ScubaGear

What it is

A PowerShell assessment module from CISA's SCuBA project. It queries Microsoft 365 configuration APIs, compares settings to Rego policies with Open Policy Agent, and writes HTML, JSON, and CSV reports.

What it helps with

- Measuring an M365 tenant against CISA secure configuration baselines
- Covering Entra ID, Exchange Online, SharePoint, Teams, Power Platform, Power BI, and the Security Suite
- Producing HTML, JSON, and CSV reports for operators and auditors

Who it's for

Microsoft 365 administrators and security teams assessing tenants they own or are authorized to assess.

Worth knowing

It is published on the PowerShell Gallery and needs dependency setup before the first run.

Which Windows PowerShell version do I need?
PowerShell 5 on Windows, because some Microsoft libraries it uses are tied to that edition.

How does it compare with Prowler and PingCastle?
In our view Prowler assesses cloud accounts across providers and PingCastle scores Active Directory and Entra ID risk, while ScubaGear targets CISA's M365 secure configuration baselines.