CISA’s Free Microsoft 365 Settings Checker Gets Its Biggest Update Since Launch

Here Is How Layered Defenses Turn a Settings Report Into Real Protection

Most cloud breaches at small businesses do not start with clever malware. They start with a setting that was never turned on, or one that someone switched off and forgot about. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has just updated two free tools built to catch exactly that.

We drew on Help Net Security’s write-up of the release for the details below.

What the tools are

ScubaGear checks a Microsoft 365 tenant’s configuration against CISA’s security baselines. Its companion, ScubaGoggles, does the same for Google Workspace. Both come from CISA’s Secure Cloud Business Applications (SCuBA) project, which writes configuration guidance for the cloud services federal civilian agencies use. In 2024, CISA reported more than 30,000 ScubaGear downloads since the tool debuted in October 2022.

What is new in ScubaGear 2.0

Direct API calls everywhere. The tool now uses direct REST API calls for every supported Microsoft 365 product, which CISA says makes assessments faster and more accurate. Earlier releases moved parts of the tool this way: version 1.6.0 switched Entra ID checks to the Microsoft Graph API, and version 1.8.0 moved SharePoint and Power Platform to REST calls.
The biggest update since launch. CISA describes 2.0 as the most comprehensive update since 2022.

ScubaGoggles 1.1.0 adds an assured controls baseline and expanded controls for Gemini, Google’s AI assistant.

How a check works

Read the settings. The tool queries the tenant’s current configuration.
Compare. It checks those settings against CISA’s baselines, written as policies in the Rego language used by Open Policy Agent.
Report. It produces results as HTML, JSON and CSV files.

ScubaGear’s baselines cover Entra ID, Defender for Office 365, Exchange Online, OneDrive for Business, Power BI, Power Platform, SharePoint Online and Teams.

Where a settings check fits in your layers

A configuration report is not a defense on its own. It tells you whether the defenses you think you have are actually switched on. Here is how it supports the other layers:

Identity: confirms multifactor sign-in, legacy authentication blocking and admin role limits are set the way you intended.
Email: checks that phishing, spoofing and attachment protections are enabled, not just licensed.
Data sharing: flags file-sharing and external-access settings that leave documents open to anyone with a link.
Change control: run it on a schedule. A report that looked clean in spring can drift after a new admin, a new app or a vendor change.
Monitoring and response: settings checks show how things are configured, not who is doing what. Pair them with sign-in alerts, audit logs and a plan for acting on what you find.

What this means for your company

Whether your business runs on Microsoft 365, Google Workspace or another platform, the most common weak spots are settings that drifted or were never turned on. A periodic, documented check against a recognized baseline, using a free tool like these or a commercial one, gives you a to-do list based on facts rather than guesswork. Treat the report as a starting point. Some recommendations are written for government agencies and may need adjusting for how your team actually works, so review each finding before changing anything in production.

Want a baseline review of your cloud tenant and a practical plan for the gaps it finds? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.