asterictnl-lvdw/m365sat

Microsoft 365 Security Assessment Tool - A Easy-To-Use Microsoft 365 Security Assessment Tool

m365sat's Issues

M365SAT execution for different Audits / E3/E5 Licenses?

Hello, is it somehow possible to run the audit, so I can specifiy which audits are run, according to the audited M365 environement?
(E3 Level 1, E3 Level 2, E5 Level 1, E5 Level 2)

Error Handling

Noticed when running the tool that errors are presented on screen and reference the Write-ErrorLog.ps1 file.

The Write-ErrorLog.ps1 file is in your root directory, but the executeinspectors.ps1 file uses $Script:PSScriptRoot to define the file path.
This can be solved by moving or copying the file from your root directory to the M365SAT\core\executeinspectors directory.

The term 'Get-MgOrganization' is not recognized

Hi today when I was trying to execute the .ps1 I was getting the followig exception.

Get-MgOrganization : The term 'Get-MgOrganization' is not recognized as the name of a cmdlet, function, script file,
or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and
try again.
At C:\M365SAT-production\core\m365connectors\Connect-MicrosoftGraph.ps1:27 char:17
+         $OrgName = (((Get-MgOrganization).VerifiedDomains |  Where-Ob ...
+                       ~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Get-MgOrganization:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException

Why is this happening? I am trying it with a demo account from a @controso domain.

Thank you,

BR,

Miro

Issues with M365SAT v2.0rc

1-8-2023: 13:00
We are aware that there are some issues with the following things:

• There are some HTML Reporting structure issues.
• Issues with Exchange CMDLets containing the new EXO Commands when they are ran after some commands
  I will push some fixes to GitHub when I am aware that things have been fixed.
  1-8-2023: 13:05
• Microsoft Exchange CMDLets seem to work when the affected CMDLets are ran standalone or without the other CMDLets before I will investigate in this week which ExchangeCMDlets are affected.
  2-8-2023: 10:15
• Investigation shows that the problem was not existing in the ExchangeCmdlet. Since the Azure cmdlets are ran before this, there might be something in there that is causing issues with the EXO cmdlets. The Az and MicrosoftGraph cmdlets have been updated to their latest version to see if that resolves the issue.
  2-8-2023: 10:30
• It seems that the CSTM is not affected as well. This might mean that the problem is in the main Az cmdlets. This will be investigated to see what the problem is.
  2-8-2023: 12:00
• It seems to be an issue with the authentication schema. The error is caused by human error. The advice is to not close the localhost tabs in Powershell 7 until the audit is done. It seems that background jobs in Powershell 7 depend sometimes onto these tabls. If you close the some tabs too early, the authentication schema will hang and result into failing to authenticate. The same is very important for the Security & Compliance Schema. If this tab is closed too early the EXO commands will not work as the files are not dumped entirely in the TEMP folder on Windows.
• In the latest version CISAz300.ps1 has an issue with a assembly conflict as a different assembly containing the same command has already been loaded. This is an issue with AzAccount itself.
  2-8-2023: 15:00
• Finally I can conclude that there is only a problem with CISAz300.ps1 which has an assembly conflict with a different assembly within the same Az package. the EXO cmdlets are working fine now on PowerShell 7 as long you keep the localhost tabs on, because once you close them they cannot make the connection anymore thus failing the commands. Keep in mind to keep all the localhost tabs on until the whole audit has been completed. The issue with CISAz300 will fixed soon, changing it to a different mechanism.

~LvdW

the new v3 is giving error

Get-M365SATReport : A parameter cannot be found that matches parameter name 'CISV3'.