Monkey365 v0.98.5

What's New

This release focuses on three main areas: authentication, Microsoft 365 benchmark coverage, and a general cleanup of Microsoft 365 rules and collectors.

🚀 SharePoint Online Support in PowerShell Core

The biggest change is the authentication layer. After several internal improvements, SharePoint Online is now fully supported in PowerShell Core. Until now, SharePoint Online assessments from PowerShell Core required device authentication because of platform limitations. That limitation has now been removed.

From this release onward, SharePoint Online works the same way in both Windows PowerShell and PowerShell Core, providing a consistent authentication experience across supported platforms.

🔐 Authentication Library Updates

The authentication components have been updated to the latest supported Microsoft Authentication Library (MSAL) versions:

• Microsoft.Identity.Client 4.82.1 (Windows PowerShell)
• Microsoft.Identity.Client 4.86 (PowerShell Core)

These updates include several internal improvements and compatibility fixes that will support new authentication workflows.

---

✅ Full Support for CIS Microsoft 365 Foundations 7.0.0

This release adds full support for CIS Microsoft 365 Foundations Benchmark 7.0.0.

Supporting the new benchmark required a significant review of the existing Microsoft 365 rules. During that work, many of the older rules were rewritten, simplified, or removed where appropriate. Several collectors were also updated to better match the current CIS recommendations.

Alongside those changes, a number of new rules have been added to improve coverage across Microsoft 365 services.

To see the available Microsoft 365 rules:

Invoke-Monkey365 -Instance Microsoft365 -ListRule

To list only the rules included in a specific benchmark:

Invoke-Monkey365 `
    -Instance Microsoft365 `
    -RuleSet /path_to_monkey365/rules/rulesets/cis_m365_7.0.0.json `
    -ListRule

---

🎯Default Ruleset

Starting with this release, CIS Microsoft 365 Foundations 7.0.0 becomes the default ruleset whenever the Microsoft365 instance is selected.

Nothing changes for users who prefer a different ruleset. The RuleSet parameter can still be used to select any supported benchmark or a custom ruleset.

Example:

$p = @{
    Instance = "Microsoft365"
    Collect  = "ExchangeOnline","MicrosoftTeams","Purview"
    ExportTo = @("HTML")
    RuleSet  = "/path_to_monkey365/rules/rulesets/cis_m365_7.0.0.json"
}

Invoke-Monkey365 @p

---

Removed Benchmarks

The following legacy benchmarks have been removed from the project:

• CIS Microsoft 365 Foundations 3.0
• CIS Microsoft 365 Foundations 4.0
• CIS Microsoft 365 Foundations 5.0

Users still relying on these benchmarks should migrate to version 7.0.0.

---

🧹 Cleanup & Fixes

This release also includes fixes for the following issues:

• Fixed an issue affecting service principal authentication where Get-MonkeyMSGraphAADServicePrincipal was not available during execution.
  Fixes #182

• Fixed certificate generation in Register-Monkey365Application. Self-signed certificates are now created using a supported RSA key size (2048 bits or greater), avoiding authentication failures caused by certificates generated with unsupported key lengths.
  Fixes #183

Special thanks to @qbrusa for discovering the issues.

---

What's Coming Next

Work continues on the Microsoft Entra assessment rules used by both the Azure and Microsoft 365 benchmarks and also on rules, rulesets and collectors for Azure.

Several of the existing checks were introduced over multiple releases and benchmark revisions. As part of the ongoing review, those rules are being validated, cleaned up, and consolidated where possible before new ones are added.

The objective is to improve consistency while expanding coverage of Microsoft Entra security recommendations.

Once the Microsoft Entra work is complete, Monkey365 will include a dedicated Microsoft Entra ID ruleset, maintained independently from the Azure and Microsoft 365 benchmarks, together with a large set of new security checks focused exclusively on Microsoft Entra environments.

The screenshots below shows a small sample of the rules currently under development and being validated.

Once this work is finished, Monkey365 will be able to identify misconfigurations across a much broader range of Microsoft Entra scenarios, including:

• App Registrations
• Conditional Access Policies
• Enterprise Applications
• Role Assignments
• Privileged Access Configurations
• Identity Security Controls
• Additional Microsoft Entra attack surface checks

Progress is being tracked in:

#172

---

Thanks to everyone who reported issues, submitted feedback, and helped test new functionality. Your contributions continue to improve Monkey365.

Full Changelog: v0.98...v0.98.5