MET

0.10.0

Security Posture Scanner for MDO, EXO and Teams - assesses MDO, EXO/EOP, and Teams protection posture.

Minimum PowerShell version

7.4

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name MET

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name MET

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Copyright

(c) 2026 Pierre Thoor. MIT License.

Package Details

Author(s)

  • Pierre Thoor

Tags

MDO Microsoft365 Defender ExchangeOnline Teams Security Posture Assessment

Functions

Connect-METSession Disconnect-METSession Invoke-METTriage Get-METReport Test-METPrerequisites

Dependencies

This module has no dependencies.

Release Notes

v0.10.0 - Connect-METSession security hardening. Fixes a confirmed cross-customer data leak in session reuse: Connect-METSession previously reused any live Exchange Online/Graph/Teams connection without verifying it belonged to the requested tenant, so running MET against two different -DelegatedOrganization customers in the same session without disconnecting in between could return a report labeled for one customer containing another customer's actual configuration. Adds certificate-file authentication (-CertificatePath/-CertificatePassword) for non-Windows platforms, since -CertificateThumbprint is Windows-only. Scopes device-code authentication down to a documented headless-only fallback, with a warning on every use, per Microsoft's current guidance to block it wherever possible. Adds Disconnect-METSession for clean session teardown across all three connection legs. Adds MET-MDO014 (Group Reference Audit) and expands MET-EXO014 (Advanced Delivery Policy) coverage. v0.9.0 - Quarantine policy accuracy pass. Fixes two confirmed false-positive bugs: MET-EXO009 previously flagged Microsoft's own Standard/Strict preset security policies as Fail/Warning for impersonation, spoof, and phish quarantine verdicts, even though Microsoft's own Strict preset uses full-access quarantine policies for those verdicts by design; corrected to only evaluate the two verdicts (Malware, High-Confidence Phish) that actually have a restrictive floor. MET-EXO004 previously flagged the built-in AdminOnlyAccessPolicy's by-design "no access" configuration as a misconfiguration on every tenant; narrowed to evaluate only genuinely custom quarantine policies. Adds preset-aware retention handling to MET-EXO008 and a new informational check, MET-EXO017 (Quarantine Notification Cadence). v0.8.0 - Teams attack-surface hardening. Adds five new Teams checks: MET-Teams009 (Trial Tenant Federation Exposure), MET-Teams010 (Per-User External Access Policy Drift), MET-Teams011 (SecOps Blocklist Authority & Blocked Entities), MET-Teams012 (Call Reporting / vishing surface), and MET-Teams014 (Cross-Tenant Guest & External Collaboration, the first check with a direct Microsoft Graph dependency). Also fixes a real gap in MET-Teams003, which previously only evaluated the Global meeting policy and missed custom meeting policies entirely, and adds rule-level exception visibility to MET-Teams001 and MET-Teams004.

FileList

Version History

Version Downloads Last updated
0.10.0 (current version) 5 8/19/2026