Maester 2.3 Released: Why Update?

Key insights

• Maester is a PowerShell-based tool for automated security checks of Microsoft 365 and Microsoft Entra environments.
  Run it locally or in CI to continuously test settings, identities, devices, and apps and get actionable findings.
  


• Critical update: Maester 2.3 fixes an HTML report XSS vulnerability — update immediately.
  Run Update-Module Maester and Update-MaesterTests to install the patch.
  


• New identity checks: Maester adds 14 checks for Agent ID and AI-agent identities, focusing on orphaned agents, over-privileged agents, and missing ownership.
  These help prevent unmanaged AI identities from becoming attack surfaces.
  


• Better reporting: the Affected objects report lists every user, group, and app behind failed checks and can export a JSON file for tooling.
  Use -RedactUserIdentity to hide user details before sharing, and enable includeaffectedobjects for GitHub Actions.
  


• More checks, clearer output: Maester 2.3 adds macOS checks, Azure DevOps and GitHub security checks, and produces a smaller report with improved Connect-Maester guidance.
  


• Standards and deadlines: Maester updates to CIS Microsoft 365 Foundations Benchmark v7 and warns about the retiring memberOf dynamic-group operator, which stops updating after 3 Nov 2026.
  Review dynamic groups now to avoid stale memberships.
  

Quick overview of the video

Merill Fernando published a concise six-minute YouTube walkthrough that summarizes the release of Maester 2.3. In the video, he highlights why teams should update immediately and shows the most important features and fixes. Viewers get a timestamped tour that emphasizes an urgent security fix first, then new checks, reporting improvements, and benchmark updates.

What’s new in Maester 2.3

The release restores and expands automated checks across Microsoft cloud environments, with a clearly flagged security hardening of the HTML report to stop XSS through report data. In addition, the tool introduces preview checks for AI-agent identities using the Agent ID model and adds a consolidated affected objects report that maps users, groups, and apps behind failed checks. Maester 2.3 also offers an option to redact user identities before sharing reports, produces a machine-friendly JSON file of affected objects for integration, and supports a GitHub Action toggle to include those objects.

Beyond reporting, Fernando shows that the new release trims report size and improves the Connect-Maester experience while adding tests for macOS devices and Azure DevOps. The release also updates its guidance to the CIS Microsoft 365 Foundations Benchmark v7 and flags a critical operational change: Microsoft will retire the memberOf dynamic group operator on 3 November 2026, after which groups using it will stop updating. Finally, the video lists the simple PowerShell commands to update: Update-Module Maester and Update-MaesterTests.

Why security teams should pay attention

Fernando stresses that the HTML report fix warrants an immediate update because cross-site scripting in exported reports can expose tenant data when shared. Moreover, the addition of AI-agent checks recognizes a growing risk: agents may hold permissions and access data similarly to apps or service principals, and unmanaged agents become a new attack surface. The affected objects report and the option to redact identities balance the need for clarity in remediation with the need to protect privacy when sharing findings externally.

Also, aligning automated checks to CIS v7 helps teams keep continuous testing matched to an accepted benchmark instead of stale guidance. However, Fernando points out that benchmarks are starting points; security teams must still assess each recommendation against their own business and compliance needs. That practical stance underlines the tool’s role in continuous posture testing rather than as a one-size-fits-all compliance solution.

Tradeoffs and operational challenges

Adding more checks improves detection but can increase noise and false positives, which in turn require secure triage processes and staff time to investigate. For example, AI-agent checks may generate a list of agents that need ownership or permission changes, yet organizations must weigh the risk of removing access against operational breakage. Likewise, redacting user identities preserves privacy but reduces forensic detail; defenders must choose whether to sacrifice some investigative depth for safer sharing.

The deprecation of the memberOf operator raises another tradeoff: teams must plan migration to avoid frozen group memberships while considering the effort to rebuild or replace group logic. Migration can be complex for tenants with large numbers of dynamic groups, and missteps could affect license assignments or Conditional Access policies. Therefore, teams should test changes in a staging environment and document fallback plans before wide rollout.

Practical update guidance

Fernando’s walkthrough includes actionable steps: update the module and the test suite in your automation pipeline, then run checks in a non-production environment to evaluate noise and false positives. Opt into the redact user identity feature when sharing reports externally, but keep an unredacted copy in a secured location for incident analysis and follow-up. Export the JSON file of affected objects to feed into ticketing or SIEM workflows so remediation can be tracked and measured over time.

Teams that use CI/CD should consider the GitHub Action option to include affected objects, but they must protect access to any output that contains identity data. In addition, organizations should plan a migration path for dynamic groups that use memberOf well before the 3 November 2026 retirement date to prevent unexpected membership staleness. Finally, treat these updates as part of an iterative security process: update, test, tune rules, and repeat.

Bottom line

Merill Fernando’s short video provides a clear, practical look at Maester 2.3 and explains why the release matters: urgent report hardening, new checks for AI agents, richer reporting options, and an updated benchmark. While the release adds valuable capabilities, it also brings tradeoffs in noise, privacy versus traceability, and migration work for deprecated group rules. Security teams should update promptly, test carefully, and use the new outputs to automate and track remediation while planning for the operational changes ahead.

Keywords

Maester 2.3 update, Maester 2.3 release, Maester 2.3 download, Maester update now, Maester 2.3 features, Maester 2.3 release notes, Maester 2.3 bug fixes, Maester 2.3 improvements