ScubaGear – Microsoft Cloud baseline security (CISA)

ScubaGear – Secure Cloud Business Applications (SCuBA) Secure Configuration Baseline

ScubeGear was released by CISA and assesses your Microsoft Cloud against “Secure Cloud Business Applications” (SCuBA) baseline policies.

More can be found on CISA’s Github: https://github.com/cisagov/ScubaGear

This post will serve as a quick starting guide.

Update 11 November 2025

ScubaGear now has a YAML config file which you can get here: https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Sample-Config-Files/full_config.yaml

GUI Interface (Release Candidate):

You can install a prerelease vsion of Scubagear that now has a user interface: https://www.powershellgallery.com/packages/ScubaGear/1.7.0-rc1

You can launch the GUI with “Start-ScubaConfigApp“

Useful Commands

Get-Command -Module ScubaGear
Uninstall-Module -Name "ScubaGear"

Download the ScubaGear Powershell application

Download their latest release from Github: https://github.com/cisagov/ScubaGear/releases

(You can also install it directly from Powershell but I prefer the manual approach)

Once downloaded, extract it to e.g. c:\Temp

Installation

(Most of the below is directly from https://github.com/cisagov/ScubaGear/blob/main/docs/installation/github.md)

Navigate to where you extracted it (e.g. C:\temp\ScubaGear-1.4.0\ScubaGear-1.4.0) and run:

Import-Module .\PowerShell\ScubaGear 

Ensure your PowerShell execution policy is set to “Remote Signed”:

Get-ExecutionPolicy

If it is not Remote Signed, then change it:

# Set execution policy to Remote Signed
Set-ExecutionPolicy `
  -ExecutionPolicy RemoteSigned `
  -Scope LocalMachine

Next, initialize Scuba:

Initialize-SCuBA 

And then double check that is is installed successfully:

Invoke-SCuBA -Version

Run ScubaGear

I ran ScubaGear to only assess AAD:

Invoke-SCuBA -ConfigFilePath C:\devstuff\scubagear\config.yml -ProductNames aad

You will need to provide admin consent, so ensure your user can, otherwise approve the consent in https://entra.microsoft.com/ under Admin Consent Requests.

Issue

There seems to be an issue where ScubeGear is looking for the existence of Conditional Access Policies, and if you have none, it fails. See https://github.com/cisagov/ScubaGear/issues/1748

Just create a random Conditional Access Policy to get past this issue.

Your error will look something like the below:

You will notice a new App Registration was created after granting consent with a whole bunch of permissions:

Report

When ScubaGear is done running, it will open a browser with the report. The report is saved on disk here:

The report provides extremely detailed information, with links to external resources by CISA to help you remediate the findings.