Hardening Microsoft 365 with CISA's SCuBA baselines and ScubaGear

The most practical way to harden a Microsoft 365 tenant without guessing is to measure it against CISA’s Secure Cloud Business Applications (SCuBA) baselines using ScubaGear, a free assessment tool CISA publishes for that purpose. The baselines describe secure settings for the core Microsoft 365 services, and ScubaGear reports where your tenant matches them and where it does not. The work that follows is a cycle: run, triage, fix, and run again.

What are the SCuBA baselines?

CISA’s Secure Cloud Business Applications (SCuBA) project publishes secure configuration baselines for Microsoft 365 and Google Workspace. The settings they describe are relevant to any organization running these platforms, public or private. For a small or mid-size business, they answer a question that is otherwise hard to settle: what does “configured securely” mean for this tenant, specifically?

The baselines cover the main Microsoft 365 services an organization depends on: identity and sign-in (Entra ID), Exchange Online, Defender, SharePoint and OneDrive, and Teams. Each describes the settings CISA recommends and why.

What does ScubaGear do?

ScubaGear is, in CISA’s words, “a no-cost assessment tool that verifies M365 tenant configuration alignment” with the baselines. It reads your tenant’s configuration and produces a report showing which settings align and which do not. As an assessment tool, its job is to report; changes are made by your administrators.

Google Workspace organizations have an equivalent, ScubaGoggles.

Before running it, follow the project’s documentation for prerequisites and the permissions the account running it needs. Run it from a managed administrative workstation, and treat the output as sensitive: a list of a tenant’s configuration gaps is useful to an attacker too.

Which findings usually matter most?

ScubaGear will typically return a long list on a first run. In most tenants we review, the same handful of areas carry most of the risk, and they are a sensible place to start.

Phishing-resistant MFA. CISA’s phishing-resistant MFA fact sheet calls phishing-resistant MFA “the gold standard” and states that “the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication.” It also notes that “any form of MFA is better than no MFA.” A realistic sequence is to enforce MFA for everyone, then require phishing-resistant methods for administrators first and expand from there.

Legacy authentication. Older protocols that cannot perform modern authentication bypass MFA entirely. Blocking them closes a path that is easy to overlook because nothing appears broken until an attacker uses it.

Administrative roles. Count your Global Administrators. Assign the narrowest role that does the job, keep privileged roles on separate accounts from daily email use, and review membership regularly.

External sharing. SharePoint, OneDrive, and Teams can share with people outside the organization. Decide deliberately who can share externally, with whom, and for how long, rather than accepting defaults set years ago.

Audit logging. If logging is not enabled and retained, you cannot reconstruct what happened after an incident. Confirm audit logs are on and that someone, or something, reviews them.

Email protections. Exchange Online and Defender settings govern how phishing, spoofing, and malicious attachments are handled. These connect directly to business email compromise, which the FBI IC3 2025 Internet Crime Report places among the largest reported loss categories, with about $3.05 billion in reported BEC losses in 2025.

How should you triage the report?

Not every gap is equal, and not every recommendation fits every organization. Sort findings into three groups:

• Fix now: gaps that expose identity or administrative access, such as missing MFA, legacy authentication left open, or excessive Global Administrators.
• Plan and schedule: changes that affect users and need communication first, such as tighter external sharing or phishing-resistant MFA for all staff.
• Accept with a reason: recommendations that conflict with a genuine business need. Write down why, who approved it, and when to revisit it. An accepted risk with a written reason is very different from an unreviewed default.

Test changes that affect sign-in on a pilot group before applying them tenant-wide. Conditional Access mistakes can lock out administrators, so keep a documented break-glass account that is excluded from those policies and monitored closely.

Why run it again?

A tenant drifts. New administrators make changes, Microsoft adds features with their own defaults, and a fix applied under pressure gets reverted. Unaddressed weaknesses add up, and software flaws in particular are a leading entry point: the Verizon 2026 Data Breach Investigations Report found that 31% of breaches now start with software vulnerabilities, “beating stolen passwords as the top way attackers get in.”

A workable cadence for most organizations:

• Run ScubaGear after any significant tenant change, such as a migration, a new security product, or a change of IT provider.
• Run it on a regular schedule, monthly or quarterly, and compare results against the previous report.
• Keep each report as evidence. Auditors, cyber-insurance carriers, and enterprise clients often ask how you know your configuration is secure, and a dated series of reports answers that directly.

How Intelligent Group can help

Intelligent Group runs this cycle as part of our Microsoft 365 management: assessing tenants against the SCuBA baselines, prioritizing findings, making changes with a pilot-first approach, and re-checking for drift. Because so many findings touch mail flow and impersonation, it pairs closely with our email security work, and it sits within our broader cybersecurity services. For the identity side of the picture, see our post on Zero Trust for SMBs.

Frequently asked questions

Is ScubaGear free to use?

Yes. CISA describes ScubaGear as a no-cost assessment tool, and it is published on GitHub. The cost is the staff time to run it, interpret the results, and make changes safely.

Do the SCuBA baselines apply to private companies?

CISA publishes them publicly, and any organization can use them as a reference. Many of the settings, such as MFA, blocking legacy authentication, and limiting administrative roles, are sound practice for any Microsoft 365 tenant.

Will ScubaGear change our tenant settings?

ScubaGear is an assessment tool: CISA describes it as verifying configuration alignment, and its output is a report. Changes are made separately by your administrators, which is why triage and testing matter.

We use Google Workspace. Is there an equivalent?

Yes. The SCuBA project also publishes baselines for Google Workspace, and ScubaGoggles is the corresponding assessment tool.