Monkey365 is a PowerShell module designed for security consultants and DevSecOps teams to automate configuration audits across Microsoft 365, Azure, and Entra ID. It runs over 160 CIS benchmark checks and produces structured HTML, CSV, JSON, or CLIXML reports.
The tool is collector-based, harvesting metadata via PowerShell commands, evaluating it against built-in rules, and generating assessments without requiring complex cloud API setups.
With Monkey365 you can scan for potential misconfigurations and security issues in public cloud accounts according to security best practices and compliance standards, across Azure, Microsoft Entra ID, and Microsoft 365 core applications.
Core Features
- Multi-Cloud Coverage
Scans across Microsoft 365 (Exchange, Teams, SharePoint), Azure subscriptions, and Entra ID in one module. - 160+ CIS Benchmark Rules
Implements CIS Azure Foundations and Microsoft 365 checks out of the box, with plans to support NIST, HIPAA, GDPR, and PCI‑DSS benchmarks - Flexible Output Formats
Exports results in HTML, JSON, CSV, or CLIXML. Ideal for automation or manual review. - Custom Rules Support
Allows configuration via JSON rule files or MkDocs plugins for tailored environments. - CI/CD Friendly Mode
Available as a GitHub Action, enabling integration into pipelines to detect misconfigurations early.
Install and Get Started
Install from PowerShell Gallery:
Install-Module -Name monkey365 -Scope CurrentUser Import-Module monkey365 |
Check available commands:
Get-Command -Module monkey365 Get-Help Invoke-Monkey365 -Detailed |
Run a basic Azure scan:
Invoke-Monkey365 -Instance Azure ` -Collect VirtualMachines,KeyVault,StorageAccounts ` -IncludeEntraID ` -ExportTo HTML |
The output includes a dashboard-style HTML with pass/fail indicators for each compliance check.
Community & Maintenance
- Stars: ~1 000, Forks: 109, actively maintained with regular updates and beta releases.
- Discussions track features requests, such as updating to CIS v3 and improving output formatting.
Final Thoughts
Monkey365 fills a niche for teams that need a portable, scriptable, and benchmark-driven security scanner across Microsoft cloud environments. Its flexibility, compliance focus, and avoidance of commercial dependencies make it a strong candidate for consultants, DevOps teams, and auditors.
You can read more or download Monkey365 here: https://github.com/silverhack/monkey365