Add Entitlement Management tests MT.1107-MT.1111 by nicowyss · Pull Request #1381 · maester365/maester

nicowyss · 2025-12-15T09:39:01Z

Summary

Adds 5 new Maester Core Tests for Entra ID Identity Governance Access Packages.

Tests Added

MT.1107 – Access packages and catalogs should not reference deleted groups
MT.1108 – Access packages should not reference inactive or orphaned assignment policies
MT.1109 – Access package approval workflows must have valid approvers
MT.1110 – No catalog should contain resources without any associated access packages
MT.1111 – Catalog resources must have valid roles (no stale app roles or SPNs)

Notes

Read-only tests
Tested with Invoke-Maester
No tenant modifications

Copilot

Pull request overview

This pull request adds 5 new Maester Core Tests (MT.1107-MT.1111) for Microsoft Entra ID Identity Governance Entitlement Management. These tests validate the configuration and integrity of access packages, catalogs, policies, and resources in Entra ID Governance.

Changes:

Adds 5 new PowerShell test functions for entitlement management validation
Adds corresponding Pester test wrappers with appropriate tags
Adds documentation files for each test with descriptions, remediation steps, and related links
Updates module manifest to export the new test functions

Reviewed changes

Copilot reviewed 21 out of 21 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
powershell/Maester.psd1	Adds 5 new test functions to the module exports
powershell/public/maester/entra/Test-MtEntitlementManagementDeletedGroups.ps1	Validates that access packages and catalogs don't reference deleted groups
powershell/public/maester/entra/Test-MtEntitlementManagementDeletedGroups.md	Documentation for deleted groups test
powershell/public/maester/entra/Test-MtEntitlementManagementInactivePolicies.ps1	Checks for inactive or misconfigured assignment policies
powershell/public/maester/entra/Test-MtEntitlementManagementInactivePolicies.md	Documentation for inactive policies test
powershell/public/maester/entra/Test-MtEntitlementManagementOrphanedResources.ps1	Identifies catalog resources not used in any access package
powershell/public/maester/entra/Test-MtEntitlementManagementOrphanedResources.md	Documentation for orphaned resources test
powershell/public/maester/entra/Test-MtEntitlementManagementValidApprovers.ps1	Validates approval workflows have valid, active approvers
powershell/public/maester/entra/Test-MtEntitlementManagementValidApprovers.md	Documentation for valid approvers test
powershell/public/maester/entra/Test-MtEntitlementManagementValidResourceRoles.ps1	Checks catalog resources for stale app roles and deleted service principals
powershell/public/maester/entra/Test-MtEntitlementManagementValidResourceRoles.md	Documentation for valid resource roles test
tests/Maester/Entra/Test-MtEntitlementManagementDeletedGroups.Tests.ps1	Pester test wrapper for MT.1107
tests/Maester/Entra/Test-MtEntitlementManagementInactivePolicies.Tests.ps1	Pester test wrapper for MT.1108
tests/Maester/Entra/Test-MtEntitlementManagementOrphanedResources.Tests.ps1	Pester test wrapper for MT.1110
tests/Maester/Entra/Test-MtEntitlementManagementValidApprovers.Tests.ps1	Pester test wrapper for MT.1109
tests/Maester/Entra/Test-MtEntitlementManagementValidResourceRoles.Tests.ps1	Pester test wrapper for MT.1111
website/docs/tests/maester/MT.1107.md	User-facing documentation for deleted groups test
website/docs/tests/maester/MT.1108.md	User-facing documentation for inactive policies test
website/docs/tests/maester/MT.1109.md	User-facing documentation for valid approvers test
website/docs/tests/maester/MT.1110.md	User-facing documentation for orphaned resources test
website/docs/tests/maester/MT.1111.md	User-facing documentation for valid resource roles test

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

powershell/public/maester/entra/Test-MtEntitlementManagementValidResourceRoles.ps1

powershell/public/maester/entra/Test-MtEntitlementManagementOrphanedResources.ps1

powershell/public/maester/entra/Test-MtEntitlementManagementDeletedGroups.ps1

website/docs/tests/maester/MT.1108.md

website/docs/tests/maester/MT.1109.md

powershell/public/maester/entra/Test-MtEntitlementManagementValidResourceRoles.ps1

powershell/public/maester/entra/Test-MtEntitlementManagementInactivePolicies.ps1

powershell/public/maester/entra/Test-MtEntitlementManagementValidResourceRoles.ps1

website/docs/tests/maester/MT.1107.md

website/docs/tests/maester/MT.1110.md

SamErde · 2026-02-02T00:26:25Z

@nicowyss, these are great checks! Do you have any thoughts on the suggestions from the Copilot review? I haven't had a chance to review much lately, but this might give you a few things to test. Thanks!

- Add missing elseif branch for single object responses in: - Test-MtEntitlementManagementValidResourceRoles (allPackages, roleScopes) - Test-MtEntitlementManagementValidApprovers (members) - Fix Write-Error to use $_.Exception.Message instead of $_ in all 4 files

- Move Graph API call for access packages before catalog foreach loop - Reduces API calls from N (per catalog) to 1 - Apply to both OrphanedResources and ValidResourceRoles tests

SamErde · 2026-02-11T10:43:33Z

@nicowyss, these are great checks! Do you have any thoughts on the suggestions from the Copilot review? I haven't had a chance to review much lately, but this might give you a few things to test. Thanks!

Just to be clear: you don't have to automatically accept all Copilot suggestions! It's just the best I can offer with my current schedule.

nicowyss · 2026-02-11T12:04:14Z

@nicowyss, these are great checks! Do you have any thoughts on the suggestions from the Copilot review? I haven't had a chance to review much lately, but this might give you a few things to test. Thanks!

Just to be clear: you don't have to automatically accept all Copilot suggestions! It's just the best I can offer with my current schedule.

@SamErde Yes, of course, I'm currently working my way through the review comments, and many of them make a lot of sense.

- Updated line 121 to use the consistent 3-branch pattern for handling Graph API responses (Array, .value property, single object) - Ensures paginated results with .value property are handled correctly

SamErde · 2026-02-16T10:09:12Z

This is looking good! FYI, the build validation tests produced the following items to resolve:

PSUseBOMForUnicodeEncodedFile

The following files are missing a BOM for UTF-8 encoding, which can cause issues when the file is opened in certain editors or environments.

powershell/public/maester/entra/Test-MtEntitlementManagementDeletedGroups.ps1
powershell/public/maester/entra/Test-MtEntitlementManagementInactivePolicies.ps1
powershell/public/maester/entra/Test-MtEntitlementManagementOrphanedResources.ps1
powershell/public/maester/entra/Test-MtEntitlementManagementValidApprovers.ps1
powershell/public/maester/entra/Test-MtEntitlementManagementValidResourceRoles.ps1

To fix PSUseBOMForUnicodeEncodedFile, run the following script with the affected file or re-save the file in an editor that supports UTF-8 with BOM encoding.

$AffectedFilePath = 'powershell/public/maester/entra/Test-MtTenantCreationRestricted.ps1'
$Content = Get-Content $AffectedFilePath -Raw; $Content | Out-File $AffectedFilePath -Encoding UTF8BOM

PSUseDeclaredVarsMoreThanAssignments

The following files have variables that are declared but not used anywhere in the code, which can lead to confusion and maintenance issues.

powershell/public/maester/entra/Test-MtEntitlementManagementValidResourceRoles.ps1

PSUseSingularNouns

The following files contain functions that do not follow the recommended naming convention of using singular nouns, which can lead to confusion and inconsistency in the codebase.

powershell/public/maester/entra/Test-MtEntitlementManagementDeletedGroups.ps1
powershell/public/maester/entra/Test-MtEntitlementManagementInactivePolicies.ps1
powershell/public/maester/entra/Test-MtEntitlementManagementOrphanedResources.ps1
powershell/public/maester/entra/Test-MtEntitlementManagementValidApprovers.ps1
powershell/public/maester/entra/Test-MtEntitlementManagementValidResourceRoles.ps1

HasValidLinkSection

The following functions have links in their documentation that do not point to the expected location. Links in this section should point to the command documentation at https://maester.dev/docs/commands/ followed by the command name.

Block : Function Test-MtEntitlementManagementDeletedGroups
Expected: 'https://maester.dev/docs/commands/Test-MtEntitlementManagem...'
But was: 'https://maester.dev/docs/tests/MT.1107'

Block : Function Test-MtEntitlementManagementInactivePolicies
Expected: 'https://maester.dev/docs/commands/Test-MtEntitlementManagem...'
But was: 'https://maester.dev/docs/tests/MT.1108'

Block : Function Test-MtEntitlementManagementOrphanedResources
Expected: 'https://maester.dev/docs/commands/Test-MtEntitlementManagem...'
But was: 'https://maester.dev/docs/tests/MT.1110'

Block : Function Test-MtEntitlementManagementValidApprovers
Expected: 'https://maester.dev/docs/commands/Test-MtEntitlementManagem...'
But was: 'https://maester.dev/docs/tests/MT.1109'

Block : Function Test-MtEntitlementManagementValidResourceRoles
Expected: 'https://maester.dev/docs/commands/Test-MtEntitlementManagem...'
But was: 'https://maester.dev/docs/tests/MT.1111'

These tests run automatically on PRs but you can also run them yourself locally! In your fork of the project, run powershell/tests/pester.ps1 to see the tests and validation of your additions. 👍

…suppression

nicowyss · 2026-02-16T12:52:01Z

@SamErde Thanks for your patience, I run the tests locally and fixed the warnings/errors.

SamErde

Looking and working great! I don't cover every pass/fail scenario in my tenant yet, but my testing so far returns accurate results. I think this only needs 2 things before merging:

Please remove the 'Security' tag from the test script tags. We have been moving away from using any tag that applies to every (or almost every) test.
Add these test titles and their Severity ratings to tests\maester-config.json. They are not listed yet, so the final report shows no severity ratings for these new tests.

Thank you! 🙏

nicowyss · 2026-02-17T07:46:51Z

@SamErde
Thanks for the feedback, I'm really looking forward to sharing these tests with everyone. I would like to point out that there may be a conflict with the Maester test numbers, which is shown here as a conflict. Two test numbers: MT.1111

Although I claimed my numbers according to the procedure, see: “#️⃣ Pick next Maester test sequence number #697”

SamErde · 2026-02-17T17:22:01Z

@SamErde Thanks for the feedback, I'm really looking forward to sharing these tests with everyone. I would like to point out that there may be a conflict with the Maester test numbers, which is shown here as a conflict. Two test numbers: MT.1111

Although I claimed my numbers according to the procedure, see: “#️⃣ Pick next Maester test sequence number #697”

Ah, sorry to see that! Looks like innocent human error. You can take MT.1106 to replace MT.1111.

merill · 2026-02-18T11:19:16Z

Awesome work @nicowyss

I believe these are the first ones around ID Governance in Maester. Thanks so much!!

nicowyss · 2026-02-18T11:43:34Z

Awesome work @nicowyss

I believe these are the first ones around ID Governance in Maester. Thanks so much!!
@merill
Yes they are and hopefully this encourage more people to collaborate. Very welcome when are those url's reachable?
https://maester.dev/docs/tests/MT.1108
https://maester.dev/docs/next/tests/MT.1106 (looks different then the others)

I would like to post something about thoose tests.

Add Entitlement Management tests MT.1107-MT.1111

4dcf6bf

nicowyss requested review from a team as code owners December 15, 2025 09:39

SamErde requested review from Copilot and removed request for a team January 31, 2026 23:03

Copilot started reviewing on behalf of SamErde January 31, 2026 23:04 View session

Copilot AI reviewed Jan 31, 2026

View reviewed changes

nicowyss added 2 commits February 11, 2026 08:55

Performance: Cache access packages API call outside catalog loop

0d7e503

- Move Graph API call for access packages before catalog foreach loop - Reduces API calls from N (per catalog) to 1 - Apply to both OrphanedResources and ValidResourceRoles tests

nicowyss added 4 commits February 11, 2026 13:05

Fix inconsistent array handling for Graph API response

ffd610f

- Updated line 121 to use the consistent 3-branch pattern for handling Graph API responses (Array, .value property, single object) - Ensures paginated results with .value property are handled correctly

Fix frontmatter: add missing slug and sidebar_class_name properties

296d49d

Fix array handling for assignment policies in DeletedGroups test

7660047

Fix comment: requestApprovalSettings -> requestorSettings

11874d6

Fix build validation: UTF-8 BOM, .LINK URLs, unused var, plural noun …

7438b53

…suppression

SamErde requested changes Feb 16, 2026

View reviewed changes

SamErde self-assigned this Feb 16, 2026

SamErde added maester-test Related to a Maester test entra Microsoft Entra labels Feb 16, 2026

Remove Security tag and add severity config for MT.1107-MT.1111

0e5322f

nicowyss and others added 2 commits February 18, 2026 09:08

Updated test name from MT.1111 to MT.1106

53e3991

Merge branch 'main' into main

93eccbf

merill merged commit 4b70192 into maester365:main Feb 18, 2026
3 checks passed

Conversation

nicowyss commented Dec 15, 2025

Summary

Tests Added

Notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

SamErde commented Feb 2, 2026

Uh oh!

SamErde commented Feb 11, 2026

Uh oh!

nicowyss commented Feb 11, 2026

Uh oh!

SamErde commented Feb 16, 2026

PSUseBOMForUnicodeEncodedFile

PSUseDeclaredVarsMoreThanAssignments

PSUseSingularNouns

HasValidLinkSection

Uh oh!

nicowyss commented Feb 16, 2026

Uh oh!

SamErde left a comment

Choose a reason for hiding this comment

Uh oh!

nicowyss commented Feb 17, 2026

Uh oh!

SamErde commented Feb 17, 2026

Uh oh!

merill commented Feb 18, 2026

Uh oh!

Uh oh!

nicowyss commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

nicowyss commented Feb 18, 2026 •

edited

Loading