Woodgrove-PhishingResistantAuthStrength](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/0f0a0c1c-41b0-4c18-ae20-d02492d03737)\n - [Unmanaged Device - Admin Portal Block](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/b86b671e-e018-46a2-a518-fb653c08ac33)\n - [AzMfa Test (Require MFA for Az Portal)](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/afd8693b-f802-4b5a-bb40-e8b1d952dd99)\n - [NewphishingCA](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/3fe49849-5ab6-4717-a22d-aa42536eb560)\n - [mytest2](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/c2f265b0-a106-45fc-aa6d-f1da74110854)\n - [Block DCF](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/b5ff217b-3d84-4581-bd92-5d8f8b8bab6a)\n - [testdevicereg21872](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/620a9c5c-09c4-4558-a0fe-7fc8b3540992)\n", | ||
| "TestResult": "\nAutomatically detected emergency access user: Merill Fernando (513f3db2-044c-41be-af14-431bf88a2b3e)\n\nThese conditional access policies don't have the emergency access user excluded:\n\n - [SharePoint - DLP Unmanaged devices](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/2fb9f832-9af7-4ad9-8468-30035ad62a7e)\n - [ACSC - L2](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/dd4e567d-47ae-4d1f-acaa-6d4ff1cd14e4)\n - [O365](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/31181d5c-dd6b-4679-aea2-e6f0ad30757a)\n - [Register device](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/c9d0080b-86e0-464a-9e25-8ca4e186fb5a)\n - [nestedgroup count](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/9e6a9793-e3ae-451e-9011-0a9bbbcfdc9b)\n - [App Protect - Mobiles :Disabled: This policy caused outage on Android devices for Outlook users. Needs further investigation to identify root cause.](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/5a5ee06f-4164-4112-9960-fe0903c2ccee)\n - [MFA Conditional Access policy](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/e589544c-0c92-432e-86ae-4e4ef103eac8)\n - [Force Password Change](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/5848211d-96f2-40ae-92a4-af1aa8f48572)\n - [No persistence](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/ff9b569d-329f-4d8b-a984-b8da833e19ea)\n - [Require multifactor authentication for Microsoft admin portals](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/db73ea6f-4017-4b04-97e9-c5f6fedec0d0)\n - [j-test admin](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/6c0ef46a-3b58-43a9-b451-7464a16d91d7)\n - [Device compliancy](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/206c9071-89d7-4b57-adaf-87f78a4bd7f5)\n - [Device compliance #1](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/2965e1d4-6146-41a5-abae-5219abf7d68f)\n - [Guest 10 hr MFA](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/bcc1a12e-c68d-419e-a6c4-6d4bdfa8bfc8)\n - [Guest-Meferna-Woodgrove-PhishingResistantAuthStrength](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/0f0a0c1c-41b0-4c18-ae20-d02492d03737)\n - [Unmanaged Device - Admin Portal Block](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/b86b671e-e018-46a2-a518-fb653c08ac33)\n - [AzMfa Test (Require MFA for Az Portal)](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/afd8693b-f802-4b5a-bb40-e8b1d952dd99)\n - [NewphishingCA](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/3fe49849-5ab6-4717-a22d-aa42536eb560)\n - [mytest2](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/c2f265b0-a106-45fc-aa6d-f1da74110854)\n - [Block DCF](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/b5ff217b-3d84-4581-bd92-5d8f8b8bab6a)\n - [testdevicereg21872](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/620a9c5c-09c4-4558-a0fe-7fc8b3540992)\n", |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== file stats =="
wc -l build/aitools/test-metadata/test-results.json
echo "== surrounding snippets =="
sed -n '7888,7928p' build/aitools/test-metadata/test-results.json
printf '\n---\n'
sed -n '10320,10350p' build/aitools/test-metadata/test-results.json
echo "== nearby generated/test-metadata files =="
find build/aitools/test-metadata -maxdepth 2 -type f -print | sortRepository: maester365/maester
Length of output: 14298
🌐 Web query:
Microsoft Entra Conditional Access policy ExcludesUsers property Emergency Access account
💡 Result:
To protect against administrator lockout due to policy misconfiguration or authentication service disruptions, Microsoft strongly recommends excluding emergency access (break-glass) accounts from all Conditional Access (CA) policies that block or restrict sign-in [1][2][3]. Best Practices for Managing Exclusions: 1. Use Security Groups: Instead of excluding individual user accounts, create a dedicated security group (e.g., EmergencyAccess) and add your emergency access accounts to it [1][4]. Reference this group in the Exclude list of your Conditional Access policies [4][5]. This prevents you from forgetting to update individual policies when new ones are created [4]. 2. Descriptive Documentation: Add a clear description to the exclusion group (e.g., "Excluded from all CA policies; reviewed annually") [4]. This provides necessary context for auditors and administrators regarding why these accounts bypass security controls [4]. 3. Monitor and Audit: Regularly review your exclusion groups, potentially using Microsoft Entra Access Reviews, to ensure membership remains correct and authorized [4][6]. 4. Policy Exclusions vs. Report-Only: Report-only policies do not block access, so they do not require specific exclusions for emergency access accounts [1]. However, any policy that enforces MFA, device compliance, or blocks access must exclude these accounts to ensure they remain usable during the exact emergency scenarios for which they were created [1][7][8]. 5. Testing: Periodically test (e.g., quarterly) that your emergency access accounts can successfully sign in while your current Conditional Access policies are active [1][3]. For further guidance, consult the official Microsoft documentation on managing emergency access accounts in Microsoft Entra ID [1].
Citations:
- 1: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access
- 2: https://learn.microsoft.com/en-us/entra/identity/conditional-access/plan-conditional-access
- 3: https://learn.microsoft.com/en-gb/entra/identity/conditional-access/plan-conditional-access
- 4: https://www.tiagoscarvalho.com/azure-entra-id/conditional-access-break-glass-accounts-2026
- 5: https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-example
- 6: https://learn.microsoft.com/en-us/entra/id-governance/conditional-access-exclusion
- 7: https://learn.microsoft.com/en-us/training/modules/plan-implement-privileged-access/9-create-manage-emergency-access-accounts
- 8: https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/identity/RMI_150
Redact the generated test metadata before merging.
test-results.json contains real tenant identity details, user GUIDs, directory locations, emergency/break-glass account information, and Entra CA policy links. These should not be committed as generated artifact data; use anonymized fixtures or placeholders for committed metadata.
📍 Affects 1 file
build/aitools/test-metadata/test-results.json#L7909-L7909(this comment)build/aitools/test-metadata/test-results.json#L10335-L10335
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@build/aitools/test-metadata/test-results.json` at line 7909, Redact real
tenant and emergency-access details from the generated TestResult metadata in
build/aitools/test-metadata/test-results.json at lines 7909 and 10335, replacing
user names, GUIDs, directory locations, and Entra CA policy links with
anonymized fixtures or placeholders while preserving the metadata structure.
| Checks the status of when you sign in to the web portal of a Microsoft Entra ID-backed organization, | ||
| Microsoft Entra ID always performs validation for any Conditional Access Policies (CAPs) set by tenant administrators. | ||
| Microsoft Entra ID always performs validation for any Conditional Access policies set by tenant administrators. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Regenerate this command documentation instead of editing it manually.
website/docs/commands/*.mdx is generated by build/Update-CommandReference.ps1. Keep the wording change in the PowerShell source/help and regenerate this file, otherwise the next documentation build can overwrite it. As per path instructions, generated command documentation must be updated through its source and documentation pipeline.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@website/docs/commands/Test-AzdoEnforceAADConditionalAccess.mdx` around lines
23 - 24, Update the source PowerShell command/help text used by
build/Update-CommandReference.ps1 rather than editing
Test-AzdoEnforceAADConditionalAccess.mdx directly, then run the
command-reference generation pipeline to regenerate the documentation file with
the wording change.
Source: Path instructions
| Security Groups will be used to exclude and include users from Conditional Access policies. | ||
| Assignments are still visible in the policy definition in Microsoft Graph API even the group is deleted. | ||
| This test checks if all groups used in Conditional Access Policies still exist and shows invalid or deleted items. | ||
| This test checks if all groups used in Conditional Access policies still exist and shows invalid or deleted items. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Regenerate both command references from their PowerShell sources.
These files are generated artifacts, so direct edits can be overwritten by the documentation pipeline.
website/docs/commands/Test-MtCaReferencedGroupsExist.mdx#L23-L25: update the corresponding PowerShell help/source and regenerate this command reference.website/docs/commands/Test-MtCisaBlockLegacyAuth.mdx#L33-L33: update the corresponding PowerShell help/source and regenerate this command reference.
As per coding guidelines and path instructions, generated command documentation must not be manually edited.
📍 Affects 2 files
website/docs/commands/Test-MtCaReferencedGroupsExist.mdx#L23-L25(this comment)website/docs/commands/Test-MtCisaBlockLegacyAuth.mdx#L33-L33
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@website/docs/commands/Test-MtCaReferencedGroupsExist.mdx` around lines 23 -
25, Update the PowerShell help/source for Test-MtCaReferencedGroupsExist and
Test-MtCisaBlockLegacyAuth, then regenerate both command references:
website/docs/commands/Test-MtCaReferencedGroupsExist.mdx lines 23-25 and
website/docs/commands/Test-MtCisaBlockLegacyAuth.mdx line 33. Do not edit the
generated MDX files directly.
Sources: Coding guidelines, Path instructions
|
|
||
| Checks the status of when you sign in to the web portal of a Microsoft Entra ID-backed organization, | ||
| Microsoft Entra ID always performs validation for any Conditional Access Policies (CAPs) set by tenant administrators. | ||
| Microsoft Entra ID always performs validation for any Conditional Access policies set by tenant administrators. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Regenerate the versioned command documentation from PowerShell help.
These files are generated artifacts; make the terminology and prose changes in the corresponding PowerShell source/comment-based help, then regenerate all affected documentation.
website/versioned_docs/version-2.2.0/commands/Test-AzdoEnforceAADConditionalAccess.mdx#L24-L24: update the source description.website/versioned_docs/version-2.2.0/commands/Test-MtCaGroupsRestricted.mdx#L23-L28: update the source description and grammar.website/versioned_docs/version-2.2.0/commands/Test-MtCaReferencedGroupsExist.mdx#L23-L25: update the source description and “even when” wording.website/versioned_docs/version-2.2.0/commands/Test-MtCisaBlockLegacyAuth.mdx#L33-L33: update the source return description.website/versioned_docs/version-2.2.0/commands/Test-MtCisaManagedDevice.mdx#L3-L13: update both generated description fields from source.website/versioned_docs/version-2.2.0/commands/Test-MtCisaMfa.mdx#L3-L13: update both generated description fields from source.website/versioned_docs/version-2.2.0/commands/Test-MtCisaPhishResistant.mdx#L3-L13: update both generated description fields from source.website/versioned_docs/version-2.2.0/commands/Test-MtCisaPrivilegedPhishResistant.mdx#L3-L13: update the source wording and use “phishing-resistant”.
As per coding guidelines: “Do not manually edit generated cmdlet command documentation under website/versioned_docs/*/commands/**; update the PowerShell cmdlet source or comment-based help instead and let the build/docs pipeline regenerate the documentation.”
📍 Affects 8 files
website/versioned_docs/version-2.2.0/commands/Test-AzdoEnforceAADConditionalAccess.mdx#L24-L24(this comment)website/versioned_docs/version-2.2.0/commands/Test-MtCaGroupsRestricted.mdx#L23-L28website/versioned_docs/version-2.2.0/commands/Test-MtCaReferencedGroupsExist.mdx#L23-L25website/versioned_docs/version-2.2.0/commands/Test-MtCisaBlockLegacyAuth.mdx#L33-L33website/versioned_docs/version-2.2.0/commands/Test-MtCisaManagedDevice.mdx#L3-L13website/versioned_docs/version-2.2.0/commands/Test-MtCisaMfa.mdx#L3-L13website/versioned_docs/version-2.2.0/commands/Test-MtCisaPhishResistant.mdx#L3-L13website/versioned_docs/version-2.2.0/commands/Test-MtCisaPrivilegedPhishResistant.mdx#L3-L13
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@website/versioned_docs/version-2.2.0/commands/Test-AzdoEnforceAADConditionalAccess.mdx`
at line 24, Update the comment-based help/source for the cmdlets
Test-AzdoEnforceAADConditionalAccess, Test-MtCaGroupsRestricted,
Test-MtCaReferencedGroupsExist, Test-MtCisaBlockLegacyAuth,
Test-MtCisaManagedDevice, Test-MtCisaMfa, Test-MtCisaPhishResistant, and
Test-MtCisaPrivilegedPhishResistant, then regenerate the affected documentation.
Do not edit generated files directly:
website/versioned_docs/version-2.2.0/commands/Test-AzdoEnforceAADConditionalAccess.mdx#L24-L24,
Test-MtCaGroupsRestricted.mdx#L23-L28,
Test-MtCaReferencedGroupsExist.mdx#L23-L25,
Test-MtCisaBlockLegacyAuth.mdx#L33-L33, Test-MtCisaManagedDevice.mdx#L3-L13,
Test-MtCisaMfa.mdx#L3-L13, Test-MtCisaPhishResistant.mdx#L3-L13, and
Test-MtCisaPrivilegedPhishResistant.mdx#L3-L13 require regenerated updates
reflecting the requested descriptions, grammar, wording, return text, and
“phishing-resistant” terminology.
Source: Coding guidelines
| --- | ||
| sidebar_class_name: hidden | ||
| description: "Checks if Conditional Access Policy requiring managed device is enabled" | ||
| description: "Checks if Conditional Access policy requiring managed device is enabled" |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Update the source help instead of editing this generated file.
Make both wording changes in the PowerShell comment-based help/source and regenerate the versioned command documentation.
As per coding guidelines: “Do not manually edit generated cmdlet command documentation under website/versioned_docs/*/commands/**; update the PowerShell cmdlet source or comment-based help instead and let the build/docs pipeline regenerate the documentation.”
Also applies to: 13-13
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@website/versioned_docs/version-2.2.0/commands/Test-MtCisaManagedDevice.mdx`
at line 3, Update the source PowerShell cmdlet comment-based help for
Test-MtCisaManagedDevice with both requested wording changes, then regenerate
the versioned command documentation so the generated file reflects those source
updates. Do not edit files under website/versioned_docs/*/commands directly.
Source: Coding guidelines
| --- | ||
| sidebar_class_name: hidden | ||
| description: "Checks if Conditional Access Policy requiring MFA is enabled" | ||
| description: "Checks if Conditional Access policy requiring MFA is enabled" |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Update the source help instead of editing this generated file.
Apply the description change in the PowerShell comment-based help/source and regenerate the versioned documentation.
As per coding guidelines: “Do not manually edit generated cmdlet command documentation under website/versioned_docs/*/commands/**; update the PowerShell cmdlet source or comment-based help instead and let the build/docs pipeline regenerate the documentation.”
Also applies to: 13-13
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@website/versioned_docs/version-2.2.0/commands/Test-MtCisaMfa.mdx` at line 3,
Update the Test-MtCisaMfa PowerShell cmdlet source or its comment-based help
with the revised description, then regenerate the corresponding versioned
command documentation so the generated file reflects the change without being
edited manually.
Source: Coding guidelines
| --- | ||
| sidebar_class_name: hidden | ||
| description: "Checks if Conditional Access Policy using Phishing-Resistant Authentication Strengths is enabled" | ||
| description: "Checks if Conditional Access policy using Phishing-Resistant Authentication Strengths is enabled" |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Update the source help instead of editing this generated file.
Make the capitalization change in the PowerShell comment-based help/source and regenerate the versioned command documentation.
As per coding guidelines: “Do not manually edit generated cmdlet command documentation under website/versioned_docs/*/commands/**; update the PowerShell cmdlet source or comment-based help instead and let the build/docs pipeline regenerate the documentation.”
Also applies to: 13-13
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@website/versioned_docs/version-2.2.0/commands/Test-MtCisaPhishResistant.mdx`
at line 3, Update the capitalization in the PowerShell comment-based help/source
for Test-MtCisaPhishResistant, then regenerate the versioned command
documentation so the generated file reflects the source change; do not edit the
versioned MDX file directly.
Source: Coding guidelines
| --- | ||
| sidebar_class_name: hidden | ||
| description: "Checks if Conditional Access Policy requiring phishing resistant authentication methods for privileged roles is enabled" | ||
| description: "Checks if Conditional Access policy requiring phishing resistant authentication methods for privileged roles is enabled" |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Update the source help and hyphenate “phishing-resistant”.
Make this wording change in the PowerShell comment-based help/source, then regenerate the versioned documentation. The synopsis should read “phishing-resistant authentication methods”.
As per coding guidelines: “Do not manually edit generated cmdlet command documentation under website/versioned_docs/*/commands/**; update the PowerShell cmdlet source or comment-based help instead and let the build/docs pipeline regenerate the documentation.”
Also applies to: 13-13
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@website/versioned_docs/version-2.2.0/commands/Test-MtCisaPrivilegedPhishResistant.mdx`
at line 3, Update the PowerShell source comment-based help for
Test-MtCisaPrivilegedPhishResistant so its synopsis uses “phishing-resistant
authentication methods,” then regenerate the versioned command documentation
through the standard docs pipeline; do not edit the generated versioned MDX
directly.
Sources: Coding guidelines, Linters/SAST tools
1 participant
📑 Description
Closes #
✅ Checks
/powershell/tests/pester.ps1locally.ℹ️ Additional Information
How to Contribute
🏗️ Read our full contributing guide for the Maester project.
🧪 We also have additional instructions and a checklist for creating tests.
Join us at the Maester repository discussions or Entra Discord for more help and conversations!
While you wait for a review, why not spread some Maester love on social media? Thank you! 💖
Summary by CodeRabbit
Documentation
Tests