This service audits a Microsoft 365 tenant against the secure configuration baselines published by CISA's Secure Cloud Business Applications (SCuBA) project and delivers a compliance report with findings and prioritized recommendations. It is for organizations that want to understand the current security configuration of their Microsoft 365 services and identify non-compliant settings that should be remediated.
SCuBA — Secure Cloud Business Applications — is a project of the U.S. Cybersecurity and Infrastructure Security Agency (CISA) that publishes secure configuration baselines for Microsoft 365 services, together with automated assessment tooling (ScubaGear). IT Partner runs the SCuBA assessment against your tenant, compares the configuration with the CISA baselines, and delivers a compliance report with findings and recommended changes explained in plain language. The report can include recommendations across Microsoft Entra ID (formerly Azure AD), Exchange Online, Microsoft Teams, Microsoft Defender, OneDrive, SharePoint, and Power Platform.
Confirm scope, agree the access and permissions needed for the scan, and schedule the assessment.
Run the SCuBA assessment tooling against the Microsoft 365 tenant. The scan assesses configuration only; no tenant settings are changed.
Analyze the scan output against each SCuBA baseline and compile the compliance report.
Walk through the findings and prioritized recommendations with your team in an easy-to-understand format.
The Microsoft 365 Advanced Security Audit is a security assessment that uses the Secure Cloud Business Applications (SCuBA) framework published by CISA to evaluate a Microsoft 365 tenant against SCuBA secure configuration baselines. IT Partner uses the scan results to produce a report with findings and recommendations so the organization can understand which settings are compliant or non-compliant.
This service is for organizations that want to understand the current security configuration of their Microsoft 365 services and identify settings that should be remediated. It is relevant when an organization needs a baseline view of its Microsoft 365 tenant security posture across core Microsoft 365 services.
The SCuBA-generated report may include recommendations across Microsoft 365 suite offerings such as Microsoft Entra ID (formerly Azure AD), Exchange, Teams, Defender, OneDrive, SharePoint, and Power Platform. The exact findings depend on the tenant configuration and the results returned by the SCuBA scan.
The deliverables include a SCuBA-generated report on the tenant’s compliance with CISA's SCuBA secure configuration baselines, an easy-to-understand version of the report for the client, and findings with recommendations based on the scan results. The service is focused on assessment, reporting, and guidance from the SCuBA results.
The stated scope includes scanning the tenant, analyzing results, generating the report, and reporting findings and recommendations. Remediation work is not specifically listed in the service deliverables, so any implementation of recommended changes should be confirmed separately with IT Partner.
The listed duration is 10 days. During that period, IT Partner runs the SCuBA assessment, analyzes the results, generates the report, and presents findings and recommendations.
The audit is priced at $1,950 per project. Project work is quoted fixed-price in writing before work begins, and you pay after you approve delivery.
The engagement includes a kickoff meeting, a SCuBA scan of the Microsoft 365 tenant, analysis of the scan results and report generation, and reporting of findings and recommendations. This process is designed to give the client a clear view of the tenant’s current alignment with the CISA SCuBA baselines.
The client must grant access to the Microsoft 365 tenant and provide the related permissions needed for the SCuBA scan. The exact permission details should be coordinated during kickoff because access must be sufficient to assess the relevant Microsoft 365 service configurations. IT Partner requests granular, time-bound admin access (GDAP) that you approve — never standing global admin.
The client is responsible for granting access to the Microsoft 365 tenant and related permissions. The client must also provide a dedicated point of contact to work with IT Partner during the assessment.
IT Partner is responsible for using SCuBA to generate a report on the tenant’s compliance with CISA's SCuBA secure configuration baselines. IT Partner also provides the report to the client in an easy-to-understand format and reports the findings and recommendations.
The service description identifies the work as an assessment, scan, analysis, and reporting engagement, not a production migration or configuration change project. Downtime or user impact is not listed as part of the service, but any operational concerns should be confirmed with IT Partner before the scan is scheduled.
The stated service scope is to assess the tenant configuration using SCuBA and provide findings and recommendations. It does not state that IT Partner will change tenant settings as part of the engagement, so clients should not assume remediation or configuration changes are included unless separately agreed.
The report shows the tenant’s compliance with CISA's SCuBA secure configuration baselines based on SCuBA scan results. It includes findings and recommendations that help identify non-compliant Microsoft 365 settings that should be reviewed or remediated.
The engagement is successful when the SCuBA assessment has been completed across the in-scope services, the results have been analyzed, and the client has received and reviewed the compliance report with findings and prioritized recommendations.
After the report is delivered, the client has a documented view of the tenant's compliance with the CISA SCuBA baselines and recommended changes to consider. The service scope does not include post-assessment remediation or ongoing monitoring by default, so follow-up implementation, ongoing monitoring, 24/7 support, or ongoing maintenance should be discussed separately with IT Partner as optional extra-cost add-ons delivered through IT Partner's NOC, third-party support partnerships, and a Microsoft Premier Support agreement.
No, this service is specifically an assessment using the SCuBA framework to evaluate Microsoft 365 tenant configuration against CISA's SCuBA secure configuration baselines. It provides findings and recommendations, but the service does not include continuous monitoring, 24/7 support, ongoing maintenance, managed detection and response, or a broader security operations program by default. Those capabilities are available as optional extra-cost add-ons delivered through IT Partner's NOC, third-party support partnerships, and a Microsoft Premier Support agreement.
Before kickoff, the client should be ready to provide Microsoft 365 tenant access, related permissions, and a dedicated point of contact for coordination. This preparation matters because IT Partner needs tenant access to run the SCuBA scan and a client contact to resolve questions during the engagement.