# ScubaGear

ScubaGear is a SSPM product. It runs on-premises. Pricing is free.

ScubaGear is a PowerShell-based assessment tool that evaluates Microsoft 365 tenant configurations against CISA security baselines using Open Policy Agent and generates compliance reports.

Checked October 2026.

## What is ScubaGear?

ScubaGear is a configuration assessment tool that evaluates Microsoft 365 tenant environments against CISA Secure Cloud Business Applications (SCuBA) Security Configuration Baseline documents.

The tool operates through a three-step process:
- Uses PowerShell to query Microsoft 365 APIs and collect configuration settings from various M365 products
- Employs Open Policy Agent (OPA) with Rego security policies to compare collected settings against established baseline requirements
- Generates comprehensive reports in HTML, JSON, and CSV formats to present assessment results

ScubaGear is designed for M365 administrators who need to verify their tenant configurations comply with security baselines. The tool can be installed from PSGallery and requires specific dependencies and permissions to access M365 APIs.

The assessment tool supports evaluation of multiple Microsoft 365 products and services. It can be executed with command-line parameters or through configuration files for customized assessments. ScubaGear includes troubleshooting capabilities for common issues related to multi-tenant environments, Microsoft Defender, Exchange Online, Power Platform, Microsoft Graph connectivity, and proxy configurations.

Tags: Configuration Management, Office 365, Microsoft, Microsoft 365

## Where it fits in your security program (NIST CSF 2.0)

- [Govern](https://cybersectools.com/guides/building-govern-program-small-team): helps you set security rules, owners and oversight.
- [Identify](https://cybersectools.com/guides/building-identify-program-small-team): helps you know your assets and your risks.

## Quick facts

- Category: [Cloud Security](https://cybersectools.com/categories/cloud-security) · [SSPM](https://cybersectools.com/categories/sspm)
- Deployment: On-Premises
- Company size fit: SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 2,291
- Website: github.com

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best Attack Surface Management Solutions for Business](https://cybersectools.com/shortlists/best-attack-surface-solutions).

## ScubaGear FAQ

### What is ScubaGear?

ScubaGear is a product in the SSPM category. It covers Configuration Management, Office 365 and Microsoft.

### What is the pricing for ScubaGear?

ScubaGear is free. Download and setup instructions are at https://github.com/cisagov/ScubaGear/.

### What are alternatives to ScubaGear?

Alternatives to ScubaGear listed on CybersecTools:

1. [Augmentt Engage Autopilot](https://cybersectools.com/tools/augmentt-engage-autopilot) - MSP-focused tool automating M365 security policy enforcement and drift remediation. (Commercial)
2. [Abnormal Security Security Posture Management](https://cybersectools.com/tools/abnormal-security-security-posture-management) - Monitors and remediates Microsoft 365 email security misconfigurations (Commercial)
3. [Guardian360 M365 Security Insights](https://cybersectools.com/tools/guardian360-m365-security-insights) - M365 security dashboard consolidating risk signals in Guardian360 Lighthouse. (Commercial)
4. [Reach Security - MS E3/E5 Optimization](https://cybersectools.com/tools/reach-security-ms-e3e5-optimization) - Optimizes Microsoft E3/E5 security configs using real-world attack data. (Commercial)
5. [Attic FIXER](https://cybersectools.com/tools/attic-fixer) - Automated Microsoft 365 security configuration management and remediation tool (Commercial)

Compare all ScubaGear alternatives at [https://cybersectools.com/alternatives/scubagear](https://cybersectools.com/alternatives/scubagear)

### What deployment and organization size does ScubaGear fit?

ScubaGear is available as on-premises software. It is listed for small businesses, mid-market companies and enterprises. It is free.

## Compare ScubaGear with similar solutions

- [ScubaGear vs Augmentt Engage Autopilot](https://cybersectools.com/compare/augmentt-engage-autopilot-vs-scubagear)
- [ScubaGear vs Abnormal Security Security Posture Management](https://cybersectools.com/compare/abnormal-security-security-posture-management-vs-scubagear)
- [ScubaGear vs Guardian360 M365 Security Insights](https://cybersectools.com/compare/guardian360-m365-security-insights-vs-scubagear)

All alternatives to ScubaGear: [/alternatives/scubagear](https://cybersectools.com/alternatives/scubagear)

---

Source: https://cybersectools.com/tools/scubagear

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on ScubaGear: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md