ScubaGear

No entries match these filters. Clear filters

1. docs update Oct 31, 2026 · issue 126

   ScubaGear adds Get-ScubaGearContext command to confirm which account and tenant were used for a run⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   After a scan, verify which account and tenant ScubaGear actually used — useful when running in environments with multiple identities or tenants.
   copy

   $ Get-ScubaGearContext

2. v2.0.0 Oct 22, 2026 · issue 117

   ScubaGear v2.0.0 adds a Security Suite baseline, risky AI agent blocking, Invoke-SCuBADiff, CSV risky-app output, and severity scoring.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.0.0 https://github.com/cisagov/ScubaGear.git
   # already have the repo? check out this version:
   $ git checkout v2.0.0

   └──▷ TRY IT
   Run a full assessment with the new Security Suite baseline included, producing HTML, JSON, and CSV outputs for BOD 25-01 submission.
   copy

   $ Invoke-SCuBA -ConfigFilePath 'C:\scuba\config.yaml' -Organization 'example.onmicrosoft.com' -ProductNames *

   • Adds Invoke-SCuBADiff command to diff two ScubaResults.json runs, enabling change-over-time comparison of assessment outputs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds MS.AAD.9.1v1 policy requiring risky AI agents to be blocked in Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., covering agents with access to tenant resources (requires Entra ID P2 plus Microsoft Agent 365 or M365 E7; not applicable to GCC HighGCC HighA Microsoft 365 cloud environment restricted to US government contractors handling controlled unclassified information, meeting compliance requirements like ITAR and DFARS that standard commercial tenants cannot satisfy./DoD).
   • Adds new MS.SECURITYSUITE baseline (Groups 1–8) covering advanced threat protection — including email attachment blocking, post-delivery scanning, malware quarantine, DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. for PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations., unified audit logging, alert enablement, and anti-spam/anti-phishing controls — replacing the retired Microsoft Defender baseline.
   • Adds a CSV output file and severity scoring to the Risky Apps module, providing spreadsheet-compatible data and risk-based prioritization for remediation.
   • Adds MS.SHAREPOINT.1.3v1, MS.SHAREPOINT.3.1v1, MS.SHAREPOINT.3.2v1, and updated MS.SHAREPOINT.3.3v2 policies to enforce external sharing domain restrictions, 30-day Anyone link expiration, view-only link permissions, and reauthentication limits.

   +5 more show less

   • Adds application management baseline policies MS.AAD.5.5v1, MS.AAD.5.6v1, and MS.AAD.5.7v1 to the Entra ID baseline.
   • Adds tenant domain name to product-specific HTML reports, a Privileged User Table, and new indicators across all HTML reports for easier identification.
   • Adds Power BI policy checks to the baseline.
   • Adds configuration analysis for automatic policy pass detection, reducing manual review burden.
   • Adds near-miss detection for Entra ID (AAD) exclusions, surfacing conditional access policy exclusions that almost match risky patterns.
   • Adds Invoke-SCuBADiff command to diff two ScubaResults.json runs, enabling change-over-time comparison of assessment outputs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds MS.AAD.9.1v1 policy requiring risky AI agents to be blocked in Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., covering agents with access to tenant resources (requires Entra ID P2 plus Microsoft Agent 365 or M365 E7; not applicable to GCC HighGCC HighA Microsoft 365 cloud environment restricted to US government contractors handling controlled unclassified information, meeting compliance requirements like ITAR and DFARS that standard commercial tenants cannot satisfy./DoD).
   • Adds new MS.SECURITYSUITE baseline (Groups 1–8) covering advanced threat protection — including email attachment blocking, post-delivery scanning, malware quarantine, DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. for PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations., unified audit logging, alert enablement, and anti-spam/anti-phishing controls — replacing the retired Microsoft Defender baseline.
   • Adds MS.SHAREPOINT.1.3v1, MS.SHAREPOINT.3.1v1, MS.SHAREPOINT.3.2v1, and updated MS.SHAREPOINT.3.3v2 policies to enforce external sharing domain restrictions, 30-day Anyone link expiration, view-only link permissions, and reauthentication limits.
   • Adds application management baseline policies MS.AAD.5.5v1, MS.AAD.5.6v1, and MS.AAD.5.7v1 to the Entra ID baseline.

   +3 more show less

   • Adds Power BI policy checks to the baseline.
   • Adds configuration analysis for automatic policy pass detection, reducing manual review burden.
   • Adds near-miss detection for Entra ID (AAD) exclusions, surfacing conditional access policy exclusions that almost match risky patterns.

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The Microsoft Defender baseline (MS.DEFENDER.1.1v1, MS.DEFENDER.1.2v1, MS.DEFENDER.1.3v1, MS.DEFENDER.1.4v1, MS.DEFENDER.1.5v1, MS.DEFENDER.4.1v2, MS.DEFENDER.5.1v1, MS.DEFENDER.6.1v1) has been retired and replaced by the new MS.SECURITYSUITE baseline; any configuration or automation referencing these policy IDs will no longer find them.
   • !MS.AAD.3.2v2 now evaluates independently of MS.AAD.3.1v1 — tenants that previously relied on the conditional 'if phishing-resistant MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. has not been enforced' logic will now be evaluated for MFA enforcement unconditionally.
   • !MS.EXO.2.2v3 now accepts SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders. soft fail (~all) as compliant; configurations that enforced hard fail only will pass where they may have previously been used to detect deviations.
3. docs update Oct 4, 2026 · issue 094

   ScubaGear adds Invoke-SCuBADiff to compare two ScubaResults.json files offline and produce JSON, CSV, and HTML delta reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Compare quarterly M365 compliance snapshots to surface policy regressions and improvements between two ScubaGear runs.
   copy

   $ Invoke-SCuBADiff -BeforePath "C:\Runs\Q1\ScubaResults_abc123.json" -AfterPath "C:\Runs\Q2\ScubaResults_def456.json" -OutPath "C:\Runs\Diff\Q1-Q2" -DarkMode

   Rename output artifacts to match an internal naming convention when archiving diff results alongside other quarterly reports.
   copy

   $ Invoke-SCuBADiff -BeforePath "\before\ScubaResults.json" -AfterPath "\after\ScubaResults.json" -OutPath "\diff" -OutJsonFileName "Q2Delta" -OutCsvFileName "Q2Delta" -OutReportFileName "Q2DiffReport"

   • Adds Invoke-SCuBADiff with -BeforePath and -AfterPath parameters to compare two ScubaResults.json files from earlier ScubaGear runs without authenticating to or contacting a tenant.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Outputs DiffResults.json (machine-readable delta with a top-level SchemaVersion), DiffResults.csv (one row per policy for spreadsheets), and DiffReport.html (self-contained, color-coded HTML with a toggle to hide unchanged rows).
   • Supports -OutPath to write all three artifacts to a chosen folder (created if missing), -DarkMode to default the HTML report to a dark theme, and -OutJsonFileName, -OutCsvFileName, -OutReportFileName to override base file names.
   • Returns an object with JsonPath, CsvPath, and ReportPath properties pointing at the three output artifacts.
   • Classifies each control change as NewFail, NewPass, NewWarning, NewPolicy, RemovedPolicy, PolicyVersionUpdate, Unchanged, Errored, Migrated, NewIncorrectResult, NewAutomatedCheck, NewManualCheck, NewOmission, or Other, matching controls on base ID (e.g. MS.AAD.1.1v1 → MS.AAD.1.1) to survive version-suffix increments.

   +2 more show less

   • Carries a built-in Defender/EXO → Security Suite migration table (e.g. MS.DEFENDER.4.1v2 → MS.SECURITYSUITE.3.1v1) derived from scuba-baseline-policy-migrations.csv so retired policies are aligned to their replacements rather than reported as RemovedPolicy.
   • Warns when MetaData.TimestampZulu in the after file is not later than in the before file, guarding against a swapped -BeforePath/-AfterPath pair.

   7 details in Everything

4. docs update Oct 4, 2026 · issue 094

   ScubaGear adds Invoke-SCuBADiff to compare results across two assessment runs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

5. docs update Sep 15, 2026 · issue 075

   ScubaGear consolidates Defender, Exchange Online, and Teams policies into a new securitysuite baseline with migration tooling and validator warnings⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Update an existing config file to use the new Security Suite baseline so ScubaGear runs cleanly without migration warnings.
   yaml copy

   ProductNames:
     - aad
     - securitysuite
     - exo
   
   SecuritySuite:
     MS.SECURITYSUITE.2.1v1:
       SensitiveUsers:
         - jdoe@example.com
   
   OmitPolicy:
     MS.SECURITYSUITE.1.1v1:
       Rationale: 'Handled by our third-party mail gateway.'

   • Replaces the defender product name with securitysuite in ProductNames config; running with defender triggers a validator warning but still works via automatic substitution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces the SecuritySuite: top-level config section to replace the deprecated Defender: section for policy exclusions.
   • Migrates MS.DEFENDER.*, MS.EXO.8–MS.EXO.17, and MS.TEAMS.6–MS.TEAMS.8 policies into new MS.SECURITYSUITE.* policy IDs, with the authoritative mapping in PowerShell/ScubaGear/mappings/scuba-baseline-policy-migrations.csv.
   • Adds built-in configuration validator warnings — prefixed Defender migration warning: and Policy migration warning: — that identify deprecated product names, renamed sections, migrated policy IDs, and removed policy IDs at load time.
   • Supports Start-ScubaConfigApp (Configuration UI) to build or validate updated configuration files, automatically checking product names and policy IDs.
   • Replaces the defender product name with securitysuite in ProductNames config; running with defender triggers a validator warning but still works via automatic substitution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces the SecuritySuite: top-level config section to replace the deprecated Defender: section for policy exclusions.
   • Migrates MS.DEFENDER.*, MS.EXO.8–MS.EXO.17, and MS.TEAMS.6–MS.TEAMS.8 policies into new MS.SECURITYSUITE.* policy IDs, with the authoritative mapping in PowerShell/ScubaGear/mappings/scuba-baseline-policy-migrations.csv.
   • Adds built-in configuration validator warnings — prefixed Defender migration warning: and Policy migration warning: — that identify deprecated product names, renamed sections, migrated policy IDs, and removed policy IDs at load time.

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The defender product name in ProductNames is deprecated and renamed to securitysuite; existing config files using defender will emit warnings on every run until updated.
   • !The top-level Defender: exclusion section in configuration files must be renamed to SecuritySuite: and all policy IDs inside it updated to MS.SECURITYSUITE.* equivalents.
   • !MS.DEFENDER.*, MS.EXO.8–MS.EXO.17, and MS.TEAMS.6–MS.TEAMS.8 policy IDs referenced in OmitPolicy, AnnotatePolicy, or exclusion sections are no longer valid; they must be replaced with the corresponding MS.SECURITYSUITE.* IDs from PowerShell/ScubaGear/mappings/scuba-baseline-policy-migrations.csv, or deleted if their New ID is None.
6. v1.8.0 May 7, 2026 · release notes

   ScubaGear v1.8.0 adds centralized run logging, environment/app/guest exclusions, REST-based data collection, and automated conditional policy checks.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.8.0 https://github.com/cisagov/ScubaGear.git
   # already have the repo? check out this version:
   $ git checkout v1.8.0

   • Adds a centralized logging module that captures data across all ScubaGear runs for audit and troubleshooting.
   • Supports excluding specific Power Platform environments from assessment scope via configuration.
   • Adds application and guest exclusion support, allowing practitioners to scope out known exceptions from policy checks.
   • Moves SharePoint and Power Platform data collection to REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. calls, replacing older methods.
   • Collects legacy Exchange hybrid configuration and dedicated hybrid app configuration data for hybrid environment assessments.

   +4 more show less

   • Conditional access policies now evaluate automatically instead of requiring manual checks, passing when conditions are met.
   • Allows parameter overrides and relaxes product validation in the configuration validator for more flexible run configurations.
   • Enhances Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. policy MS.AAD.7.2v1 with improved detection logic.
   • Adds workflow support to run assessments for individual products rather than requiring a full suite run.

   9 details in Everything

7. v1.7.0 Feb 11, 2026 · release notes

   ScubaGear v1.7.0 adds a config-file GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands., new AAD detections, DNS options, risky app reporting, and a service principal module.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.7.0 https://github.com/cisagov/ScubaGear.git
   # already have the repo? check out this version:
   $ git checkout v1.7.0

   • Adds a GUI for creating ScubaGear configuration files interactively.
   • Adds authentication strength evaluation for policy MS.AAD.3.2v1.
   • Expands risky delegated and application permission detection.
   • Adds DNS configuration options for ScubaGear deployments.
   • Updates MS.AAD.6.1v1 to evaluate non-root domains in addition to root domains.

   +7 more show less

   • Adds risky apps and service principals to the AAD HTML report.
   • Adds a dedicated service principal module to ScubaGear.
   • Implements ScubaConfig validation with JSON schema and defaults.
   • Updates MS.AAD.3.4v1 policy migration state to reflect current enforcement.
   • Sorts conditional access policies by state in output.
   • Enhances module dependency checks and improves Initialize-SCuBA.
   • Removes MS.TEAMS.3.1v1 (Skype user contact restriction) as the underlying Microsoft setting has been deprecated and removed.

   12 details in Everything

8. v1.6.0 Jul 9, 2025 · release notes

   ScubaGear v1.6.0 adds policy annotations, app-permission reporting, DNS log tables, OPAOPAOpen Policy Agent, a CNCF-graduated policy engine that evaluates rules written in the Rego language against JSON-structured data, letting tools enforce authorization and compliance decisions without hardcoding logic. v1.1–1.3 support, and a new device-code-auth block policy.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.6.0 https://github.com/cisagov/ScubaGear.git
   # already have the repo? check out this version:
   $ git checkout v1.6.0

   • Adds capability to annotate results for individual policies; annotations appear in the HTML report's details column.
   • Adds reporting for application and delegated permissions assigned to application/service principal objects.
   • Adds DNS log tables to the Exchange Online HTML report with overhauled DNS error handling.
   • Supports dynamic Graph permissions generation for ScubaGear connections, reducing the Microsoft GraphMicrosoft GraphMicrosoft's unified REST API for accessing data and services across Microsoft 365, Azure AD, and related cloud products, giving cyber tools a single authenticated endpoint to query users, emails, files, and sign-in logs. dependency footprint.
   • Includes results for omitted policies in the ScubaGear results JSON output.

   +6 more show less

   • Extends OPA support to versions v1.1.0 through v1.3.0.
   • Improves Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. performance by switching to direct Graph APIGraph APIMicrosoft's unified REST API for accessing data across Microsoft 365 services — mail, calendar, users, files — letting cyber tools query or monitor cloud environments through a single authenticated endpoint. calls, decreasing total Microsoft Graph dependencies.
   • Adds new SHOULD policy MS.AAD.3.9v1 to block device code authentication.
   • Updates MS.EXO.1.1v2 to allow automatic forwarding for specific, agency-approved domains on an allow list.
   • Updates MS.AAD.3.3v2 so login context checks apply only when Microsoft Authenticator is enabled.
   • Removes MS.AAD.5.4v1 (Microsoft deprecated group-owner app consent), MS.DEFENDER.6.2v1, and MS.EXO.17.2v1 (superseded by updated auditing coverage) from the baseline.

   11 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !MS.AAD.5.4v1 is removed from the baseline; any automation or reporting referencing this policy will no longer find it.
   • !MS.DEFENDER.6.2v1 and MS.EXO.17.2v1 are removed from the baseline; workflows depending on these policy checks will no longer produce results.
   • !MS.SHAREPOINT.1.4v1 is removed from the baseline due to setting deprecation; references to this policy in reports or scripts will no longer be valid.
   • !Get-TenantDetailsFromGraph commandlet is removed due to Azure AD Graph API deprecation; any scripts calling this commandlet will break.
9. v1.5.0 Feb 28, 2025 · release notes

   ScubaGear v1.5.0 adds high-risk app/service-principal detection, privileged SP tables, report UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide., and OPAOPAOpen Policy Agent, a CNCF-graduated policy engine that evaluates rules written in the Rego language against JSON-structured data, letting tools enforce authorization and compliance decisions without hardcoding logic. v1.0.1.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.5.0 https://github.com/cisagov/ScubaGear.git
   # already have the repo? check out this version:
   $ git checkout v1.5.0

   • Identifies high-risk permissions held by Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. registered applications and third-party service principals, surfaced via risky_applications and risky_third_party_service_principals keys in the ScubaResults JSON file.
   • Adds a privileged service principals table to the Azure AD baseline HTML report.
   • Appends a UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. to the ScubaResults JSON filename for unique report identification.
   • New -Scope option on Initialize-SCuBA supports installing the module for AllUsers.
   • Stack traces are now included in error output for easier troubleshooting.

   +6 more show less

   • HTML elements stripped from ScubaResults.json for cleaner machine-readable output.
   • Version update notification displayed on ScubaGear module import.
   • Bumps bundled OPA from v0.69.0 to v1.0.1.
   • SharePoint Online interactive auth now requires only Global Reader role — no longer needs SharePoint Administrator role.
   • Baseline MS.AAD.3.1v1 updated to include device-bound passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. language.
   • Baseline MS.SHAREPOINT.4.2v1 removed following Microsoft's update to custom scripting settings.

   11 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !MS.SHAREPOINT.4.2v1 has been removed from the baseline due to Microsoft's update to custom scripting settings; any automation or reporting referencing this control will no longer find it.
10. v1.4.0 Nov 26, 2024 · release notes

    ScubaGear v1.4.0 adds policy toggling, action-plan CSV output, new M365 assessment checks, and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. mappings across all baselines.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.0 https://github.com/cisagov/ScubaGear.git
    # already have the repo? check out this version:
    $ git checkout v1.4.0

    • Adds policy check toggling via config file, allowing specific policies to be omitted from assessments.
    • New -OutActionPlanFileName parameter generates a dedicated remediation action-plan CSV output.
    • Consolidates results into a single ScubaResults.json by default, with a UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. appended to the filename for uniqueness.
    • New assessment check for MS.DEFENDER.6.2v1 (Defender policy coverage expanded).
    • New policy check for MS.AAD.3.7v1 with support for exclusions.

    +7 more show less

    • New policy check for MS.SHAREPOINT.3.2v1 when running as a service principal.
    • Adds MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. mappings to all M365 secure configuration baselines.
    • Updates MS.AAD.6.1v1 check to account for federated domains.
    • Realigns MS.EXO.2.1v1 and MS.EXO.2.2v2 SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders. assessment checks with updated policies.
    • Enhances CSV output to be consistent with data shown in HTML reports.
    • Adds a backup path to locate the OPAOPAOpen Policy Agent, a CNCF-graduated policy engine that evaluates rules written in the Rego language against JSON-structured data, letting tools enforce authorization and compliance decisions without hardcoding logic. executable in the current directory.
    • Bumps minimum and acceptable OPA version to v0.69.0.

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Individual per-product JSON files are no longer produced by default; output is now a single ScubaResults.json (with UUID in filename). Use -KeepIndividualJSON to restore the previous behavior.
    • !The MS.SHAREPOINT.4.1v1 policy is removed entirely; any config or workflow referencing it will no longer find that check.
    • !MS.SHAREPOINT.1.4v1 check is now set to not-implemented due to a deprecated field, so it will no longer return a pass/fail result.
    • !Minimum accepted OPA version is raised to v0.69.0; older OPA executables will no longer be accepted.
11. v1.3.0 Jun 7, 2024 · release notes

    Adds automated checks for MS.AAD.3.3v1 policy and includes policy group names in ScubaResults.json output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.0 https://github.com/cisagov/ScubaGear.git
    # already have the repo? check out this version:
    $ git checkout v1.3.0

    • Add automated checks for policy MS.AAD.3.3v1 to detect configuration violations for this specific Azure AD baseline requirement
    • Include policyGroupName field in ScubaResults.json output to identify which policy group each result belongs to
    • Include reference URL in ScubaResults.json output for each check result

    3 details in Everything

12. v1.2.0 May 3, 2024 · release notes

    New Install-Module via PSGallery support, New-Config cmdlet, per-product JSON output, and tenant licensing data in HTML reports

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.0 https://github.com/cisagov/ScubaGear.git
    # already have the repo? check out this version:
    $ git checkout v1.2.0

    └──▷ USE IT
    Install ScubaGear directly from the public PowerShell repository without downloading ZIP files manually.
    shell copy

    Install-Module -Name ScubaGear

    Generate a blank configuration file template to start customizing your scanning environment.
    shell copy

    New-Config

    • Adds installation via PowerShell Gallery using the Install-Module cmdlet from PowerShellGet, removing the need for manual ZIP extraction.
    • Introduces the New-Config cmdlet to generate a configuration file template.
    • Enables generation of per-product and merged JSON results via a new option.
    • Adds tenant licensing details to the Azure AD HTML report.
    • Updates MS.AAD.7.2v1 check to use least privilege score.

    +1 more show less

    • Adds authentication methods disabled checks for MS.AAD.3.5.v1.

    6 details in Everything

13. v1.1.0 Feb 1, 2024 · release notes

    Adds Azure AD PIMPIMProtocol Independent Multicast, an IETF routing protocol that distributes IP multicast traffic across networks without depending on a specific unicast routing protocol, letting tools monitor or manipulate multicast group traffic. group support, password expiration checks, tenant licensing output, CLI overrides, and versioned baseline links

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.0 https://github.com/cisagov/ScubaGear.git
    # already have the repo? check out this version:
    $ git checkout v1.1.0

    └──▷ USE IT
    Override the config file's scan_target or output_path directly from the command line without editing YAML
    shell copy

    ScubaGear -c default-config.yaml --cmdline_config_vars 'scan_target: "my-tenant.onmicrosoft.com"; output_dir: "/tmp/report'"

    • Adds --config or CLI parameter overrides for config file variables via cmdline_config_vars
    • Adds automated detection check for MS.AAD.6.1v1 user password expiration
    • Adds Azure AD Privileged Identity Management (PIM) support specifically for groups
    • Includes tenant licensing information in the JSON output artifacts
    • Updates report hyperlinks to point to versioned baseline documents rather than latest

    5 details in Everything

14. v1.0.0 Dec 19, 2023 · release notes

    ScubaGear v1.0 introduces non-NA Power Platform region support and updated baseline policies

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.0 https://github.com/cisagov/ScubaGear.git
    # already have the repo? check out this version:
    $ git checkout v1.0.0

    • Adds support for non-North America regions when running Power Platform assessments
    • Merges SharePoint and OneDrive baselines into a single unified baseline
    • Updates Defender baseline to use preset security policies instead of individual settings
    • Adds unique individual policy IDs and rationale to each policy item in the baselines

    4 details in Everything

15. 0.3.0 Mar 24, 2023 · release notes

    ScubaGear v0.3.0 adds non-interactive auth, custom YAML/JSON configs, Dark Mode UI, and OPAOPAOpen Policy Agent, a CNCF-graduated policy engine that evaluates rules written in the Rego language against JSON-structured data, letting tools enforce authorization and compliance decisions without hardcoding logic. decoupling

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.3.0 https://github.com/cisagov/ScubaGear.git
    # already have the repo? check out this version:
    $ git checkout 0.3.0

    └──▷ USE IT
    Run ScubaGear non-interactively in a CI/CD pipeline using a service principal and a custom config file.
    shell copy

    Invoke-SCuBA -CertificateThumbprint '<thumbprint>' -ConfigFilePath './sample-config-files/sample-config.yaml'

    • Adds -CertificateThumbprint parameter to Invoke-SCuBA for non-interactive authentication via Azure AD service principals
    • Adds -ConfigFilePath parameter to Invoke-SCuBA to specify custom configuration files in YAML or JSON format
    • Adds Dark Mode button to the HTML report UI
    • Decouples the Open Policy Agent (OPA) executable from the repository, allowing users to reference their own version

    4 details in Everything

16. v0.2.0 Dec 16, 2022 · release notes

    New Invoke-SCuBA cmdlet, -M365Environment switch for GCC-H/DOD, and Disconnect-SCuBATenant for multi-tenant workflows in v0.2.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.0 https://github.com/cisagov/ScubaGear.git
    # already have the repo? check out this version:
    $ git checkout v0.2.0

    └──▷ USE IT
    Run an assessment against GCC-H endpoints using the new entry point and environment switch
    shell copy

    Invoke-SCuBA -M365Environment GCC-H -ProductNames *

    • Adds Invoke-SCuBA as the primary entry point for assessments, replacing RunSCuBA.ps1
    • Adds -M365Environment parameter to connect to GCC-H/DOD endpoints
    • Adds Disconnect-SCuBATenant cmdlet and Invoke-SCuBA -DisconnectOnExit option to manage multi-tenant connections

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed RunSCuBA.ps1 script; users must now use the Invoke-SCuBA cmdlet instead
    • !Removed Graph APIGraph APIMicrosoft's unified REST API for accessing data across Microsoft 365 services — mail, calendar, users, files — letting cyber tools query or monitor cloud environments through a single authenticated endpoint. Scope Policy.ReadWRITE.AuthenticationMethod requirement
    • !Renamed Power Platform exclusive -Endpoint parameter to -M365Environment
17. v0.1.0 Oct 20, 2022 · release notes

    ScubaGear v0.1.0 initial alpha release adds Azure AD, Defender, Exchange, SharePoint, Teams, and Power Platform reporting

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.0 https://github.com/cisagov/ScubaGear.git
    # already have the repo? check out this version:
    $ git checkout v0.1.0

    • Initial alpha release of ScubaGear for cybersecurity tooling auditing cloud environments.

    1 detail in Everything