README.md

Monkey365

Monkey365 is a PowerShell-based security assessment framework for Microsoft 365, Microsoft Entra ID, and Azure. It collects configuration data, evaluates it against security rules, and produces reports with the evidence and remediation guidance needed to review each finding.

The module is self-contained: its runtime dependencies are bundled, so it does not require the Azure CLI, Az PowerShell, ExchangeOnlineManagement, or the Microsoft Graph PowerShell SDK.

It helps security professionals, consultants, administrators, and incident responders identify misconfigurations, review cloud security posture, and evaluate environments against industry security best practices and compliance standards.

Monkey365 simplifies Microsoft cloud security assessments without requiring users to learn complex APIs, install multiple Microsoft modules, or navigate multiple administration portals.

Features

• Security posture assessment for:
  • Microsoft 365
  • Azure
  • Microsoft Entra ID
• Coverage for major Microsoft 365 workloads including:
  • Exchange Online
  • SharePoint Online
  • Microsoft Teams
  • Microsoft Purview
  • Microsoft Fabric
• Supports multiple authentication methods including:
  • Interactive authentication
  • Service principals
  • Certificate-based authentication
  • Direct access token authentication
• Declarative security rules and rulesets configured with JSON files
• Structured HTML, JSON, and CSV reporting for automation and analysis workflows
• Support for Azure Public, China, and Government cloud environments
• Collector-based and extensible architecture
• Easy deployment across workstations, jump boxes, automation pipelines, and assessment environments

Quick start

Install Monkey365 from the PowerShell Gallery:

Install-Module -Name monkey365 -Scope CurrentUser
Import-Module monkey365

Run a Microsoft 365 assessment and include Microsoft Entra ID:

$options = @{
    Instance       = 'Microsoft365'
    Collect        = @(
        'ExchangeOnline'
        'MicrosoftTeams'
        'SharePointOnline'
    )
    PromptBehavior = 'SelectAccount'
    IncludeEntraID = $true
    ExportTo       = 'HTML'
}

Invoke-Monkey365 @options

Monkey365 prompts you to sign in when the selected authentication flow requires it. The services available to the scan depend on the permissions granted to the signed-in identity.

Before scanning a production environment, review the installation guide, required permissions, and authentication options.

How it works

Monkey365 separates an assessment into three stages:

1. Collect configuration data from the selected cloud services.
2. Evaluate the collected data with the selected rulesets.
3. Report findings, supporting evidence, and remediation guidance.

Security rules are declarative and configured in JSON files. They are evaluated separately from collectors, so you can add organization-specific checks without changing the scan engine. Review the bundled rules or see Custom checks and rulesets for the configuration model.

Reports and automation

Use -ExportTo to select one or more output formats:

Format	Best suited for
HTML	Interactive review of findings and evidence
JSON	Pipelines, APIs, and structured post-processing
CSV	Spreadsheet analysis and data exchange

The documentation includes details for exporting results, rate limits and retries, and logging.

Rulesets

The bundled rulesets currently include:

• CIS Microsoft Azure Foundations Benchmark v6.0.0
• CIS Microsoft Azure Database Services Benchmark v2.0.0
• CIS Microsoft Azure Compute Services Benchmark v2.0.0
• CIS Microsoft 365 Foundations Benchmark v7.0.0
• Monkey365 Microsoft Entra ID ruleset

A benchmark mapping identifies the control associated with a finding; it does not by itself establish certification or compliance. Review each result in the context of the assessed environment and its licensing, business, and risk requirements.

Authentication and permissions

Monkey365 supports both delegated and application authentication. Support varies by workload—for example, some Microsoft 365 services require a certificate rather than a client secret for app-only access. Use the authentication support matrix before choosing an unattended authentication flow.

Monkey365 is designed to read configuration data and does not remediate or modify cloud resources. Use least-privilege roles and API permissions, protect assessment output as sensitive data, and remove tenant identifiers and secrets before sharing logs or reports.

Documentation

Topic	Link
Install Monkey365	Installation guide
Run a scan	Basic usage
Configure a scan	General options
Choose an authentication flow	Authentication overview
Grant access	Required permissions
Run in a container	Docker guide
Write custom checks	Security checks

For command syntax and examples, use PowerShell's built-in help:

Get-Help Invoke-Monkey365 -Detailed
Get-Help Invoke-Monkey365 -Examples

Detailed installation guides, advanced usage examples, configuration references, and additional documentation are available at:

https://silverhack.github.io/monkey365/

---

Contributing and support

Contributions to code, tests, documentation, collectors, and security checks are welcome. Read CONTRIBUTING.md before opening a pull request and follow the Code of Conduct.

• Ask usage questions in GitHub Discussions.
• Report reproducible bugs through GitHub Issues.
• Follow SECURITY.md to report a vulnerability privately.
• See support for the project's support policy.

Do not post credentials, tokens, tenant data, or unredacted assessment reports in a public issue or discussion.

---

Tip

Give us a Star! If you find Monkey365 useful, please consider starring the repository on GitHub. It helps improve visibility and supports ongoing development.

---

Star History