ConfigCobra vs Maester
Maester is a free, open-source PowerShell test framework that lets you write and run security tests for Microsoft 365 and Entra from a pipeline, which suits teams that want security as code. ConfigCobra is a read-only platform that covers Microsoft 365, Azure, Google Cloud and AWS with CIS benchmark checks, an inventory, impact analysis and reports, which suits teams that want those results without maintaining scripts.
At a glance
| ConfigCobra | Maester | |
|---|---|---|
| What it is | A platform you connect to your cloud accounts with read-only access. It runs CIS benchmark checks and also holds an inventory, impact analysis, monitoring and reports. No agents to install. | An open-source, PowerShell-based test automation framework for monitoring Microsoft 365 security configuration. A separate product, Maester Cloud, is described on maester.cloud |
| Clouds covered | Microsoft 365, Azure, Google Cloud and AWS | Microsoft 365 and Entra. Its docs also mention optional connections to Azure, Exchange Online, Teams, GitHub and Azure DevOps, and list a suite for on-premises Active Directory. The pages fetched do not list AWS or Google Cloud |
| Benchmarks / checks | CIS Microsoft 365 Foundations v7.0.0 (160 controls, Level 1 and 2); four CIS Azure benchmarks (339 controls); CIS Google Cloud Platform Foundation v5.0.0 (93 controls); four CIS AWS benchmarks (306 controls) | Test suites named on its site: Maester, EIDSCA, CISA SCuBA, ORCA and a CIS suite (its homepage names CIS Microsoft 365 Foundations Benchmark v3.1.0). You can also write your own tests |
| Asset inventory (what objects it collects) | One inventory across clouds. Microsoft 365: users, guests, admins, groups, devices, enterprise apps, app registrations, mailboxes, SharePoint sites, policies, domains, licences, directory roles. Azure, Google Cloud and AWS: resources with their security properties | No general inventory documented. Results can optionally list the objects each run touched (opt-in, makes the report larger) |
| Risk views (inactive users, guests, app secrets…) | Built-in views such as users inactive 90 days, guests who never signed in, groups without owner, expired or soon-expiring app credentials, high-privilege app permissions | Not documented |
| Cost and licence savings (unused paid licences, licences of inactive users, unattached disks) | Unused paid licences view; unattached disks view (Azure). The inventory also holds licences and the users-inactive-90-days view | Not documented |
| Remediation impact analysis (what a fix changes before you apply it) | Yes. For a failing control it shows what changes in your environment if you apply the fix, with an impact level of High, Medium, Low or None | Conditional Access What-If tests, to check the effect of a policy change before it is applied. Every test ships with remediation steps and portal links |
| Drift monitoring and scheduled scans | Yes. Daily, weekly or monthly scans of any mix of controls or rule sets; you are alerted when a control regresses | Schedule runs from GitHub Actions, Azure DevOps, GitLab, Azure Automation and similar; the homepage says you can be alerted when posture drifts. Maester Cloud's page describes run-to-run diffs and long history |
| Notifications | Email, for findings and drift | Email, Teams and Slack (README and alerts docs) |
| Reports and evidence | PDF report with findings, evidence and a timestamped tenant snapshot; audit-ready evidence export; CSV export of the inventory; read-only auditor seat | Interactive HTML report; CSV, Excel, JSON and Markdown exports |
| AI assistant (MCP) | Yes, a native MCP server for MCP-compatible assistants, answering from live scan data | Not documented |
| Multi-tenant / MSP use | Yes, one workspace for several tenants | Yes. Run per tenant with its own service connection, then merge the JSON results into one HTML report with a tenant switcher |
| How it runs (install, agent, SaaS, script) | Web platform, nothing to install in the tenant | PowerShell module from the PowerShell Gallery (README: PowerShell 7.4 or later on Windows, Linux or macOS); GitHub Action; pipelines |
| Access it needs | Read-only. Microsoft 365: read-only Microsoft Graph permissions. Azure: Reader plus a read-only Graph policy permission, certificate-based app registration. Google Cloud: read-only service account. AWS: read-only assume-role | Microsoft Graph permissions requested by Connect-Maester; non-admin accounts need an admin to grant consent first. Optional tests need extra roles, for example an Exchange role. A custom app registration is an option |
| Licence / pricing model | 14-day free trial with full access; then an annual subscription sized by licensed Microsoft 365 users, or a per-tenant assessment licence for MSPs and auditors | MIT licence (free). Maester Cloud's page lists a paid self-hosted plan with a monthly price, and a hosted plan as coming soon |
What Maester does well
Maester describes itself as a test automation framework, and that is where it is strongest. Everything is a test written in PowerShell, so a team can keep its own security policies in version control and run them on every change. The project's introduction explains the idea with a Conditional Access example: if someone deletes a group a policy depends on, a test can catch it.
- Your own tests. You can write custom tests, per-tenant configuration and test parameters.
- Several baselines in one run. Its site lists suites based on CISA SCuBA, EIDSCA and ORCA next to a CIS suite, and a Maester community suite.
- Pipelines. It documents setup for GitHub, Azure DevOps, GitLab and Azure Automation, including sign-in without stored secrets through workload identity federation on GitHub and Azure DevOps.
- Conditional Access what-if. Tests that check a policy change before you make it are a documented feature.
- Alerts and exports. Email, Teams and Slack alerts, and results in CSV, Excel, HTML, JSON or Markdown.
- Cost and openness. The core is MIT licensed and free to use, and the project states its core tests will stay open source.
Where ConfigCobra is different
Maester is a framework you run and extend. ConfigCobra is a platform you connect once; the checks, schedule and reports are already there. It never changes your tenant, and it covers more than the Microsoft 365 benchmark.
CSPM
CIS benchmarks for four clouds: Microsoft 365 v7.0.0 (160 controls), Azure (four benchmarks, 339 controls), Google Cloud v5.0.0 (93 controls) and AWS (four benchmarks, 306 controls). Each finding comes with evidence and a severity estimate, which is ConfigCobra's own estimate for prioritising fixes, since CIS publishes no severity. Rule sets and a dashboard are included.
Inventory & Insights
One inventory across clouds with a per-cloud and an All clouds view. On Microsoft 365 it collects users, guests, admins, groups, devices, enterprise apps, app registrations, mailboxes, SharePoint sites, policies, domains, licences and directory roles. Built-in risk views include users inactive 90 days, guests who never signed in and expired app credentials. A relation graph shows how objects connect, findings link to the objects they concern, and the inventory exports to CSV.
Cost & licence optimisation
The unused paid licences view and, on Azure, the unattached disks view sit in the same inventory, next to licences and the inactive-user view.
Remediation impact analysis
Maester's what-if tests focus on Conditional Access. ConfigCobra's impact analysis works for a failing control on all four clouds and lists the users, groups, mailboxes, apps, policies or resources affected, with the effect, a confidence level and a prepare step.
Monitoring, reports, AI and teams
The scheduler runs daily, weekly or monthly with any mix of controls or rule sets, drift detection alerts you when a control regresses, and notifications go out by email. Reports include a PDF with a timestamped tenant snapshot and an audit-ready evidence export, and a read-only auditor seat lets clients or external auditors in. A native MCP server lets an MCP-compatible assistant answer questions from live scan data. A multi-tenant workspace holds subsidiaries or client tenants together.
Which one to choose
- Choose Maester if your team writes PowerShell, wants tests in version control, needs custom checks, or wants Conditional Access what-if tests inside a pipeline. It is free to run.
- Choose ConfigCobra if you need Azure, Google Cloud or AWS next to Microsoft 365, want an inventory and risk views, or want an assessment and reports without running scripts.
- Use both if you want custom tests in your pipeline and a broader read-only view with scheduled scans, impact analysis and evidence for others.
How to move or run them side by side
- List the checks your own Maester tests cover that are not in a CIS benchmark. ConfigCobra has no custom controls, so keep those in Maester.
- Connect the tenant to ConfigCobra with its read-only access. Nothing changes in the tenant, and your Maester runs are not touched.
- Start the 14-day free trial, which has full access, and run a scan. Compare the failing controls with your latest Maester report.
- Use the impact analysis for any failing control before you change a setting, then re-run your Maester Conditional Access what-if tests to check the policy change.
- Set a ConfigCobra schedule and email notifications, and keep Maester in the pipeline for your custom tests.
- If you retire Maester, export your test list first. Its custom tests stay in your repository.
Facts about Maester come from its own documentation, last checked 2026-10-18. Check its site for current details.
Sources
- raw.githubusercontent.comhttps://raw.githubusercontent.com/maester365/maester/main/README.md
- raw.githubusercontent.comhttps://raw.githubusercontent.com/maester365/maester/main/LICENSE
- maester.devhttps://maester.dev/
- maester.devhttps://maester.dev/docs/intro
- maester.devhttps://maester.dev/docs/installation
- maester.devhttps://maester.dev/docs/connect-maester/
- maester.devhttps://maester.dev/docs/tests/
- maester.devhttps://maester.dev/docs/multi-tenant/overview
- maester.devhttps://maester.dev/docs/export-results
- maester.devhttps://maester.dev/docs/monitoring/
- maester.devhttps://maester.dev/docs/alerts/
- maester.cloudhttps://maester.cloud
Facts about Maester come from its public documentation, last checked 17 Oct 2026. Product names and trademarks belong to their owners. Spotted something out of date? Tell us.
Related pages
See where your cloud stands
ConfigCobra checks Microsoft 365, Azure, Google Cloud and AWS against the CIS benchmarks, read-only.