Update maester.dev powershell docs

website/docs/commands/Test-MtGsaBaselineThreatIntelligenceEnforced.mdx

@@ -0,0 +1,73 @@
+---
+sidebar_class_name: hidden
+description: "Checks that the baseline Global Secure Access security profile enforces a threat-intelligence floor."
+id: Test-MtGsaBaselineThreatIntelligenceEnforced
+title: Test-MtGsaBaselineThreatIntelligenceEnforced
+hide_title: false
+hide_table_of_contents: false
+custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtGsaBaselineThreatIntelligenceEnforced.ps1
+---
+
+## SYNOPSIS
+
+Checks that the baseline Global Secure Access security profile enforces a threat-intelligence floor.
+
+## SYNTAX
+
+```powershell
+Test-MtGsaBaselineThreatIntelligenceEnforced [-ProgressAction <ActionPreference>] [<CommonParameters>]
+```
+
+## DESCRIPTION
+
+The baseline security profile (priority 65000) applies to all Internet Access traffic with no
+Conditional Access required.
+Linking an enabled threat-intelligence policy to the baseline
+provides an always-on malware and phishing floor that also covers non-client / remote-network
+traffic, the Conditional Access token-propagation gap, and users not matched by any user-aware
+profile.
+Microsoft recommends linking the threat-intelligence policy to the baseline.
+
+## EXAMPLES
+
+### EXAMPLE 1
+
+```powershell
+Test-MtGsaBaselineThreatIntelligenceEnforced
+```
+
+Returns $true if the baseline security profile has an enabled threat-intelligence policy linked.
+
+## PARAMETERS
+
+### -ProgressAction
+
+Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.
+
+```yaml
+Type: ActionPreference
+Parameter Sets: (All)
+Aliases: proga
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+## OUTPUTS
+
+### System.Boolean
+
+## NOTES
+
+## RELATED LINKS
+
+[https://maester.dev/docs/commands/Test-MtGsaBaselineThreatIntelligenceEnforced](https://maester.dev/docs/commands/Test-MtGsaBaselineThreatIntelligenceEnforced)

website/docs/commands/Test-MtGsaCompliantNetworkBreakGlassExcluded.mdx

@@ -0,0 +1,75 @@
+---
+sidebar_class_name: hidden
+description: "Checks that every Compliant Network Conditional Access policy excludes the emergency access (break-glass) accounts."
+id: Test-MtGsaCompliantNetworkBreakGlassExcluded
+title: Test-MtGsaCompliantNetworkBreakGlassExcluded
+hide_title: false
+hide_table_of_contents: false
+custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtGsaCompliantNetworkBreakGlassExcluded.ps1
+---
+
+## SYNOPSIS
+
+Checks that every Compliant Network Conditional Access policy excludes the emergency access (break-glass) accounts.
+
+## SYNTAX
+
+```powershell
+Test-MtGsaCompliantNetworkBreakGlassExcluded [-ProgressAction <ActionPreference>] [<CommonParameters>]
+```
+
+## DESCRIPTION
+
+A Conditional Access policy that enforces the Global Secure Access Compliant Network control
+blocks access when the session is not on a compliant network.
+If such a policy does not exclude
+the emergency access (break-glass) accounts, it can lock out the very accounts needed to recover
+the tenant.
+This check verifies that every enabled Compliant Network enforcement policy excludes
+all configured break-glass accounts and groups.
+
+Emergency access accounts are read from the EmergencyAccessAccounts setting in maester-config.json.
+
+## EXAMPLES
+
+### EXAMPLE 1
+
+```powershell
+Test-MtGsaCompliantNetworkBreakGlassExcluded
+```
+
+Returns $true if every Compliant Network enforcement policy excludes the break-glass accounts.
+
+## PARAMETERS
+
+### -ProgressAction
+
+Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.
+
+```yaml
+Type: ActionPreference
+Parameter Sets: (All)
+Aliases: proga
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+## OUTPUTS
+
+### System.Boolean
+
+## NOTES
+
+## RELATED LINKS
+
+[https://maester.dev/docs/commands/Test-MtGsaCompliantNetworkBreakGlassExcluded](https://maester.dev/docs/commands/Test-MtGsaCompliantNetworkBreakGlassExcluded)

website/docs/commands/Test-MtGsaForwardingProfileAssignmentNotNested.mdx

@@ -0,0 +1,76 @@
+---
+sidebar_class_name: hidden
+description: "Checks if groups assigned to Global Secure Access traffic forwarding profiles use direct membership (no nested groups)."
+id: Test-MtGsaForwardingProfileAssignmentNotNested
+title: Test-MtGsaForwardingProfileAssignmentNotNested
+hide_title: false
+hide_table_of_contents: false
+custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtGsaForwardingProfileAssignmentNotNested.ps1
+---
+
+## SYNOPSIS
+
+Checks if groups assigned to Global Secure Access traffic forwarding profiles use direct membership (no nested groups).
+
+## SYNTAX
+
+```powershell
+Test-MtGsaForwardingProfileAssignmentNotNested [-ProgressAction <ActionPreference>] [<CommonParameters>]
+```
+
+## DESCRIPTION
+
+Global Secure Access traffic forwarding profiles (Microsoft 365, Internet, and Private Access)
+can be scoped to specific users and groups.
+Microsoft does not support nested group membership
+for this assignment - a user must be a DIRECT member of the assigned group to receive the
+profile (and therefore the Global Secure Access client routing).
+A nested assignment group
+silently leaves part of the intended population without the profile.
+
+Traffic forwarding profiles are represented by service principals whose display name ends with
+'trafficforwardingprofile'; their user and group assignments are exposed as app role assignments.
+
+## EXAMPLES
+
+### EXAMPLE 1
+
+```powershell
+Test-MtGsaForwardingProfileAssignmentNotNested
+```
+
+Returns $true if no group assigned to a traffic forwarding profile contains a nested group.
+
+## PARAMETERS
+
+### -ProgressAction
+
+Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.
+
+```yaml
+Type: ActionPreference
+Parameter Sets: (All)
+Aliases: proga
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+## OUTPUTS
+
+### System.Boolean
+
+## NOTES
+
+## RELATED LINKS
+
+[https://maester.dev/docs/commands/Test-MtGsaForwardingProfileAssignmentNotNested](https://maester.dev/docs/commands/Test-MtGsaForwardingProfileAssignmentNotNested)

website/docs/commands/Test-MtGsaM365ProfileEnabled.mdx

@@ -0,0 +1,75 @@
+---
+sidebar_class_name: hidden
+description: "Checks if the Microsoft 365 traffic forwarding profile in Global Secure Access is enabled."
+id: Test-MtGsaM365ProfileEnabled
+title: Test-MtGsaM365ProfileEnabled
+hide_title: false
+hide_table_of_contents: false
+custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtGsaM365ProfileEnabled.ps1
+---
+
+## SYNOPSIS
+
+Checks if the Microsoft 365 traffic forwarding profile in Global Secure Access is enabled.
+
+## SYNTAX
+
+```powershell
+Test-MtGsaM365ProfileEnabled [-ProgressAction <ActionPreference>] [<CommonParameters>]
+```
+
+## DESCRIPTION
+
+The Microsoft 365 traffic forwarding profile routes Microsoft 365 traffic (Exchange Online,
+SharePoint Online, Teams) through Global Secure Access.
+Enabling it is the lowest-risk entry
+point to Global Secure Access and unlocks source IP restoration, the Compliant Network signal
+in Conditional Access (token replay protection), Universal Tenant Restrictions, and network
+access traffic logging.
+
+Learn more:
+https://learn.microsoft.com/entra/global-secure-access/concept-traffic-forwarding
+
+## EXAMPLES
+
+### EXAMPLE 1
+
+```powershell
+Test-MtGsaM365ProfileEnabled
+```
+
+Returns $true if the Microsoft 365 traffic forwarding profile exists and is enabled.
+
+## PARAMETERS
+
+### -ProgressAction
+
+Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.
+
+```yaml
+Type: ActionPreference
+Parameter Sets: (All)
+Aliases: proga
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+## OUTPUTS
+
+### System.Boolean
+
+## NOTES
+
+## RELATED LINKS
+
+[https://maester.dev/docs/commands/Test-MtGsaM365ProfileEnabled](https://maester.dev/docs/commands/Test-MtGsaM365ProfileEnabled)

website/docs/commands/Test-MtGsaPrivateAccessAppAssignmentNotNested.mdx

@@ -0,0 +1,76 @@
+---
+sidebar_class_name: hidden
+description: "Checks if groups assigned to Entra Private Access (and Quick Access) applications use direct membership (no nested groups)."
+id: Test-MtGsaPrivateAccessAppAssignmentNotNested
+title: Test-MtGsaPrivateAccessAppAssignmentNotNested
+hide_title: false
+hide_table_of_contents: false
+custom_edit_url: https://github.com/maester365/maester/blob/main/powershell/public/Test-MtGsaPrivateAccessAppAssignmentNotNested.ps1
+---
+
+## SYNOPSIS
+
+Checks if groups assigned to Entra Private Access (and Quick Access) applications use direct membership (no nested groups).
+
+## SYNTAX
+
+```powershell
+Test-MtGsaPrivateAccessAppAssignmentNotNested [-ProgressAction <ActionPreference>] [<CommonParameters>]
+```
+
+## DESCRIPTION
+
+Microsoft Entra enterprise application assignment grants access to the direct (and dynamic)
+members of an assigned group only - the assignment does not cascade to nested groups, and
+nested group membership is not supported for app assignment.
+Groups assigned to Global Secure
+Access Private Access applications (and the Quick Access app) must therefore use direct
+membership, otherwise members of a nested group are silently left without access.
+
+Note: this only applies to app assignment (appRoleAssignedTo).
+Conditional Access scoping does
+honor nested groups, so the MFA and managed-device coverage checks are not affected.
+
+## EXAMPLES
+
+### EXAMPLE 1
+
+```powershell
+Test-MtGsaPrivateAccessAppAssignmentNotNested
+```
+
+Returns $true if no group assigned to a Private Access or Quick Access application contains a nested group.
+
+## PARAMETERS
+
+### -ProgressAction
+
+Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.
+
+```yaml
+Type: ActionPreference
+Parameter Sets: (All)
+Aliases: proga
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+## OUTPUTS
+
+### System.Boolean
+
+## NOTES
+
+## RELATED LINKS
+
+[https://maester.dev/docs/commands/Test-MtGsaPrivateAccessAppAssignmentNotNested](https://maester.dev/docs/commands/Test-MtGsaPrivateAccessAppAssignmentNotNested)