CIS M365v6.0.1 SPO tests Chapter 7

[Mynster9361]

📑 Description

(Currently Draft PR so we can see progress)
This PR is a followup/takeover off #1433
In agreement with @HenrikPiecha

Adds the following CIS tests/controls:
7.2.2
7.2.5
7.2.7
7.2.9
7.2.11
7.3.1

✅ Checks

• My pull request adheres to the code style of this project.
• My code requires changes to the documentation.
• I have updated the documentation as required.
• The build and unit tests pass after running /powershell/tests/pester.ps1 locally.

ℹ️ Additional Information

---

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[Copilot]

Pull request overview

Adds CIS Microsoft 365 Foundations Benchmark v6.0.1 Chapter 7 SharePoint Online (SPO) controls to the Maester PowerShell module and its CIS Pester suite, providing new checks for tenant-level external sharing and security settings.

Changes:

• Added six new CIS SPO test implementations (PowerShell) and matching Pester tests for controls 7.2.2, 7.2.5, 7.2.7, 7.2.9, 7.2.11, 7.3.1.
• Added accompanying CIS guidance markdown pages for each new SPO control.
• Extended Connect-Maester and the module manifest exports to include the new SPO checks.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
tests/cis/Test-MtCisSpoPreventDownloadMaliciousFile.Tests.ps1	Adds Pester coverage for CIS 7.3.1 SPO infected-file download setting.
tests/cis/Test-MtCisSpoGuestCannotShareUnownedItem.Tests.ps1	Adds Pester coverage for CIS 7.2.5 guest resharing restriction.
tests/cis/Test-MtCisSpoGuestAccessExpiry.Tests.ps1	Adds Pester coverage for CIS 7.2.9 guest access expiry.
tests/cis/Test-MtCisSpoDefaultSharingLinkPermission.Tests.ps1	Adds Pester coverage for CIS 7.2.11 default link permission.
tests/cis/Test-MtCisSpoDefaultSharingLink.Tests.ps1	Adds Pester coverage for CIS 7.2.7 default sharing link type.
tests/cis/Test-MtCisSpoB2BIntegration.Tests.ps1	Adds Pester coverage for CIS 7.2.2 Entra B2B integration.
powershell/public/Connect-Maester.ps1	Adds SharePointOnline as a selectable service (but connection implementation is incomplete).
powershell/public/cis/Test-MtCisSpoPreventDownloadMaliciousFile.ps1	Implements CIS 7.3.1 check using Get-SPOTenant.
powershell/public/cis/Test-MtCisSpoPreventDownloadMaliciousFile.md	Adds guidance content for CIS 7.3.1 (missing results placeholder; contains a dash typo).
powershell/public/cis/Test-MtCisSpoGuestCannotShareUnownedItem.ps1	Implements CIS 7.2.5 check using Get-SPOTenant.
powershell/public/cis/Test-MtCisSpoGuestCannotShareUnownedItem.md	Adds guidance content for CIS 7.2.5 (missing results placeholder).
powershell/public/cis/Test-MtCisSpoGuestAccessExpiry.ps1	Implements CIS 7.2.9 check using Get-SPOTenant.
powershell/public/cis/Test-MtCisSpoGuestAccessExpiry.md	Adds guidance content for CIS 7.2.9 (missing results placeholder).
powershell/public/cis/Test-MtCisSpoDefaultSharingLinkPermission.ps1	Implements CIS 7.2.11 check using Get-SPOTenant.
powershell/public/cis/Test-MtCisSpoDefaultSharingLinkPermission.md	Adds guidance content for CIS 7.2.11 (missing results placeholder).
powershell/public/cis/Test-MtCisSpoDefaultSharingLink.ps1	Implements CIS 7.2.7 check using Get-SPOTenant.
powershell/public/cis/Test-MtCisSpoDefaultSharingLink.md	Adds guidance content for CIS 7.2.7 (missing results placeholder).
powershell/public/cis/Test-MtCisSpoB2BIntegration.ps1	Implements CIS 7.2.2 check using Get-SPOTenant.
powershell/public/cis/Test-MtCisSpoB2BIntegration.md	Adds guidance content for CIS 7.2.2 (missing results placeholder).
powershell/Maester.psd1	Exports the six new SPO CIS functions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 46 out of 46 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (3)

website/docs/sections/create-entra-app.md:1

• The docs recommend very broad SharePoint permissions (AllSites.FullControl delegated and Sites.FullControl.All application) while stating the tests are read-only. If the implementation only needs to read tenant settings, please document and recommend the least-privileged permissions that work (or explicitly justify why full-control is required), to avoid encouraging over-privileged app registrations.
  website/docs/sections/create-entra-app.md:1
• The docs recommend very broad SharePoint permissions (AllSites.FullControl delegated and Sites.FullControl.All application) while stating the tests are read-only. If the implementation only needs to read tenant settings, please document and recommend the least-privileged permissions that work (or explicitly justify why full-control is required), to avoid encouraging over-privileged app registrations.
  website/docs/sections/create-entra-app.md:1
• The docs recommend very broad SharePoint permissions (AllSites.FullControl delegated and Sites.FullControl.All application) while stating the tests are read-only. If the implementation only needs to read tenant settings, please document and recommend the least-privileged permissions that work (or explicitly justify why full-control is required), to avoid encouraging over-privileged app registrations.

[Copilot]

Pull request overview

Copilot reviewed 46 out of 46 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

website/docs/sections/create-entra-app.md:1

• Inside the <details> block, the content starts immediately with a Markdown heading that duplicates the <summary> text. Markdown renderers can be sensitive to Markdown immediately following inline HTML, and this duplication can create awkward layout/TOC artifacts. Consider removing the redundant ### ... line and/or adding a blank line after </summary> so the content renders consistently.

[Copilot]

Pull request overview

Copilot reviewed 46 out of 46 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

website/docs/sections/create-entra-app.md:1

• Inside a <details> block, the section title is duplicated (both the <summary> and the ### heading) and the heading is placed immediately after </summary> without a separating blank line. This can render awkwardly in MDX/Docusaurus and creates redundant headings. Consider removing the ### ... line (keeping the <summary> as the title), or add a blank line and change the inner heading to a lower level that doesn't duplicate the summary.

[Copilot]

Pull request overview

Copilot reviewed 46 out of 46 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (2)

website/docs/sections/create-entra-app.md:1

• The tenant placeholder format here ([yourtenant].onmicrosoft.com) is inconsistent with the rest of the doc (which uses <...> placeholders). Consider switching this to the same <tenant>.onmicrosoft.com style to avoid readers copying the brackets literally.
  website/docs/sections/create-entra-app.md:1
• This section repeats the title in both the <summary> and an immediate ### heading, which can lead to duplicated headings/anchors and noisy rendering. Prefer keeping only the <summary> as the visible title (and start the body content after a blank line), or remove the summary and keep the heading.

[Copilot]

Pull request overview

Copilot reviewed 46 out of 46 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (3)

website/docs/sections/create-entra-app.md:1

• Markdown headings immediately following an HTML <summary> (without an empty line and/or wrapper) can render inconsistently in MDX/Docusaurus, and this also duplicates the summary text. Suggest removing the duplicate ### heading or inserting a blank line and wrapping the contents (e.g., inside a <div>), so the section reliably renders inside the <details> block.
  website/docs/sections/create-entra-app.md:1
• The docs state the SharePoint tests are read-only, but the recommended delegated permission AllSites.FullControl grants far more than read access and may not align with least-privilege expectations. If a more restrictive scope works (e.g., read-only delegated scopes), prefer documenting that; otherwise, explicitly explain why FullControl is required (e.g., specific PnP cmdlets needing elevated privileges) so readers understand the security tradeoff.
  website/versioned_docs/version-2.1.0/commands/Get-MtSpo.mdx:1
• Several newly added command docs include the placeholder {{ Fill ProgressAction Description }}. This is user-facing documentation and should be replaced with an actual description (or omitted if this parameter section is intended to be auto-generated elsewhere), otherwise it looks like incomplete docs.

[Copilot]

Pull request overview

Copilot reviewed 46 out of 46 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (2)

website/docs/sections/create-entra-app.md:1

• The guidance states the tests are read-only, but instructs granting AllSites.FullControl delegated permission. That permission is extremely broad and can exceed least-privilege expectations for readers of this doc. If AllSites.FullControl is truly required by PnP for Get-PnPTenant/tenant settings, please explicitly state why a lower-privilege delegated permission is not sufficient; otherwise, prefer the minimal delegated permission that still enables the tests.
  website/docs/sections/create-entra-app.md:1
• The guidance states the tests are read-only, but instructs granting AllSites.FullControl delegated permission. That permission is extremely broad and can exceed least-privilege expectations for readers of this doc. If AllSites.FullControl is truly required by PnP for Get-PnPTenant/tenant settings, please explicitly state why a lower-privilege delegated permission is not sufficient; otherwise, prefer the minimal delegated permission that still enables the tests.