ScubaGear is free and good. Here's when it isn't enough.

Here's something most small businesses don't know: the US Cybersecurity and Infrastructure Security Agency publishes a free tool that audits your Microsoft 365 configuration, and it's good.

It's called ScubaGear. It came out of CISA's SCuBA project — Secure Cloud Business Applications — which exists to give federal agencies a defensible security baseline for the cloud services they run on. The baselines are public, the tool is open source, and nothing stops a plumbing company in Texas from using exactly what a federal agency uses.

If you have someone who can run PowerShell and you've never assessed your tenant, close this tab and go run it. Seriously. This article will still be here.

Still reading? Then let's talk about the part nobody mentions.

What it actually does

ScubaGear is a PowerShell module. Per CISA's own description, it queries Microsoft 365 APIs for configuration settings, then uses Open Policy Agent to compare what it found against policies written from the SCuBA baseline documents. It covers Entra ID, Exchange Online, the Defender security suite, SharePoint and OneDrive, Teams, Power Platform and Power BI, and it produces a report showing which baseline policies your tenant passes and fails.

That's a real audit against a real standard, published by a real government agency, for free. There is no catch and no upsell. It's one of the better things in security right now.

The three situations where it isn't enough

None of these are criticisms of the tool. They're the boundaries of what a configuration-baseline scanner is designed to do.

1. When nobody is going to run it twice

This is the big one, and it has nothing to do with the software.

ScubaGear is something a person runs. That person needs PowerShell, needs to install the module and its dependencies, needs permissions in your tenant, and needs to read the output. Then — and this is where it usually falls apart — they need to remember to do it again next quarter, after the settings have drifted, after the new hire got over-permissioned, after somebody disabled a Conditional Access policy to unblock a deadline and never turned it back on.

We've seen the pattern more than once: a business runs ScubaGear once, gets a long report, fixes the two things that were obvious, and never runs it again. The tool did its job perfectly. The program didn't exist.

If you have a person who will own this on a calendar, ScubaGear is excellent. If your honest answer is "our IT guy would do it if we asked," you don't have a program — you have a good intention.

2. When the risk is outside the tenant

ScubaGear grades your Microsoft 365 configuration. That's its scope, and it's an appropriate scope.

It means the tool cannot see the remote desktop port someone opened on your office firewall during the pandemic. Or the old server still answering on a public IP. Or the VPN appliance a version behind. Or the forgotten subdomain pointing at a box nobody has patched since 2023.

That matters because attacks frequently start there and then arrive in your tenant, wearing a valid password. A perfect ScubaGear report and an exposed management interface can coexist happily, and the report will not mention it — correctly, because that was never the question it was asked.

3. When you need to know what to do first

A ScubaGear report tells you which baseline policies fail. It's thorough, which means for a typical tenant it's also long.

What it doesn't tell you is which of those failures connect to each other. An attacker doesn't exploit one misconfiguration — they chain three. A user without MFA, plus a mailbox rule they can create, plus an approval process that trusts email, is an invoice-fraud incident. Those same three findings, scattered across a compliance report, are three medium-severity rows a busy person scrolls past.

Prioritizing by severity gets you a defensible order. Prioritizing by which failures lead somewhere gets you a shorter list that reduces more risk. A baseline scanner isn't built to make that judgement, and shouldn't pretend to.

So which should you use?

Genuinely useful decision, not a sales pitch:

Use ScubaGear if you have a technical person who will own it, you want a defensible audit against a published federal standard, and your compliance conversation is helped by "we assess against CISA SCuBA baselines." That sentence carries weight with auditors and insurers, and it's free.

You need more than ScubaGear if nobody will reliably run it, or you need to know what you expose to the internet, or the person receiving the report can't act on 200 findings without help deciding what matters.

Use both if you're an MSP. Run baseline tooling for the defensible standard, and something continuous for the drift between assessments. They're answering different questions.

Where we fit

Tenant Strike exists for the second case. It connects read-only in about five minutes with nothing to install, runs 130+ checks across Microsoft 365 and Azure plus an outside-in scan of what your domain exposes to the internet, and correlates findings into the multi-step attack paths an intruder would actually use — so the fix list is ordered by what breaks a chain, not just by severity. Every fix is written in plain English with the portal steps and a warning about what it might break. It runs on a schedule and tells you when something drifts, which is the part a person running a script quarterly can't do.

It's read-only by design and never requests permission to change anything — every API endpoint it reads is published on our trust page, generated from the source on every release.

We're not going to tell you it beats a CISA baseline for compliance paperwork. It doesn't — that's not what it's for. But if the honest problem is that nobody's running anything, a tool that runs itself is worth more than a better tool that sits in a repo.

And if you only want the part ScubaGear structurally can't do, the free external scan takes no account and no credentials, reads public records only, and shows you the outside-in view in about ten seconds.