{
  "@context": [
    "https://www.w3.org/ns/credentials/v2"
  ],
  "type": [
    "VerifiableCredential",
    "BlogPostCredential"
  ],
  "id": "urn:uuid:77892216-eaa2-49ce-99b9-d244f64d654a",
  "issuer": "did:webvh:QmTVQnV3qGxWzWmnmWJAy1zkYswgbUmE95K5qodmAizVfr:mjendza.net",
  "validFrom": "2026-03-15T13:35:32Z",
  "credentialSubject": {
    "title": "Entra ID Four Musketeers",
    "author": "Mateusz Jendza",
    "body": "![enum](/images/musketeers/musketeers.webp)\r\n\r\n## Changelog\r\n- 2025-11-17 initial version\r\n- 2026-01-02 updated Zero Trust Assessment pipeline to publish only HTML files (all others are not needed to display the report)\r\n\r\n## TL;DR\r\n- Maester: Review your tenant configuration using Pester (PowerShell) tests written by the community or customised by you.\r\n- EntraExporter: Export tenant state to JSON files. Review changes between exports and take action.\r\n- ZeroTrustAssessment: Evaluates tenant posture against Zero Trust baseline. Provides the big picture and summary of findings.\r\n- Together they enable repeatable change management, drift detection, and continuous improvement.\r\n\r\n## Introduction\r\nOperating Entra ID at scale requires more than ad-hoc scripting. Configuration must be observable, assessable, repeatable, and improvable. Rather than building custom verification scripts, backup solutions, or assessment frameworks from scratch, leverage three proven tools from Microsoft and the community—collectively known as the Entra ID Three Musketeers: Maester, EntraExporter, and ZeroTrustAssessment. Each addresses a critical piece of the operational lifecycle—governance testing, configuration export, and security assessment—forming a complete loop for identity platform maturity.\r\n\r\nThese tools are battle-tested, actively maintained, and designed specifically for Entra ID operations, eliminating the need to build custom solutions from scratch.\r\n\r\n## Big Picture\r\nThink of the lifecycle:\r\n1. Observe current state (EntraExporter).\r\n2. Assess against policy and Zero Trust benchmarks (ZeroTrustAssessment).\r\n3. Test your Entra ID configuration (Maester).\r\n\r\nThis loop reduces configuration drift, surfaces misalignment early, and embeds security posture reviews inside the delivery pipeline rather than after it.\r\n\r\nThis continuous assessment can be implemented using build agents in Azure DevOps or GitHub Actions, running pipelines daily, weekly, or monthly, depending on your organisation's maturity.\r\n\r\n**Publishing the assessment results in a dedicated place makes it easy to review and act on the findings.** Comparing two runs, whether manual or automated, provides a better understanding of the state of Entra ID.\r\n\r\n### Maester\r\n- PowerShell module for both Windows and Linux runtimes\r\n- Outputs reports in HTML, JSON, or Markdown formats\r\n- Extensible with custom tests\r\n- Supports Service Principal and User Authentication\r\n- Large community and regular updates—1.3.0 is the latest stable release https://github.com/maester365/maester/releases/tag/1.3.0, but in prerelease mode there are many changes https://github.com/maester365/maester/releases/tag/1.3.115-preview\r\n\r\n### Entra Exporter\r\n- PowerShell module compatible with Windows and Linux\r\n- Exports tenant state to JSON files\r\n- Supports Service Principal and User Authentication\r\n\r\n### Zero Trust Assessment\r\n- PowerShell Module (Windows & Visual C++ Redistributable)\r\n- Output as HTML report & db file & JSON files\r\n- Service Principal and User Authentication\r\n\r\n> ZTA root `zta-rexport` directory \r\n> ![zta-result-root-folder](/images/musketeers/zta-result-root-folder.jpg)\r\n\r\n> > Maester report overview\r\n> ![zta-result-one-folder](/images/musketeers/zta-result-one-folder.jpg)\r\n\r\n## Review results\r\n> Maester report overview\r\n> ![Check Maester Report example](/images/musketeers/maester-report.jpg)\r\n> \r\n> Entra Exporter example JSON and folder structure (each configuration peer Authentication Method is a separate JSON file)\r\n> ![Check Entra Exporter example](/images/musketeers/export-result.jpg)\r\n> \r\n> ZeroTrustAssessment demo: https://microsoft.github.io/zerotrustassessment/demo/\r\n> ![Check ZeroTrustAssessment demo](/images/musketeers/assessment.jpg)\r\n\r\n## The Three Tools as Github Actions\r\n### Maester\r\n#### Baseline\r\n- Import ready-to-use GitHub Action step `maester365/maester-action@main`.\r\n- Pipeline based on the Maester documentation.\r\n- Should be extended to include your custom tests.\r\n- Export Report (HTML, JSON, MD) to Build Artefacts.\r\n- Show summary with total files and size.\r\n\r\n```yaml\r\nname: Run Maester 🔥\r\non:\r\n  # push:\r\n  #   branches:\r\n  #     - main\r\n\r\n  # schedule:\r\n  #   # Daily at 7:30 UTC, change accordingly\r\n  #   - cron: \"30 7 * * *\"\r\n\r\n  # Allows to run this workflow manually from the Actions tab\r\n  workflow_dispatch:\r\n\r\njobs:\r\n  test:\r\n    runs-on: ubuntu-latest\r\n    environment: maester-workforce-tenant\r\n    permissions:\r\n      id-token: write\r\n      contents: read\r\n\r\n    steps:\r\n      - name: Run Maester 🔥\r\n        id: maester\r\n        # Set the action version to a specific version, to keep using that exact version.\r\n        uses: maester365/maester-action@main\r\n        with:\r\n          tenant_id: ${{ vars.AZURE_TENANT_ID }}\r\n          client_id: ${{ vars.AZURE_CLIENT_ID }}\r\n          include_public_tests: true\r\n          include_private_tests: false\r\n\r\n          include_exchange: false\r\n          include_teams: false\r\n          # Set a specific version of the powershell module here or 'latest' or 'preview'\r\n          # check out https://www.powershellgallery.com/packages/Maester/\r\n          maester_version: latest\r\n          disable_telemetry: true\r\n          step_summary: true\r\n\r\n      - name: Write status 📃\r\n        shell: bash\r\n        run: |\r\n          echo \"The result of the test run is: ${{ steps.maester.outputs.result }}\"\r\n          echo \"Total tests: ${{ steps.maester.outputs.tests_total }}\"\r\n          echo \"Passed tests: ${{ steps.maester.outputs.tests_passed }}\"\r\n          echo \"Failed tests: ${{ steps.maester.outputs.tests_failed }}\"\r\n          echo \"Skipped tests: ${{ steps.maester.outputs.tests_skipped }}\"\r\n```\r\n> Example screen from pipeline run:\r\n> ![enum](/images/musketeers/maester.jpg)\r\n\r\n\r\n\r\n### Entra Exporter\r\n\r\n#### Baseline\r\n- Simple pipeline based on the EntraExporter documentation.\r\n- Export Config, Applications, ServicePrincipals as a start point (my code).\r\n- Export Configuration (Folders & Json's) to Build Artefacts.\r\n- Show summary with total files and size.\r\n\r\n#### Code\r\n```yaml\r\nname: Run EntraExporter 🚀\r\non:\r\n  push:\r\n    branches:\r\n      - master\r\n\r\n  # schedule:\r\n  #   # Daily at 7:30 UTC, change accordingly\r\n  #   - cron: \"30 7 * * *\"\r\n\r\n  # Allows to run this workflow manually from the Actions tab\r\n  workflow_dispatch:\r\n\r\njobs:\r\n  export:\r\n    runs-on: ubuntu-latest\r\n    environment: entra-exporter-workforce-tenant\r\n    permissions:\r\n      id-token: write\r\n      contents: read\r\n\r\n    steps:\r\n      - name: Checkout repository\r\n        uses: actions/checkout@v4\r\n\r\n      - name: Install PowerShell 7\r\n        uses: actions/setup-dotnet@v4\r\n        with:\r\n          dotnet-version: '8.0.x'\r\n\r\n      - name: Install PowerShell Modules\r\n        shell: pwsh\r\n        run: |\r\n          Install-Module -Name Az -Scope CurrentUser -Force -AllowClobber\r\n          Install-Module -Name Microsoft.Graph -Scope CurrentUser -Force -AllowClobber\r\n          Install-Module -Name Microsoft.Entra -Scope CurrentUser -Force -AllowClobber\r\n          Install-Module -Name EntraExporter -Scope CurrentUser -Force -AllowClobber\r\n      - name: Log in to Azure using OIDC\r\n        uses: azure/login@v2\r\n        with:\r\n          client-id: ${{ vars.AZURE_CLIENT_ID }}\r\n          tenant-id: ${{ vars.AZURE_TENANT_ID }}\r\n          allow-no-subscriptions: true\r\n          enable-AzPSSession: true\r\n          \r\n      - name: Run EntraExporter Export 📦\r\n        shell: pwsh\r\n        run: |          \r\n          $token = (Get-AzAccessToken -ResourceTypeName MSGraph -AsSecureString -ErrorAction Stop).token\r\n          $null = Connect-Entra -AccessToken $token -ErrorAction Stop\r\n          Write-Host \"Starting Entra export...\"\r\n          # Create output directory\r\n          $outputPath = \"${{ github.workspace }}/entra-export\"\r\n          #(Get-Command Export-Entra | Select-Object -Expand Parameters)['Type'].Attributes.ValidValues\r\n          #https://github.com/microsoft/EntraExporter?tab=readme-ov-file#export-options\r\n          New-Item -ItemType Directory -Force -Path $outputPath\r\n          \r\n          # Run EntraExporter\r\n          Export-Entra -Path $outputPath -Type \"Config\", \"Applications\", \"ServicePrincipals\"          \r\n          Write-Host \"Export completed successfully!\"\r\n          \r\n          # List exported files\r\n          Get-ChildItem -Path $outputPath -Recurse\r\n        \r\n      - name: Upload Export Artifacts 📤\r\n        uses: actions/upload-artifact@v4\r\n        with:\r\n          name: entra-export-${{ github.run_number }}\r\n          path: ${{ github.workspace }}/entra-export\r\n          retention-days: 30\r\n\r\n      - name: Export Summary 📊\r\n        shell: pwsh\r\n        run: |\r\n          $exportPath = \"${{ github.workspace }}/entra-export\"\r\n          $fileCount = (Get-ChildItem -Path $exportPath -Recurse -File).Count\r\n          $totalSize = (Get-ChildItem -Path $exportPath -Recurse -File | Measure-Object -Property Length -Sum).Sum\r\n          $sizeInMB = [math]::Round($totalSize / 1MB, 2)\r\n          \r\n          Write-Host \"Export Summary:\"\r\n          Write-Host \"- Total files exported: $fileCount\"\r\n          Write-Host \"- Total size: $sizeInMB MB\"\r\n          Write-Host \"- Artifact name: entra-export-${{ github.run_number }}\"\r\n          \r\n          # Add to GitHub step summary\r\n          @\"\r\n          ## EntraExporter Summary 🚀\r\n          \r\n          - **Total files exported:** $fileCount\r\n          - **Total size:** $sizeInMB MB\r\n          - **Artifact name:** entra-export-${{ github.run_number }}\r\n          - **Retention:** 30 days\r\n          \"@ | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Append\r\n\r\n```\r\nExample screen from pipeline run:\r\n![enum](/images/musketeers/entra-export.jpg)\r\n\r\n### Zero Trust Assessment\r\n#### Baseline\r\n- Simple pipeline based on the Zero Trust Assessment documentation.\r\n- The PowerShell module requires Visual C++ Redistributable to be installed on the build agent - the agent should be windows-latest.\r\n- Like other pipelines, the pipeline will use Workload Federated Identity to authenticate to Entra ID.\r\n- Export Report (HTML) to Build Artefacts.\r\n- Export only HTML file - the 'zt-export' folder is not needed.\r\n- Show summary with total files and size.\r\n\r\n#### Code\r\n```yaml\r\nname: Run Microsoft Zero Trust Assessment 🛡️\r\non:\r\n  push:\r\n    branches:\r\n      - master\r\n\r\n  # schedule:\r\n  #   # Daily at 7:30 UTC, change accordingly\r\n  #   - cron: \"30 7 * * *\"\r\n\r\n  # Allows to run this workflow manually from the Actions tab\r\n  workflow_dispatch:\r\n\r\njobs:\r\n  export:\r\n    runs-on: windows-latest\r\n    environment: microsoft-zta-mjendza\r\n    permissions:\r\n      id-token: write\r\n      contents: read\r\n\r\n    steps:\r\n      - name: Checkout repository\r\n        uses: actions/checkout@v4\r\n\r\n      - name: Install PowerShell 7\r\n        uses: actions/setup-dotnet@v4\r\n        with:\r\n          dotnet-version: '8.0.x'\r\n\r\n      - name: Install Visual C++ Redistributable\r\n        shell: pwsh\r\n        run: |\r\n          Write-Host \"Downloading Visual C++ Redistributable...\"\r\n          $vcRedistUrl = \"https://aka.ms/vs/17/release/vc_redist.x64.exe\"\r\n          $vcRedistPath =  \"vc_redist.x64.exe\"\r\n          \r\n          Invoke-WebRequest -Uri $vcRedistUrl -OutFile $vcRedistPath -UseBasicParsing\r\n          \r\n          Write-Host \"Installing Visual C++ Redistributable...\"\r\n          Start-Process -FilePath $vcRedistPath -ArgumentList '/install', '/quiet', '/norestart' -Wait -NoNewWindow\r\n          \r\n          Write-Host \"Visual C++ Redistributable installed successfully!\"\r\n          Remove-Item -Path $vcRedistPath -Force -ErrorAction SilentlyContinue\r\n\r\n      - name: Install PowerShell Modules\r\n        shell: pwsh\r\n        run: |\r\n          Install-Module -Name ZeroTrustAssessment -Scope CurrentUser -Force -AllowClobber\r\n          Install-Module -Name Az -Scope CurrentUser -Force -AllowClobber\r\n          \r\n      - name: Log in to Azure using OIDC\r\n        uses: azure/login@v2\r\n        with:\r\n          client-id: ${{ vars.AZURE_CLIENT_ID }}\r\n          tenant-id: ${{ vars.AZURE_TENANT_ID }}\r\n          allow-no-subscriptions: true\r\n          enable-AzPSSession: true\r\n          \r\n      - name: Run ZtAssessment 📦\r\n        shell: pwsh\r\n        run: |\r\n          $token = (Get-AzAccessToken -ResourceTypeName MSGraph -AsSecureString -ErrorAction Stop).token\r\n          $outputPath = \"${{ github.workspace }}/entra-zta\"\r\n          # Connect to Microsoft Graph with the access token\r\n          Connect-MgGraph -AccessToken $token -ErrorAction Stop\r\n          Invoke-ZtAssessment -Path $outputPath -ErrorAction Stop\r\n          \r\n          \r\n          Write-Host \"ZtAssessment completed successfully!\"\r\n          \r\n          # List exported files\r\n          Get-ChildItem -Path $outputPath -Recurse\r\n        \r\n      - name: Upload ZtAssessment Artifacts 📤\r\n        uses: actions/upload-artifact@v4\r\n        with:\r\n          name: entra-zta-${{ github.run_number }}\r\n          path: ${{ github.workspace }}/entra-zta/**/*.html\r\n          retention-days: 30\r\n\r\n      - name: ZtAssessment Summary 📊\r\n        shell: pwsh\r\n        run: |\r\n          $exportPath = \"${{ github.workspace }}/entra-zta\"\r\n          $fileCount = (Get-ChildItem -Path $exportPath -Recurse -File).Count\r\n          $totalSize = (Get-ChildItem -Path $exportPath -Recurse -File | Measure-Object -Property Length -Sum).Sum\r\n          $sizeInMB = [math]::Round($totalSize / 1MB, 2)\r\n          \r\n          Write-Host \"ZtAssessment Summary:\"\r\n          Write-Host \"- Total files exported: $fileCount\"\r\n          Write-Host \"- Total size: $sizeInMB MB\"\r\n          Write-Host \"- Artifact name: entra-zta-${{ github.run_number }}\"\r\n          \r\n          # Add to GitHub step summary\r\n          @\"\r\n          ## ZtAssessment Summary 🚀\r\n          \r\n          - **Total files exported:** $fileCount\r\n          - **Total size:** $sizeInMB MB\r\n          - **Artifact name:** entra-zta-${{ github.run_number }}\r\n          - **Retention:** 30 days\r\n          \"@ | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Append\r\n\r\n```\r\n\r\n\r\n## Extra! Terraform for Workload Federated Identity\r\nThe Terraform AzureAD provider can be used to create a dedicated Service Principal for the workload.\r\nBased on the Zero Trust Assessment requirements for Microsoft Graph API permissions from the page: https://learn.microsoft.com/en-us/security/zero-trust/assessment/get-started#connect-to-microsoft-graph-and-microsoft-azure\r\nWe have a list:\r\n```text\r\nAuditLog.Read.All\r\nCrossTenantInformation.ReadBasic.All\r\nDeviceManagementApps.Read.All\r\nDeviceManagementConfiguration.Read.All\r\nDeviceManagementManagedDevices.Read.All\r\nDeviceManagementRBAC.Read.All\r\nDeviceManagementServiceConfig.Read.All\r\nDirectory.Read.All\r\nDirectoryRecommendations.Read.All\r\nEntitlementManagement.Read.All\r\nIdentityRiskEvent.Read.All\r\nIdentityRiskyUser.Read.All\r\nPolicy.Read.All\r\nPolicy.Read.ConditionalAccess\r\nPolicy.Read.PermissionGrant\r\nPrivilegedAccess.Read.AzureAD\r\nReports.Read.All\r\nRoleManagement.Read.All\r\nUserAuthenticationMethod.Read.All\r\n```\r\n\r\nCopying the list into the https://permissions.factorlabs.pl, we can get the corresponding Graph API permission IDs:\r\n![enum](/images/musketeers/permissions-factorlabs.jpg)\r\n\r\nWe will use very similar code for all our resources, each with its own dedicated permissions:\r\n```terraform\r\nmodule \"MicrosoftZTA_ServicePrincipal\" {\r\n  source = \"./modules/service_principal_workload_identity\"\r\n  business_name = \"MicrosoftZTA\"\r\n  enable_workload_identity = true\r\n  subject_identifier = \"repo:mjendza/sandbox-terraform-entra-id:environment:microsoft-zta-workforce-tenant\"\r\n  issuer_url = \"https://token.actions.githubusercontent.com\"\r\n  graph_permissions = [\r\n    \"b0afded3-3588-46d8-8b3d-9842eff778da\",\r\n    \"cac88765-0581-4025-9725-5ebc13f729ee\",\r\n    \"7a6ee1e7-141e-4cec-ae74-d9db155731ff\",\r\n    \"dc377aa6-52d8-4e23-b271-2a7ae04cedf3\",\r\n    \"2f51be20-0bb4-4fed-bf7b-db946066c75e\",\r\n    \"58ca0d9a-1575-47e1-a3cb-007ef2e4583b\",\r\n    \"06a5fe6d-c49d-46a7-b082-56b1b14103c7\",\r\n    \"7ab1d382-f21e-4acd-a863-ba3e13f7da61\",\r\n    \"ae73097b-cb2a-4447-b064-5d80f6093921\",\r\n    \"c74fd47d-ed3c-45c3-9a9e-b8676de685d2\",\r\n    \"6e472fd1-ad78-48da-a0f0-97ab2c6b769e\",\r\n    \"dc5007c0-2d7d-4c42-879c-2dab87571379\",\r\n    \"246dd0d5-5bd0-4def-940b-0421030a5b68\",\r\n    \"37730810-e9ba-4e46-b07e-8ca78d182097\",\r\n    \"9e640839-a198-48fb-8b9a-013fd6f6cbcd\",\r\n    \"4cdc2547-9148-4295-8d11-be0db1391d6b\",\r\n    \"01e37dc9-c035-40bd-b438-b2879c4870a6\",\r\n    \"230c1aed-a721-4c5d-9cb4-a90514e508ef\",\r\n    \"c7fbd983-d9aa-4fa7-84b8-17382c103bc4\",\r\n    \"38d9df27-64da-44fd-b7c5-a6fbac20248f\"\r\n  ]\r\n}\r\n```\r\n#### Basic Module for Service Principal\r\n```terraform\r\nvariable \"graph_permissions\" {\r\n    description = \"List of Graph API permissions\"\r\n    type        = list(string)\r\n    default     = []\r\n}\r\nvariable \"business_name\" {\r\n    description = \"Business name\"\r\n    type        = string\r\n}\r\nvariable \"enable_workload_identity\" {\r\n    description = \"Enable workload identity federation\"\r\n    type        = bool\r\n}\r\nvariable \"subject_identifier\" {\r\n    description = \"Subject identifier for the federated credential\"\r\n    type        = string\r\n}\r\nvariable \"issuer_url\" {\r\n    description = \"Issuer URL for the federated credential\"\r\n    type        = string\r\n}\r\n\r\nresource \"azuread_application\" \"this\" {\r\n  display_name     = \"TF.${var.business_name}.ServicePrincipal\"\r\n  sign_in_audience = \"AzureADMyOrg\"\r\n  api {\r\n    mapped_claims_enabled          = true\r\n    requested_access_token_version = 2\r\n  }\r\n  feature_tags {\r\n    enterprise = true\r\n    gallery    = false\r\n  }\r\n  dynamic \"required_resource_access\" {\r\n    for_each = length(var.graph_permissions) > 0 ? [1] : []\r\n    content {\r\n      # Microsoft Graph\r\n      resource_app_id = \"00000003-0000-0000-c000-000000000000\"\r\n      \r\n      dynamic \"resource_access\" {\r\n        for_each = var.graph_permissions\r\n        content {\r\n          id   = resource_access.value\r\n          type = \"Role\"\r\n        }\r\n      }\r\n    }\r\n  }\r\n}\r\n\r\nresource \"azuread_service_principal\" \"this\" {\r\n  client_id                    = azuread_application.this.client_id\r\n  app_role_assignment_required = false\r\n}\r\n\r\nresource \"azuread_application_federated_identity_credential\" \"this\" {\r\n  count              = var.enable_workload_identity ? 1 : 0\r\n  application_id     = azuread_application.this.id\r\n  display_name       = \"${var.business_name}-federated-credential\"\r\n  description        = \"Workload Identity Federation for ${var.business_name}\"\r\n  audiences          = [\"api://AzureADTokenExchange\"]\r\n  issuer             = \"${var.issuer_url}\"\r\n  subject            = var.subject_identifier\r\n}\r\n\r\noutput \"application_id\" {\r\n  value = azuread_application.this.id\r\n}\r\n\r\noutput \"application_client_id\" {\r\n  value = azuread_application.this.client_id\r\n}\r\n\r\noutput \"service_principal_id\" {\r\n  value = azuread_service_principal.this.id\r\n}\r\n```\r\n\r\n## Summary\r\n- Secure workflows with GitHub Actions and Workload Federated Identity, eliminating the need for secrets.\r\n- Maintain a clear, versioned history of your configuration with artefacts.\r\n- Quick and straightforward initial setup.\r\n- Seamless adoption of new tools using the Terraform AzureAD provider and Factorlabs Entra ID Permissions website for efficient Graph API permission mapping.\r\n\r\n## What next?\r\n- Compare two Entra Exports via Maester diff: https://github.com/maester365/maester/pull/995\r\n\r\n## Links\r\n- Backstage foundation post: https://mjendza.net/post/backstage-for-entra-operations\r\n- Entra ID docs: https://learn.microsoft.com/entra/\r\n- Terraform provider (reference): https://registry.terraform.io/providers/hashicorp/azuread/latest\r\n- Zero Trust guidance: https://learn.microsoft.com/en-us/security/zero-trust/assessment/overview\r\n- Maester: https://maester.dev/\r\n- EntraExporter: https://github.com/microsoft/EntraExporter\r\n- Entra ID Permissions (Factorlabs): https://permissions.factorlabs.pl",
    "datePublished": "2025-11-17",
    "url": "/post/entra-musketeers",
    "description": "Maester, EntraExporter and ZeroTrustAssessment via Github Actions",
    "tags": [
      "Entra-Id",
      "Assessment"
    ]
  },
  "proof": {
    "type": "DataIntegrityProof",
    "cryptosuite": "eddsa-jcs-2022",
    "verificationMethod": "did:key:z6MksoqpqENZmzzA4nhCPkfcbWtRHVegGV38Yqu2arRc5Er2#z6MksoqpqENZmzzA4nhCPkfcbWtRHVegGV38Yqu2arRc5Er2",
    "created": "2026-03-15T13:35:32Z",
    "proofPurpose": "assertionMethod",
    "proofValue": "z5HeWuGb8ddvWmeBCCfjV13tCJYXFj7VJVXSLY2cooMTKx86wfphorCCz1CBmeharbMUgDBb5ZyZxpuzGyoX6QCQY"
  }
}