CISA's SCuBA Secure Configuration Baselines for Microsoft 365: What They Require, How to Check Your Tenant with ScubaGear, and What to Fix First

The project is run by the Cybersecurity and Infrastructure Security Agency, and its Microsoft 365 baselines are published on GitHub in the cisagov/ScubaGear repository, one per product: Entra ID, Exchange Online, SharePoint and OneDrive, Teams, Power Platform, Power BI, and a Security Suite baseline covering the Defender for Office 365 and Purview functions.

Each baseline states its audience: the project "provides guidance and capabilities to secure federal civilian executive branch (FCEB) agencies' cloud business application environments", and "for non-Federal users, the information in this document is being provided 'as is' for INFORMATIONAL PURPOSES ONLY". Read them as a published, versioned list of settings that any organization can adopt in whole or in part.

In December 2024 CISA issued Binding Operational Directive 25-01, which made a subset of the policies mandatory for federal civilian agencies; those policies now carry a "BOD 25-01 Requirement" badge. Third-party reporting puts the deadlines at February 21, 2025 to inventory tenants, April 25, 2025 to deploy the assessment tooling and June 20, 2025 to implement the policies (as reported; the CISA pages were not reachable from our environment). It does not bind a private company, but federal contractors are increasingly asked for the same evidence.

Every requirement has an identifier such as MS.AAD.3.1v1: product, policy group, policy number, version. The key words follow RFC 2119: SHALL is a requirement, SHOULD a recommendation an agency may deviate from with a documented reason. Each policy carries a rationale, a NIST SP 800-53 and MITRE ATT&CK mapping, license requirements beyond Microsoft 365 E3, and implementation steps. Three badges mark each policy: BOD 25-01 Requirement, Automated Check and Requires Configuration (ScubaGear needs your YAML file, for example your approved external domains).

Some of the SHALL policies, quoted from the baselines opened for this article:

• MS.AAD.1.1v1: "Legacy authentication SHALL be blocked."
• MS.AAD.3.1v1: "Phishing-resistant MFA SHALL be enforced for all users."
• MS.AAD.7.1v1: "A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role."
• MS.EXO.4.2v1: "The DMARC message rejection option SHALL be p=reject."

The baselines are explicit that third-party tools count: the Security Suite document says "third-party solutions that offer comparable security functions can be used in lieu of Defender and Purview", and the Entra ID document accepts a third-party privileged access management product in place of Entra ID P2 for the just-in-time role policies.

ScubaGear is a PowerShell module published by CISA under a Creative Commons Zero license. From the README, it "verifies that a Microsoft 365 (M365) tenant's configuration conforms to the policies described in the Secure Cloud Business Applications (SCuBA) Secure Configuration Baseline documents": PowerShell queries the Microsoft 365 APIs, Open Policy Agent compares the settings with Rego policies written from the baselines, and the results are written as HTML, JSON and CSV.

What it needs:

• A Windows computer with PowerShell 5, then Install-Module -Name ScubaGear and Install-ScubaDependencies.
• An account or a service principal. CISA's permissions guide lists Global Reader as the minimum for Entra ID, Exchange Online, the Security Suite, SharePoint and Teams; Power Platform needs Power Platform Administrator, and Power BI needs Fabric Administrator.
• Admin consent for the Microsoft Graph PowerShell application's read permissions (Directory.Read.All, Policy.Read.All, RoleManagement.Read.Directory and a few more), granted by an administrator where user consent is restricted.
• Optionally a YAML configuration file, built by hand or with the Start-ScubaConfigApp wizard, recording approved domains, sensitive accounts and exclusions.

Then Invoke-SCuBA -ProductNames * runs everything, reading only; it does not change tenant settings. Allow an hour for a first run, minutes for repeats, and run Update-ScubaGear first because the checks move.

The HTML report has a page per product with one row per policy: the ID, the requirement, the result and a details column naming the setting or object that produced it. SHOULD policies that fail read as warnings. Policies marked Requires Configuration report against your configuration file, so a blank file leaves gaps; fill it in first.

Three habits make the report useful rather than alarming. Read failures per product, not the total. Separate "we chose this" from "nobody chose this": deliberate external sharing to a named partner domain can be documented, while Anyone links that never expire are a finding. And map each failure to the person who owns the change; half are Exchange and SharePoint settings.

Our assessments of tenants between 20 and 500 seats fail the same policies again and again. In rough order of frequency:

1. Phishing-resistant MFA not enforced (MS.AAD.3.1v1) and SMS, voice and email one-time passcodes still enabled (MS.AAD.3.5v2). Our passkeys rollout order is the fix.
2. Legacy authentication not blocked (MS.AAD.1.1v1), usually for one scanner or application.
3. Global Administrator count (MS.AAD.7.1v1): one person, or a dozen. Permanent role assignments (MS.AAD.7.4v1) fail in every tenant without Entra ID P2 or a PAM product.
4. Users allowed to register applications and consent to them (MS.AAD.5.1v1, 5.2v1), with no admin consent workflow (5.3v1).
5. Password expiration still on (MS.AAD.6.1v1), common in tenants created before October 2021.
6. External auto-forwarding allowed (MS.EXO.1.1v2) and SMTP AUTH enabled tenant-wide (MS.EXO.5.1v1), typically for a printer.
7. DMARC missing or at p=none (MS.EXO.4.1v1, 4.2v1); see the SPF, DKIM and DMARC setup order.
8. SharePoint and OneDrive sharing at Anyone (MS.SHAREPOINT.1.1v1, 1.2v1) and default links wider than "Specific people" (2.1v1, 2.2v1).
9. Teams external access open to all domains (MS.TEAMS.2.1v2) and anonymous users able to start meetings (MS.TEAMS.1.2v2).
10. Audit retention short of the baseline (MS.SECURITYSUITE.5.2v1), no DLP policy (MS.SECURITYSUITE.3.1v1) and none in the default Power Platform environment (MS.POWERPLATFORM.2.1v1).

Fix identity first (items 1 to 5), then mail, then sharing, then logging and DLP. The identity items close the attack paths in why MFA is not enough. Several need licenses: Entra ID P2 for the risk-based and just-in-time role policies (or a PAM product), Defender for Office 365 for Safe Links and Safe Attachments, and E5 or an add-on for longer audit retention and DLP in Teams. Business Premium carries the Entra ID P1 and Defender for Office 365 Plan 1 pieces; Entra ID P1 vs P2 explains what P2 adds.

Microsoft Secure Score is a points system in the Defender portal: Microsoft defines and weights improvement actions, and the score moves as you complete them and as Microsoft adds new ones. It is useful for trend, and improve Secure Score without chasing points explains how to use it without gaming it. But it is Microsoft grading Microsoft, the denominator changes, and a number tells a third party nothing about which settings are on.

SCuBA is the opposite shape: a fixed list of named policies, each pass or fail, with a rationale and a control mapping, checked by a tool anyone can run. That is why it fits a cyber insurance questionnaire and a federal customer's supplier review: "MFA enforced for all users" becomes MS.AAD.3.2v2, Pass, with the policy named. We hand clients the report and a remediation list for that purpose, and re-run the tool after the fixes so the evidence is dated.

If the aim is a tidy tenant rather than a report, what a clean Microsoft 365 tenant should look like and the Conditional Access policies every business should have cover the same ground in plainer terms. SCuBA is the version you can show someone.

What does ScubaGear cost?

Nothing from CISA. It is published under a Creative Commons Zero license on GitHub and installed from the PowerShell Gallery. The cost is the time to run it, the time to fix what it finds, and the Microsoft licenses some policies require.

Do the SCuBA baselines apply to private companies?

Not as a requirement. They apply when a customer, an insurer or your own security policy adopts them, which is happening more often because they are specific and checkable.

Does ScubaGear change anything in my tenant?

No. It reads configuration through the Microsoft APIs and compares it with the baselines; the one side effect is the admin consent for Graph read permissions on first run.

What licenses do I need to pass the baselines?

The baselines assume Microsoft 365 E3 and list what is needed beyond it: Entra ID P2 (or a third-party PAM product), Defender for Office 365, and E5 or add-ons for longer audit retention and DLP in Teams. A Business Premium tenant meets most Entra ID and Defender items and fails the P2 and E5 items unless it adds them or documents an alternative.

• cisagov/ScubaGear on GitHub: README; baselines aad.md, exo.md, securitysuite.md, sharepoint.md, teams.md and powerplatform.md; docs/prerequisites/interactive.md (all opened 2026-09-27; all quotations, license statements, the BOD 25-01 badge, roles and permissions)
• CISA, "Secure Cloud Business Applications (SCuBA) Project" and "BOD 25-01: Implementation Guidance for Implementing Secure Practices for Cloud Services" (referenced by the baselines; cisa.gov was not reachable from our environment)
• BOD 25-01 issue date and deadlines as reported by SC Media, "CISA orders federal agencies to secure Microsoft 365 cloud apps", and Tenable, "CISA BOD 25-01 Compliance: What U.S. Government Agencies Need to Know" (search excerpts opened 2026-09-27); verify on cisa.gov
• IT Partner service pages: content/services/ITPWW140SECOT and ITPWW150CONOT; IT Partner blog articles linked above
• IT Partner engineering notes, September 2026