ScubaGear: M365 Security Assessment Tool

What ScubaGear Does

ScubaGear is a PowerShell module CISA built to check a Microsoft 365 tenant against the SCuBA Secure Configuration Baseline documents. It works in three stages: pull the tenant's current settings through Microsoft's own APIs, hand those settings to Open Policy Agent for comparison against Rego rules derived from the baselines, then emit the outcome as an HTML report, a JSON file, and a CSV export.

Target Audience for ScubaGear

ScubaGear is aimed squarely at M365 administrators — the people responsible for actually running the tenant, not general IT staff or end users. If you're the one who owns Entra ID, Exchange Online, SharePoint, Teams, or Power Platform settings and need to prove those settings meet CISA's baselines, especially for a BOD 25-01 submission, this is built for your job specifically. If you just want a general M365 health dashboard without baseline-grading rigor, Microsoft's own Secure Score inside the admin center is a lighter starting point.

Assessing M365 Tenant Security

Checking a Microsoft 365 tenant against CISA's Secure Configuration Baselines by hand means reading seven separate baseline documents and manually comparing each control to live tenant settings — slow, error-prone, and inconsistent from one reviewer to the next. ScubaGear automates that comparison: it pulls current M365 configuration through the platform's own APIs, evaluates it against Rego policies written straight from the SCuBA baselines using Open Policy Agent, and hands back the same HTML/JSON/CSV report every time, whether it's your first run or your fiftieth.

Key Capabilities and Output

• ✓A three-step assessment pipeline: PowerShell pulls current M365 configuration through Microsoft's APIs, Open Policy Agent checks it against Rego rules built from the SCuBA baselines, then the results get written out.
• ✓Seven baseline areas: Microsoft Entra ID, the Security Suite, Exchange Online, Power BI, Power Platform, SharePoint, and Teams, each documented in its own baseline file.
• ✓Controls trace to two frameworks — NIST SP 800-53 and MITRE ATT&CK — per the mappings document the README links to.
• ✓A Scuba Configuration UI, launched with `Start-ScubaConfigApp`, gives you a step-by-step wizard, live YAML preview, and Microsoft Graph integration for picking users and groups instead of hand-editing config files.
• ✓Three report formats per run: an interactive HTML report, a structured JSON file, and a CSV export for spreadsheet work.
• ✓A YAML config file drives exclusions, annotations, and omissions, so accepted risk gets documented instead of silently skipped.
• ✓Built-in maintenance commands: `Update-ScubaGear` for routine updates and `Reset-ScubaGearDependencies` for a full dependency reinstall.

Installing ScubaGear

Installing ScubaGear means PowerShell 5 on Windows — the README's install steps don't cover Linux or macOS. From PSGallery: `Install-Module -Name ScubaGear`, then `Initialize-SCuBA` to pull in the minimum required dependencies, then `Invoke-SCuBA -Version` to confirm it installed correctly. To update later, run `Update-ScubaGear`; for a full dependency reinstall, `Reset-ScubaGearDependencies` (the README says to read the Update Guide first).

Running Your First Assessment

The first run should skip the config file: `Invoke-SCuBA -ProductNames *` reads your tenant's current settings across all products and writes a baseline template without changing anything. On v2.0.0, logging in interactively to a non-commercial tenant (GCC or GCC High) still needs `-M365Environment` passed manually — the README says auto-detection is planned for a later release. From there, copy one of the sample YAML files, edit it to match your intended policies, and rerun with `-ConfigFilePath`. Add `-Organization` for a BOD 25-01 submission, or `-SilenceBODWarnings` for any other use.

Related Assessment Tools

Common Questions About ScubaGear

Best use cases

• •Running a config-free first pass to see your tenant's current M365 posture before deciding what needs fixing.
• •Documenting accepted risk in a YAML file (exclusions, annotations, omissions) so repeat runs don't re-flag decisions you've already made.
• •Preparing a CISA BOD 25-01 submission, which per the README needs the YAML config file and the `-Organization` parameter rather than the defaults.
• •Wiring ScubaGear into unattended pipelines through ScubaConnect, the separate CISA infrastructure project the README names for automating ScubaGear and ScubaGoggles runs.

Related repositories