ScubaGear 2.0: What Changed and How It Checks Microsoft 365

What is ScubaGear?#

ScubaGear is a free, open-source tool from CISA that checks a Microsoft 365 tenant's configuration against the agency's Secure Cloud Business Applications (SCuBA) security baselines and reports every setting that misses. CISA released ScubaGear 2.0 (opens in new tab) on October 28, 2026, calling it the largest update since the tool launched in October 2022.

SCuBA is a CISA project that writes configuration guidance for the cloud services federal civilian agencies use. The Microsoft 365 baselines cover Entra ID, Defender for Office 365, Exchange Online, OneDrive, Power BI, Power Platform, SharePoint Online, and Teams. ScubaGear is the tool that automates checking a tenant against those baselines. Its sibling, ScubaGoggles, does the same job for Google Workspace.

The tool is federal in origin, not federal in scope. Any organization running Microsoft 365 can download it from GitHub (opens in new tab) and run it, and by 2024 CISA reported more than 30,000 downloads. For MSPs, that makes SCuBA one of the few security baselines a client's auditor, insurer, or federal contracting officer is likely to name by name.

What changed in ScubaGear 2.0?#

ScubaGear 2.0 queries every supported Microsoft 365 product through direct REST API calls instead of relying on Microsoft's PowerShell modules to export settings. CISA says the result is faster assessments and more accurate results. That is the whole headline, and for anyone who has run ScubaGear on a Friday afternoon it is a bigger deal than it sounds.

Earlier releases leaned on a stack of Microsoft PowerShell modules (Graph, Exchange Online, Teams, SharePoint, Power Platform) to pull configuration from each workload. Those modules ship on their own schedules, change their own parameters, and fail in their own ways, which is why the project keeps automation just to track module version bumps (opens in new tab). A tenant check that fails because a module updated overnight is not a security finding, but it looks like one until someone reads the error.

The move away from that dependency chain happened in stages. Version 1.6.0 moved Entra ID to direct Graph API calls, and 1.8.0 moved SharePoint and Power Platform to REST calls (opens in new tab). Version 2.0 finishes the job across Exchange Online, Defender for Office 365, Teams, OneDrive, and Power BI.

What did not change matters as much. The baselines, the Rego policy engine, and the report formats are the same, so a 2.0 run is comparable to a 1.x run on the same tenant. ScubaGear still installs as a PowerShell module on Windows, still runs against one tenant at a time, and still produces a report meant for the administrator who ran it. The same release also shipped ScubaGoggles 1.1.0 for Google Workspace, which adds an assured controls baseline and new controls for Gemini.

How does ScubaGear work as a security baseline?#

A security baseline is a published list of settings a tenant should have, written as pass-or-fail policies, and ScubaGear is the tool that checks a Microsoft 365 tenant against CISA's version of that list. The SCuBA baselines state each requirement as a numbered policy with a strength word. SHALL means required, SHOULD means recommended, and the report scores each one as pass, fail, warning, or not applicable.

The tool runs in three steps (opens in new tab):

1. Query. PowerShell code reads the tenant's configuration settings for each supported product through Microsoft's APIs.
2. Compare. It hands those settings to Open Policy Agent (OPA), which evaluates them against policies written in Rego, OPA's policy language. Each Rego rule corresponds to one baseline policy, so the logic is readable and auditable.
3. Report. It writes the results as an HTML report for reading, plus JSON and CSV for anything downstream.

The Microsoft 365 baselines cover eight products: Entra ID, Defender for Office 365, Exchange Online, OneDrive for Business, Power BI, Power Platform, SharePoint Online, and Teams. The checks are the ones most tenant compromises trace back to: legacy authentication left on, MFA not enforced for everyone, external sharing wide open, mailbox auditing off, and conditional access gaps.

Two practical details shape how people use it. Running it takes a Windows machine with PowerShell 5, the ScubaGear module from PSGallery, and an account with enough read access to every workload in the list. And ScubaGear supports a YAML configuration file that records intentional exceptions, so a tenant that deliberately deviates from a policy (a break-glass account exempt from a conditional access rule, say) is reported as a known decision rather than a fresh failure on every run. Without that file, the first run of any real tenant produces a long list, much of it noise the administrator already knows about.

The baselines carry weight outside government because CISA made them binding inside it. Binding Operational Directive 25-01, issued in December 2024, required federal civilian agencies to deploy the SCuBA tools and meet the Microsoft 365 baselines by mid-2025. A baseline that federal agencies are ordered to meet is one that auditors, insurers, and federal contractors' customers tend to ask about next.

What does ScubaGear 2.0 mean for MSPs?#

ScubaGear 2.0 is worth running on at least one tenant this month, because it is free, it is faster than it was, and SCuBA is the baseline a client with federal customers, cyber insurance questionnaires, or an incoming auditor is most likely to name. Knowing what the report says before someone else runs it is cheap insurance.

Where it fits in an MSP practice:

• A second opinion on a tenant you already manage. The Rego policies are public, so a finding is easy to trace back to the exact SCuBA policy ID and the exact setting. That makes it a good cross-check against whatever assessment you already run.
• Onboarding a client with federal or defense exposure. If the client sells to a federal agency, SCuBA is the vocabulary their customer's security team uses. A ScubaGear report in the onboarding file answers a question before it gets asked.
• Validating a hardening project. Run it before and after. The JSON output diffs cleanly.

Where the tool stops and the MSP's work begins:

• It runs in PowerShell. The first reason partners give for not running ScubaGear has nothing to do with its findings. It is a Windows PowerShell 5 session, a module install, and a privileged sign-in, repeated per tenant. Most techs will do that once for a lab tenant and never again for forty clients.
• One tenant per run. Each run authenticates to one tenant. Twenty clients means twenty runs, twenty sets of credentials or GDAP-scoped access, and twenty HTML files to keep straight.
• Admin-facing output. The HTML report is one fixed format written for the person who ran it: no client branding, no score, no prioritization. Turning a list of failed policy IDs into something a client's owner will read, prioritize, and approve budget for is still a manual job.
• One baseline. SCuBA is one list. Most MSP client bases also get asked about CIS Foundations, NIST CSF 2.0, NIST SP 800-171, CMMC, Essential Eight, or Cyber Essentials, depending on the client's industry and geography, and each of those maps to overlapping but different settings.
• Findings, not fixes. ScubaGear tells you a setting misses the baseline. Changing it, documenting the change, and catching it when it drifts back a month later are all outside the tool.
• No history unless you build it. Each run is a snapshot. Trend lines across tenants and over time mean archiving JSON output and building reporting on top of it.

None of those are flaws. ScubaGear was built for a federal administrator checking one agency tenant against one mandated baseline, and 2.0 makes it better at exactly that. The gap is between that job and the job of running security across a book of client tenants.

How does CloudCapsule map tenants to the most trusted baselines?#

CloudCapsule scans every connected Microsoft 365 tenant once and maps the results to each security baseline the MSP selects, so the same tenant can be scored against CIS, NIST, CMMC, Essential Eight, and Cyber Essentials from one scan instead of one tool run per framework. The scan reads more than 200 configuration controls across Entra, Exchange, SharePoint, Teams, Intune, Purview, and Defender, and the first assessment on a new tenant takes under a minute. For scale, the SCuBA Microsoft 365 baselines on CISA's GitHub currently total 109 policies, 100 of which ScubaGear checks automatically, and none of them touch Intune or Defender for Endpoint.

The baseline library covers the lists MSPs are actually asked about:

Each control is mapped once and reported everywhere it applies. A failed MFA enforcement check shows up under every baseline that requires it, CIS, NIST CSF, Essential Eight, and Cyber Essentials, without anyone maintaining a crosswalk spreadsheet. When a publisher revises a baseline, as CIS did from v5 to v6, both versions sit side by side so a client mid-audit on the old version is not forced onto the new one.

Because every tenant is scored the same way, the MSP sees the whole book of business on one screen: which tenants pass which baselines, which controls fail most often across clients, and which single fix would move the most tenants at once. The Analyze tier produces the scan, the scores, and a report formatted for the client, not the administrator. The Manage tier applies the fix through Policy Capsules, then watches for drift and flags the tenant when a setting reverts. That is the other half of the comparison. ScubaGear's job ends at the finding. CloudCapsule carries the same finding through to the change, the record of the change, and the alert when it comes undone.

For the ScubaGear user, the practical pairing is simple: run ScubaGear where a client needs a SCuBA report in CISA's own format, and run CloudCapsule to see that client, and every other client, against the baselines the rest of the book is measured on. Pricing is flat-rate with unlimited tenants, so the twentieth tenant costs the same as the first.