microsoft/zerotrustassessment

Before you start, review the prerequisites and required permissions and roles. Use PowerShell 7.6 or later for the current source's dependencies; published packages can have different requirements. Windows is needed for full service coverage. A dedicated Windows VM and a fresh PowerShell session help avoid dependency conflicts.

Install the stable package, connect to your tenant, and run the assessment:

Install-PSResource -Name ZeroTrustAssessment -Scope CurrentUser
Connect-ZtAssessment -Tenant contoso.onmicrosoft.com
Invoke-ZtAssessment

Replace contoso.onmicrosoft.com with your tenant's verified domain or GUID. The default output directory is .\ZeroTrustReport; use a new output directory for each fresh run. Protect the reports and exports because they can contain sensitive tenant data.

See the PowerShell guide for app-only certificate authentication, pillar selection and resume behavior, and configuration tuning.

Telemetry is enabled by default, with the tenant ID as its only tenant-specific custom property. Assessment results are not included. Use -DisableTelemetry to opt out; see data handling and telemetry for payload and network-metadata details.