HighFreeBuilt inOfficial

Microsoft Zero Trust Assessment

Runs Microsoft's Zero Trust Assessment and shows each of its results in the Maester report.

maester365 · maester.zero-trust-assessment · 1,156 stars · Open source · MIT

PowerShell

Invoke-Maester -Pack ZTA

Ships with Maester 3.0 and later, so there is nothing to install. Name the pack to run it.

Risk: High

Contains compiled code or code that cannot be scanned. Install only if you trust the publisher.

Scanned 25 Oct 2026 at commit 0dc9067. Digest sha256:5f29c0bef1ded452a540a3b5fab9775360aad0c1439d883ff6101cf27cc5bfea.

Services: Graph
Microsoft Graph scopes: Application.Read.All, AuditLog.Read.All, CopilotPackages.Read.All, CrossTenantInformation.ReadBasic.All, CustomSecAttributeAssignment.Read.All, DeviceManagementApps.Read.All, DeviceManagementConfiguration.Read.All, DeviceManagementManagedDevices.Read.All, DeviceManagementRBAC.Read.All, DeviceManagementServiceConfig.Read.All, Directory.Read.All, DirectoryRecommendations.Read.All, EntitlementManagement.Read.All, IdentityRiskEvent.Read.All, IdentityRiskyServicePrincipal.Read.All, IdentityRiskyUser.Read.All, LifecycleWorkflows-Workflow.Read.All, NetworkAccess.Read.All, Policy.Read.All, Policy.Read.ConditionalAccess, Policy.Read.PermissionGrant, PrivilegedAccess.Read.AzureAD, PrivilegedAssignmentSchedule.Read.AzureADGroup, PrivilegedEligibilitySchedule.Read.AzureADGroup, Reports.Read.All, RoleManagement.Read.All, SecurityAlert.Read.All, SecurityEvents.Read.All, SecurityIdentitiesHealth.Read.All, SecurityIdentitiesSensors.Read.All, SecurityIncident.Read.All, ThreatHunting.Read.All, UserAuthenticationMethod.Read.All
Tenant writes: None
Network hosts: None
PowerShell modules: None
Modules you install (run in a separate process, not pinned): ZeroTrustAssessment >= 2.6.0

Severity	Finding	Where
Medium	DynamicCode Calls a command whose name is computed at run time.	tests/Test.ZTA.ps1:544
Medium	ProcessStart Starts another process ([Diagnostics.Process]::Start).	tests/Test.ZTA.ps1:532
High	UserModules The pack runs your own install of ZeroTrustAssessment 2.6.0 or newer in a separate PowerShell process. Maester does not save, pin or check those files, so a change to them needs no new approval.