CIS M365v6.0.1 SPO tests Chapter 7

[Mynster9361]

📑 Description

(Currently Draft PR so we can see progress)
This PR is a followup/takeover off #1433
In agreement with @HenrikPiecha

Adds the following CIS tests/controls:
7.2.2
7.2.5
7.2.7
7.2.9
7.2.11
7.3.1

✅ Checks

• My pull request adheres to the code style of this project.
• My code requires changes to the documentation.
• I have updated the documentation as required.
• The build and unit tests pass after running /powershell/tests/pester.ps1 locally.

ℹ️ Additional Information

---

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[Copilot]

Pull request overview

Adds CIS Microsoft 365 Foundations Benchmark v6.0.1 Chapter 7 SharePoint Online (SPO) controls to the Maester PowerShell module and its CIS Pester suite, providing new checks for tenant-level external sharing and security settings.

Changes:

• Added six new CIS SPO test implementations (PowerShell) and matching Pester tests for controls 7.2.2, 7.2.5, 7.2.7, 7.2.9, 7.2.11, 7.3.1.
• Added accompanying CIS guidance markdown pages for each new SPO control.
• Extended Connect-Maester and the module manifest exports to include the new SPO checks.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
tests/cis/Test-MtCisSpoPreventDownloadMaliciousFile.Tests.ps1	Adds Pester coverage for CIS 7.3.1 SPO infected-file download setting.
tests/cis/Test-MtCisSpoGuestCannotShareUnownedItem.Tests.ps1	Adds Pester coverage for CIS 7.2.5 guest resharing restriction.
tests/cis/Test-MtCisSpoGuestAccessExpiry.Tests.ps1	Adds Pester coverage for CIS 7.2.9 guest access expiry.
tests/cis/Test-MtCisSpoDefaultSharingLinkPermission.Tests.ps1	Adds Pester coverage for CIS 7.2.11 default link permission.
tests/cis/Test-MtCisSpoDefaultSharingLink.Tests.ps1	Adds Pester coverage for CIS 7.2.7 default sharing link type.
tests/cis/Test-MtCisSpoB2BIntegration.Tests.ps1	Adds Pester coverage for CIS 7.2.2 Entra B2B integration.
powershell/public/Connect-Maester.ps1	Adds SharePointOnline as a selectable service (but connection implementation is incomplete).
powershell/public/cis/Test-MtCisSpoPreventDownloadMaliciousFile.ps1	Implements CIS 7.3.1 check using Get-SPOTenant.
powershell/public/cis/Test-MtCisSpoPreventDownloadMaliciousFile.md	Adds guidance content for CIS 7.3.1 (missing results placeholder; contains a dash typo).
powershell/public/cis/Test-MtCisSpoGuestCannotShareUnownedItem.ps1	Implements CIS 7.2.5 check using Get-SPOTenant.
powershell/public/cis/Test-MtCisSpoGuestCannotShareUnownedItem.md	Adds guidance content for CIS 7.2.5 (missing results placeholder).
powershell/public/cis/Test-MtCisSpoGuestAccessExpiry.ps1	Implements CIS 7.2.9 check using Get-SPOTenant.
powershell/public/cis/Test-MtCisSpoGuestAccessExpiry.md	Adds guidance content for CIS 7.2.9 (missing results placeholder).
powershell/public/cis/Test-MtCisSpoDefaultSharingLinkPermission.ps1	Implements CIS 7.2.11 check using Get-SPOTenant.
powershell/public/cis/Test-MtCisSpoDefaultSharingLinkPermission.md	Adds guidance content for CIS 7.2.11 (missing results placeholder).
powershell/public/cis/Test-MtCisSpoDefaultSharingLink.ps1	Implements CIS 7.2.7 check using Get-SPOTenant.
powershell/public/cis/Test-MtCisSpoDefaultSharingLink.md	Adds guidance content for CIS 7.2.7 (missing results placeholder).
powershell/public/cis/Test-MtCisSpoB2BIntegration.ps1	Implements CIS 7.2.2 check using Get-SPOTenant.
powershell/public/cis/Test-MtCisSpoB2BIntegration.md	Adds guidance content for CIS 7.2.2 (missing results placeholder).
powershell/Maester.psd1	Exports the six new SPO CIS functions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Mynster9361]

@SamErde @HenrikPiecha
I believe this one is ready for review.

Note for you @SamErde
I think for the action:
[Build Website / Build Docusaurus website 🏗️ (pull_request)]

That it should run either build-docs.yaml or update-module-docs.yaml first otherwise it will always fail when new cis commands are added as the docs pages are never built unless like in my case here i run the Update-CommandReference.ps1 manually and add the changed files i have modified. Not sure if there already is an issue on this?
reference:
https://github.com/maester365/maester/actions/runs/25636108975/job/75248154790?pr=1755

 Exhaustive list of all broken links found:
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.2.11:
     -> linking to /docs/commands/Test-MtCisSpoDefaultSharingLinkPermission
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.2.2:
     -> linking to /docs/commands/Test-MtCisSpoB2BIntegration
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.2.5:
     -> linking to /docs/commands/Test-MtCisSpoGuestCannotShareUnownedItem
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.2.7:
     -> linking to /docs/commands/Test-MtCisSpoDefaultSharingLink
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.2.9:
     -> linking to /docs/commands/Test-MtCisSpoGuestAccessExpiry
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.3.1:
     -> linking to /docs/commands/Test-MtCisSpoPreventDownloadMaliciousFile

[SamErde]

@SamErde @HenrikPiecha I believe this one is ready for review.

Note for you @SamErde I think for the action: [Build Website / Build Docusaurus website 🏗️ (pull_request)]

That it should run either build-docs.yaml or update-module-docs.yaml first otherwise it will always fail when new cis commands are added as the docs pages are never built unless like in my case here i run the Update-CommandReference.ps1 manually and add the changed files i have modified. Not sure if there already is an issue on this? reference: https://github.com/maester365/maester/actions/runs/25636108975/job/75248154790?pr=1755

 Exhaustive list of all broken links found:
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.2.11:
     -> linking to /docs/commands/Test-MtCisSpoDefaultSharingLinkPermission
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.2.2:
     -> linking to /docs/commands/Test-MtCisSpoB2BIntegration
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.2.5:
     -> linking to /docs/commands/Test-MtCisSpoGuestCannotShareUnownedItem
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.2.7:
     -> linking to /docs/commands/Test-MtCisSpoDefaultSharingLink
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.2.9:
     -> linking to /docs/commands/Test-MtCisSpoGuestAccessExpiry
  - Broken link on source page path = /docs/next/tests/CIS.M365.7.3.1:
     -> linking to /docs/commands/Test-MtCisSpoPreventDownloadMaliciousFile

Great insight, @Mynster9361! Thanks for all of this work!

[Copilot]

Pull request overview

Copilot reviewed 40 out of 40 changed files in this pull request and generated 5 comments.

[Mynster9361]

Did not see there already was a PR related to Sharepoint Online.
I decided to revert my changes in regards to connection to SharePoint online and adopt the ones from #1662 added @DataAndGoliath as a co-author on this adoption (Awesome work Simon!)

Only actual change between the 2 is the location for Get-MtSpo.ps1 i have chosen to place this in the powershell\public folder as it now will relate to both CIS and CISA tests.