Add MT.1185: Block legacy MSOnline (MSOL) PowerShell module by BakkerJan · Pull Request #1972 · maester365/maester

BakkerJan · 2026-07-21T07:43:18Z

Summary

Adds Test-MtEntraMsolPowerShellBlocked (MT.1185, High severity) which checks the blockMsolPowerShell property on the tenant's authorizationPolicy (Microsoft Graph).

The MSOnline (MSOL) and Azure AD PowerShell modules were retired by Microsoft and no longer receive security updates. The blockMsolPowerShell setting lets an admin explicitly block authentication requests from the legacy MSOnline PowerShell module's service principal. This setting isn't enabled by default for every tenant, so it's worth an explicit, standing check rather than assuming it's already in place.

Reserved via #697 (comment).

Test plan

Invoke-ScriptAnalyzer against the new function file — no issues
./build/Build-LocalMaester.ps1 — builds and loads cleanly
./powershell/tests/pester.ps1 — full suite, 10056/10056 tests passed

Reference

Authorization policy resource type | Microsoft Learn

Summary by CodeRabbit

New Features
- Added an Entra security check to verify that legacy MSOnline (MSOL) PowerShell authentication is blocked.
- Returns a clear boolean result and safely skips when Graph access isn’t available or authorized.
Documentation
- Added a new guidance page with remediation steps for tenants where the setting is not enabled.
Tests
- Added MT.1185 coverage as a high-severity check.
Chores
- Minor update to exported cmdlet list formatting/line wrapping (no functional change).

The blockMsolPowerShell setting on the tenant's authorization policy blocks authentication requests from the retired MSOnline PowerShell module. It isn't enabled by default for every tenant, so this check verifies the current state via Graph rather than assuming it.

coderabbitai · 2026-07-21T07:43:45Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 8acbcd78-767e-4d0c-a57c-9cf53687dd88

📥 Commits

Reviewing files that changed from the base of the PR and between d699dd2 and 8accc94.

📒 Files selected for processing (1)

powershell/public/maester/entra/Test-MtEntraMsolPowerShellBlocked.md

🚧 Files skipped from review as they are similar to previous changes (1)

powershell/public/maester/entra/Test-MtEntraMsolPowerShellBlocked.md

📝 Walkthrough

Walkthrough

Adds Test-MtEntraMsolPowerShellBlocked, documentation and remediation steps, export wiring, a high-severity MT.1185 configuration entry, and a test asserting the tenant blocks MSOL PowerShell authentication.

Changes

Entra MSOL PowerShell blocking

Layer / File(s)	Summary
Blocking check and command wiring `powershell/public/maester/entra/Test-MtEntraMsolPowerShellBlocked.ps1`, `powershell/public/maester/entra/Test-MtEntraMsolPowerShellBlocked.md`, `powershell/Maester.psd1`	The new cmdlet checks `blockMsolPowerShell` through Microsoft Graph, records success or skipped results, documents remediation commands, and is included in the exported function list.
Test registration and validation `tests/maester-config.json`, `tests/Maester/Entra/Test-MtEntraMsolPowerShellBlocked.Tests.ps1`	Registers MT.1185 with High severity and verifies that the cmdlet returns `$true`.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant MaesterTest
  participant TestMtEntraMsolPowerShellBlocked
  participant MicrosoftGraph

  MaesterTest->>TestMtEntraMsolPowerShellBlocked: Invoke MT.1185
  TestMtEntraMsolPowerShellBlocked->>MicrosoftGraph: Query authorizationPolicy
  MicrosoftGraph-->>TestMtEntraMsolPowerShellBlocked: Return blockMsolPowerShell
  TestMtEntraMsolPowerShellBlocked-->>MaesterTest: Return check result

Suggested labels: maester-test, documentation

Suggested reviewers: merill

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: adding MT.1185 to block legacy MSOnline PowerShell.
Description check	✅ Passed	The description covers the change, test plan, and reference, but it omits the template's checklist and additional information sections.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

codacy-production · 2026-07-21T07:45:37Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

coderabbitai

🧹 Nitpick comments (1)

powershell/public/maester/entra/Test-MtEntraMsolPowerShellBlocked.md (1)
11-24: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Fix markdown heading increment.

As per static analysis hints, heading levels should only increment by one level at a time. The #### headings skip a level following the ## Why This Matters heading.
♻️ Proposed fix
-#### Remediation action:
+### Remediation action:
 
 1. Connect to Graph using **Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"**.
 2. Run the following PowerShell command to review the current value:
 ```powershell
 Get-MgPolicyAuthorizationPolicy | Select-Object BlockMsolPowerShell
If BlockMsolPowerShell is $false, block the legacy MSOnline PowerShell module:
$authPolicy = Get-MgPolicyAuthorizationPolicy
Update-MgPolicyAuthorizationPolicy -AuthorizationPolicyId $authPolicy.Id -BlockMsolPowerShell:$true
-#### Related links
+### Related links
</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @powershell/public/maester/entra/Test-MtEntraMsolPowerShellBlocked.md around
lines 11 - 24, Change the “Related links” heading in
Test-MtEntraMsolPowerShellBlocked.md from level four to level three so it
follows the preceding level-two section without skipping a heading level.
</details>



_Source: Linters/SAST tools_

</blockquote></details>

</blockquote></details>

<details>
<summary>🤖 Prompt for all review comments with AI agents</summary>
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @powershell/public/maester/entra/Test-MtEntraMsolPowerShellBlocked.md:

Around line 11-24: Change the “Related links” heading in
Test-MtEntraMsolPowerShellBlocked.md from level four to level three so it
follows the preceding level-two section without skipping a heading level.
</details>

---

<details>
<summary>ℹ️ Review info</summary>

<details>
<summary>⚙️ Run configuration</summary>

**Configuration used**: Path: .coderabbit.yaml

**Review profile**: CHILL

**Plan**: Pro Plus

**Run ID**: `1aae43bd-e646-439a-9cd4-da10e3097c63`

</details>

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 17c6f8fff74e8e7dc9ca069738259ecfb7d18e6d and b20a30501bb5abe59a540bb5da7bdfe943eaf593.

</details>

<details>
<summary>📒 Files selected for processing (5)</summary>

* `powershell/Maester.psd1`
* `powershell/public/maester/entra/Test-MtEntraMsolPowerShellBlocked.md`
* `powershell/public/maester/entra/Test-MtEntraMsolPowerShellBlocked.ps1`
* `tests/Maester/Entra/Test-MtEntraMsolPowerShellBlocked.Tests.ps1`
* `tests/maester-config.json`

</details>

</details>

merill · 2026-07-22T13:07:17Z

Good stuff again @BakkerJan

FYI Just a minor tweak. I've updated the remediate code block to use the same example as in the official Microsoft docs.

merill

LGTM

BakkerJan requested review from a team as code owners July 21, 2026 07:43

coderabbitai Bot reviewed Jul 21, 2026

View reviewed changes

BakkerJan and others added 2 commits July 21, 2026 09:47

Fix markdown heading level increment per CodeRabbit review

d699dd2

docs: fix MT.1185 remediation command

8accc94

merill approved these changes Jul 22, 2026

View reviewed changes

merill merged commit 8be8cd9 into maester365:main Jul 22, 2026
13 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add MT.1185: Block legacy MSOnline (MSOL) PowerShell module#1972

Add MT.1185: Block legacy MSOnline (MSOL) PowerShell module#1972
merill merged 3 commits into
maester365:mainfrom
BakkerJan:mt1185-block-msol-powershell

BakkerJan commented Jul 21, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

codacy-production Bot commented Jul 21, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

merill commented Jul 22, 2026

Uh oh!

merill left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

BakkerJan commented Jul 21, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Reference

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

codacy-production Bot commented Jul 21, 2026

Up to standards ✅

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

merill commented Jul 22, 2026

Uh oh!

merill left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

BakkerJan commented Jul 21, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading