https://cybertoolchain.io/tools/scubagear New releases and features in ScubaGear, tracked by The Cyber Toolchain. en Thu, 22 Oct 2026 21:22:11 GMT https://github.com/cisagov/ScubaGear/releases/tag/v2.0.0 https://github.com/cisagov/ScubaGear/releases/tag/v2.0.0 Thu, 22 Oct 2026 21:22:11 GMT ScubaGear v2.0.0 adds a Security Suite baseline, risky AI agent blocking, `Invoke-SCuBADiff`, CSV risky-app output, and severity scoring.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Invoke-SCuBADiff` command to diff two `ScubaResults.json` runs, enabling change-over-time comparison of assessment outputs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `MS.AAD.9.1v1` policy requiring risky AI agents to be blocked in Entra ID, covering agents with access to tenant resources (requires Entra ID P2 plus Microsoft Agent 365 or M365 E7; not applicable to GCC High/DoD). • Adds new `MS.SECURITYSUITE` baseline (Groups 1–8) covering advanced threat protection — including email attachment blocking, post-delivery scanning, malware quarantine, DLP for PII, unified audit logging, alert enablement, and anti-spam/anti-phishing controls — replacing the retired Microsoft Defender baseline. • Adds a CSV output file and severity scoring to the Risky Apps module, providing spreadsheet-compatible data and risk-based prioritization for remediation. • Adds `MS.SHAREPOINT.1.3v1`, `MS.SHAREPOINT.3.1v1`, `MS.SHAREPOINT.3.2v1`, and updated `MS.SHAREPOINT.3.3v2` policies to enforce external sharing domain restrictions, 30-day 'Anyone' link expiration, view-only link permissions, and reauthentication limits. • Adds application management baseline policies `MS.AAD.5.5v1`, `MS.AAD.5.6v1`, and `MS.AAD.5.7v1` to the Entra ID baseline. • Adds tenant domain name to product-specific HTML reports, a Privileged User Table, and new indicators across all HTML reports for easier identification. • Adds Power BI policy checks to the baseline. • Adds configuration analysis for automatic policy pass detection, reducing manual review burden. • Adds near-miss detection for Entra ID (AAD) exclusions, surfacing conditional access policy exclusions that almost match risky patterns. Breaking changes: • The Microsoft Defender baseline (`MS.DEFENDER.1.1v1`, `MS.DEFENDER.1.2v1`, `MS.DEFENDER.1.3v1`, `MS.DEFENDER.1.4v1`, `MS.DEFENDER.1.5v1`, `MS.DEFENDER.4.1v2`, `MS.DEFENDER.5.1v1`, `MS.DEFENDER.6.1v1`) has been retired and replaced by the new `MS.SECURITYSUITE` baseline; any configuration or automation referencing these policy IDs will no longer find them. • `MS.AAD.3.2v2` now evaluates independently of `MS.AAD.3.1v1` — tenants that previously relied on the conditional 'if phishing-resistant MFA has not been enforced' logic will now be evaluated for MFA enforcement unconditionally. • `MS.EXO.2.2v3` now accepts SPF soft fail (`~all`) as compliant; configurations that enforced hard fail only will pass where they may have previously been used to detect deviations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/scubagear https://github.com/cisagov/ScubaGear/releases/tag/v1.8.0 https://github.com/cisagov/ScubaGear/releases/tag/v1.8.0 Thu, 07 May 2026 21:44:29 GMT ScubaGear v1.8.0 adds centralized run logging, environment/app/guest exclusions, REST-based data collection, and automated conditional policy checks. • Adds a centralized logging module that captures data across all ScubaGear runs for audit and troubleshooting. • Supports excluding specific Power Platform environments from assessment scope via configuration. • Adds application and guest exclusion support, allowing practitioners to scope out known exceptions from policy checks. • Moves SharePoint and Power Platform data collection to REST API calls, replacing older methods. • Collects legacy Exchange hybrid configuration and dedicated hybrid app configuration data for hybrid environment assessments. • Conditional access policies now evaluate automatically instead of requiring manual checks, passing when conditions are met. • Allows parameter overrides and relaxes product validation in the configuration validator for more flexible run configurations. • Enhances Entra ID policy MS.AAD.7.2v1 with improved detection logic. • Adds workflow support to run assessments for individual products rather than requiring a full suite run. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/scubagear https://github.com/cisagov/ScubaGear/releases/tag/v1.6.0 https://github.com/cisagov/ScubaGear/releases/tag/v1.6.0 Wed, 09 Jul 2025 00:48:11 GMT ScubaGear v1.6.0 adds policy annotations, app-permission reporting, DNS log tables, OPA v1.1–1.3 support, and a new device-code-auth block policy. • Adds capability to annotate results for individual policies; annotations appear in the HTML report's details column. • Adds reporting for application and delegated permissions assigned to application/service principal objects. • Adds DNS log tables to the Exchange Online HTML report with overhauled DNS error handling. • Supports dynamic Graph permissions generation for ScubaGear connections, reducing the Microsoft Graph dependency footprint. • Includes results for omitted policies in the ScubaGear results JSON output. • Extends OPA support to versions v1.1.0 through v1.3.0. • Improves Entra ID performance by switching to direct Graph API calls, decreasing total Microsoft Graph dependencies. • Adds new SHOULD policy MS.AAD.3.9v1 to block device code authentication. • Updates MS.EXO.1.1v2 to allow automatic forwarding for specific, agency-approved domains on an allow list. • Updates MS.AAD.3.3v2 so login context checks apply only when Microsoft Authenticator is enabled. • Removes MS.AAD.5.4v1 (Microsoft deprecated group-owner app consent), MS.DEFENDER.6.2v1, and MS.EXO.17.2v1 (superseded by updated auditing coverage) from the baseline. Breaking changes: • MS.AAD.5.4v1 is removed from the baseline; any automation or reporting referencing this policy will no longer find it. • MS.DEFENDER.6.2v1 and MS.EXO.17.2v1 are removed from the baseline; workflows depending on these policy checks will no longer produce results. • MS.SHAREPOINT.1.4v1 is removed from the baseline due to setting deprecation; references to this policy in reports or scripts will no longer be valid. • Get-TenantDetailsFromGraph commandlet is removed due to Azure AD Graph API deprecation; any scripts calling this commandlet will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/scubagear https://github.com/cisagov/ScubaGear/releases/tag/v1.5.0 https://github.com/cisagov/ScubaGear/releases/tag/v1.5.0 Fri, 28 Feb 2025 20:01:12 GMT ScubaGear v1.5.0 adds high-risk app/service-principal detection, privileged SP tables, report UUIDs, and OPA v1.0.1. • Identifies high-risk permissions held by Entra ID registered applications and third-party service principals, surfaced via `risky_applications` and `risky_third_party_service_principals` keys in the ScubaResults JSON file. • Adds a privileged service principals table to the Azure AD baseline HTML report. • Appends a UUID to the ScubaResults JSON filename for unique report identification. • New `-Scope` option on `Initialize-SCuBA` supports installing the module for `AllUsers`. • Stack traces are now included in error output for easier troubleshooting. • HTML elements stripped from ScubaResults.json for cleaner machine-readable output. • Version update notification displayed on ScubaGear module import. • Bumps bundled OPA from v0.69.0 to v1.0.1. • SharePoint Online interactive auth now requires only Global Reader role — no longer needs SharePoint Administrator role. • Baseline MS.AAD.3.1v1 updated to include device-bound passkeys language. • Baseline MS.SHAREPOINT.4.2v1 removed following Microsoft's update to custom scripting settings. Breaking changes: • MS.SHAREPOINT.4.2v1 has been removed from the baseline due to Microsoft's update to custom scripting settings; any automation or reporting referencing this control will no longer find it. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/scubagear https://github.com/cisagov/ScubaGear/releases/tag/v1.4.0 https://github.com/cisagov/ScubaGear/releases/tag/v1.4.0 Tue, 26 Nov 2024 20:49:29 GMT ScubaGear v1.4.0 adds policy toggling, action-plan CSV output, new M365 assessment checks, and MITRE ATT&CK mappings across all baselines. • Adds policy check toggling via config file, allowing specific policies to be omitted from assessments. • New `-OutActionPlanFileName` parameter generates a dedicated remediation action-plan CSV output. • Consolidates results into a single `ScubaResults.json` by default, with a UUID appended to the filename for uniqueness. • New assessment check for MS.DEFENDER.6.2v1 (Defender policy coverage expanded). • New policy check for MS.AAD.3.7v1 with support for exclusions. • New policy check for MS.SHAREPOINT.3.2v1 when running as a service principal. • Adds MITRE ATT&CK mappings to all M365 secure configuration baselines. • Updates MS.AAD.6.1v1 check to account for federated domains. • Realigns MS.EXO.2.1v1 and MS.EXO.2.2v2 SPF assessment checks with updated policies. • Enhances CSV output to be consistent with data shown in HTML reports. • Adds a backup path to locate the OPA executable in the current directory. • Bumps minimum and acceptable OPA version to v0.69.0. Breaking changes: • Individual per-product JSON files are no longer produced by default; output is now a single `ScubaResults.json` (with UUID in filename). Use `-KeepIndividualJSON` to restore the previous behavior. • The MS.SHAREPOINT.4.1v1 policy is removed entirely; any config or workflow referencing it will no longer find that check. • MS.SHAREPOINT.1.4v1 check is now set to `not-implemented` due to a deprecated field, so it will no longer return a pass/fail result. • Minimum accepted OPA version is raised to v0.69.0; older OPA executables will no longer be accepted. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/scubagear https://github.com/cisagov/ScubaGear/releases/tag/v1.1.0 https://github.com/cisagov/ScubaGear/releases/tag/v1.1.0 Thu, 01 Feb 2024 19:17:44 GMT Adds Azure AD PIM group support, password expiration checks, tenant licensing output, CLI overrides, and versioned baseline links • Adds `--config` or CLI parameter overrides for config file variables via `cmdline_config_vars` • Adds automated detection check for MS.AAD.6.1v1 user password expiration • Adds Azure AD Privileged Identity Management (PIM) support specifically for groups • Includes tenant licensing information in the JSON output artifacts • Updates report hyperlinks to point to versioned baseline documents rather than latest Full history on Cyber Toolchain: https://cybertoolchain.io/tools/scubagear https://github.com/cisagov/ScubaGear/releases/tag/v1.0.0 https://github.com/cisagov/ScubaGear/releases/tag/v1.0.0 Tue, 19 Dec 2023 21:26:31 GMT ScubaGear v1.0 introduces non-NA Power Platform region support and updated baseline policies • Adds support for non-North America regions when running Power Platform assessments • Merges SharePoint and OneDrive baselines into a single unified baseline • Updates Defender baseline to use preset security policies instead of individual settings • Adds unique individual policy IDs and rationale to each policy item in the baselines Full history on Cyber Toolchain: https://cybertoolchain.io/tools/scubagear https://github.com/cisagov/ScubaGear/releases/tag/0.3.0 https://github.com/cisagov/ScubaGear/releases/tag/0.3.0 Fri, 24 Mar 2023 20:23:03 GMT ScubaGear v0.3.0 adds non-interactive auth, custom YAML/JSON configs, Dark Mode UI, and OPA decoupling • Adds `-CertificateThumbprint` parameter to `Invoke-SCuBA` for non-interactive authentication via Azure AD service principals • Adds `-ConfigFilePath` parameter to `Invoke-SCuBA` to specify custom configuration files in YAML or JSON format • Adds Dark Mode button to the HTML report UI • Decouples the Open Policy Agent (OPA) executable from the repository, allowing users to reference their own version Full history on Cyber Toolchain: https://cybertoolchain.io/tools/scubagear https://github.com/cisagov/ScubaGear/releases/tag/v0.2.0 https://github.com/cisagov/ScubaGear/releases/tag/v0.2.0 Fri, 16 Dec 2022 17:48:09 GMT New `Invoke-SCuBA` cmdlet, `-M365Environment` switch for GCC-H/DOD, and `Disconnect-SCuBATenant` for multi-tenant workflows in v0.2.0 • Adds `Invoke-SCuBA` as the primary entry point for assessments, replacing `RunSCuBA.ps1` • Adds `-M365Environment` parameter to connect to GCC-H/DOD endpoints • Adds `Disconnect-SCuBATenant` cmdlet and `Invoke-SCuBA -DisconnectOnExit` option to manage multi-tenant connections Breaking changes: • Removed `RunSCuBA.ps1` script; users must now use the `Invoke-SCuBA` cmdlet instead • Removed Graph API Scope `Policy.ReadWRITE.AuthenticationMethod` requirement • Renamed Power Platform exclusive `-Endpoint` parameter to `-M365Environment` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/scubagear https://github.com/cisagov/ScubaGear/releases/tag/v0.1.0 https://github.com/cisagov/ScubaGear/releases/tag/v0.1.0 Thu, 20 Oct 2022 12:30:27 GMT ScubaGear v0.1.0 initial alpha release adds Azure AD, Defender, Exchange, SharePoint, Teams, and Power Platform reporting • Initial alpha release of ScubaGear for cybersecurity tooling auditing cloud environments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/scubagear