automation

ScubaGear: Automate M365 Security

Name: ScubaGear: Automate M365 Security
Author: cisagov

Assess your M365 tenant's security with ScubaGear, a tool for startup founders, backed by 2.6k+ GitHub stars.

intermediate⏱ 30 minutes💵 Free

2,620 stars373 forksPowerShellQuality 8/10Updated 7/23/2026100% free · open source

What it is

Use ScubaGear to check the security level of your Microsoft 365 (M365) tenant.

What you can make with it

Automations like checking your M365's vulnerability against CISA's baselines and receiving a report.

How it helps

ScubaGear speeds up your security assessment, reducing the time spent on complex security audits so you can focus on growth.

Real use case example

"A founder with a growing M365 tenant uses ScubaGear to assess their security and gets a detailed report, finding some vulnerabilities they can easily fix within a few days."

If you're new

Novice users should pick this up when they first set up their M365 tenant to prioritize security.

If you're senior

Senior engineers and founders reach for ScubaGear when they need to ensure the highest level of security for their M365 tenant quickly and accurately.

Common confusion cleared up

Some users might think ScubaGear is exclusively for advanced users, but it's suitable for intermediate users who want to ensure their M365 tenant's security.

Best inside these AI tools

Any AI Client

Pairs with

CISA's M365 security guidelines

Why we list it on WorkflowStacks: ScubaGear is included because it's a free and open-source tool backed by the US government's cybersecurity agency.

What it does

ScubaGear assesses your Microsoft 365 tenant's security by checking its configuration against CISA's recommended baselines

Install / run

git clone https://github.com/cisagov/ScubaGear.git

When to use it

•When you need to identify potential security risks in your M365 tenant
•Before a security audit or compliance check
•After making significant changes to your M365 configuration

Quick start

1Navigate to the ScubaGear directory: cd ScubaGear
2Run the assessment script: .\ScubaGear.ps1 -TenantId <your_tenant_id> -ClientId <your_client_id> -ClientSecret <your_client_secret>
3Review the generated report to identify areas for improvement
4Use the -OutputFile parameter to save the report to a file: .\ScubaGear.ps1 -TenantId <your_tenant_id> -ClientId <your_client_id> -ClientSecret <your_client_secret> -OutputFile report.csv
5Use the -Baseline parameter to specify a custom baseline: .\ScubaGear.ps1 -TenantId <your_tenant_id> -ClientId <your_client_id> -ClientSecret <your_client_secret> -Baseline Custom

Ready-to-paste prompt

.\ScubaGear.ps1 -TenantId abc123 -ClientId def456 -ClientSecret ghi789 -OutputFile security_report.csv

Heads up: You need to have the AzureAD and ExchangeOnlineManagement PowerShell modules installed and configured to use ScubaGear, and you must have the necessary permissions to access your M365 tenant

Saves to your device