cisagov / ScubaGear

[![GitHub Release][github-release-img]][release]
[![PSGallery Release][psgallery-release-img]][psgallery]
[![CI Pipeline][ci-pipeline-img]][ci-pipeline]
[![Functional Tests][functional-test-img]][functional-test]
[![GitHub License][github-license-img]][license]
[![GitHub Downloads][github-downloads-img]][release]
[![PSGallery Downloads][psgallery-downloads-img]][psgallery]
[![GitHub Issues][github-issues-img]][github-issues]
ScubaGear is an assessment tool that verifies that a Microsoft 365 (M365) tenant’s configuration conforms to the policies described in the Secure Cloud Business Applications (SCuBA) Secure Configuration Baseline documents.
> [!NOTE]
> This documentation can be read using GitHub Pages.
## Target Audience
ScubaGear is for M365 administrators who want to assess their tenant environments against CISA Secure Configuration Baselines.
## Overview
ScubaGear uses a three-step process:
- **Step One** - PowerShell code queries M365 APIs for various configuration settings.
- **Step Two** - It then calls Open Policy Agent (OPA) to compare these settings against Rego security policies written per the baseline documents.
- **Step Three** - Finally, it reports the results of the comparison as HTML, JSON, and CSV.
## Key Features
### Baseline Security Coverage
SCuBA controls have been mapped to both NIST SP 800-53 and the MITRE ATT&CK framework.
 - Baselines
 - Microsoft Entra ID: Identity and access management policies
 - Security Suite: Advanced threat protection settings
 - Exchange Online: Email security and compliance configurations
 - Power BI: Cloud-based data visualization tool security settings
 - Power Platform: Low-code application security settings
 - SharePoint: Document collaboration and access controls
 - Teams: Communication and meeting security policies
 - Removed Policies
### Scuba Configuration UI
SCuBA now includes a graphical user interface that makes it easier than ever to create and manage your YAML configuration files. This intuitive tool helps reduce the complexity of manual editing and streamlines the configuration process for your organization.
For more information review the Configuration UI documentation.
#### UI Key Features:
- Launch with `Start-ScubaConfigApp`
- Step-by-step setup wizard covering all configuration options
- Real-time validation with live YAML preview
- Microsoft Graph integration for user and group selection
- Seamless import/export of existing configuration files
> Ideal for users who prefer a visual interface over command-line tools.
### ScubaGear Output
- **HTML Reports**: Interactive, user-friendly compliance reports. Sample BaselineReports.html
- **JSON Output**: Structured results for reporting and parsing. Sample ScubaResults.json
- **CSV Export**: Spreadsheet-compatible data for analysis. Sample ScubaResults.csv
## Getting Started
Before launching **ScubaGear**, it's important to ensure your environment is properly configured. This includes having the necessary dependencies and permissi