Microsoft 365 Security Baseline: How Mid-Market Owners and Operators Can Use CISA’s Free SCuBA Checklist

Microsoft 365 Security Baseline: How Mid-Market Owners and Operators Can Use CISA’s Free SCuBA Checklist

2026-10-24

Takeaway: If your company runs on Microsoft 365, you don’t have to invent a security standard. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) already publishes one, called SCuBA, plus a free tool that grades your setup against it. Run the report, fix the handful of settings attackers lean on most, and write down why you’re skipping anything you skip.

Quick definition: your Microsoft 365 “tenant” is your company’s own instance of Microsoft 365, with its users, mailboxes, files, and settings. Many of its security protections are settings someone has to turn on deliberately.

What SCuBA is, and why it isn’t just for government

CISA started the Secure Cloud Business Applications (SCuBA) project in 2022 to address security gaps exposed by intrusions into cloud software. Its main goal is protecting federal agencies, but CISA says plainly that “all organizations can use SCuBA.” The project publishes secure configuration baselines for Microsoft 365 and Google Workspace, and two no-cost assessment tools introduced in 2023: ScubaGear for Microsoft 365 and ScubaGoggles for Google Workspace.

On December 17, 2024, CISA issued Binding Operational Directive (BOD) 25-01, which required federal civilian agencies to implement the mandatory SCuBA policies by June 20, 2025. Your company isn’t bound by it. Still, a list of settings the federal government made mandatory for itself is a sensible starting list for everyone else.

Step 1: Run the free report

ScubaGear is a PowerShell tool that reads your tenant’s settings, compares them with the SCuBA baselines, and produces HTML, JSON, and CSV reports. CISA’s documentation says the first run makes no changes; it shows you where you stand. It needs an administrator with the right permissions to run it, usually your IT lead or managed service provider.

What you get is a pass/fail list mapped to specific policies. That turns “are we secure?” into a punch list.

Step 2: Fix the settings attackers love first

The baselines are long. These five items, all on the BOD 25-01 mandatory list, are a good first pass.

Block legacy authentication

Legacy authentication means older sign-in methods (think old email protocols) that can’t enforce multifactor authentication (MFA). SCuBA policy MS.AAD.1.1 says it “SHALL be blocked.” Microsoft’s own guidance says that, based on its analysis, more than 97 percent of credential stuffing attacks and more than 99 percent of password spray attacks use legacy authentication. Check the sign-in logs for anything still using it before you flip the switch, and test in Microsoft’s report-only mode first.

Require MFA for everyone, phishing-resistant where you can

The baseline calls for phishing-resistant MFA for all users (MS.AAD.3.1) and requires it for highly privileged roles (MS.AAD.3.6). A 2023 study by Microsoft researchers (Meyer et al.) of Azure Active Directory accounts reviewed for suspicious activity between April and September 2022 estimated that MFA reduced the risk of compromise by 99.22%. In a separate sample of 128,000 accounts with leaked passwords, it also found SMS codes less effective than an authenticator app. Note that it’s Microsoft studying its own product, using 2022 data.

Shrink the number of Global Administrators

Global Administrator is the master key to your tenant. Policy MS.AAD.7.1 calls for at least two and no more than eight; the baseline notes Microsoft recommends fewer than five. MS.AAD.7.2 says privileged users should get narrower roles instead. Check whether anyone who no longer needs it still holds one.

Restrict who can approve third-party apps

When an employee clicks “Accept” on an app that asks to read their mail or files, they may be granting that app ongoing access. Policy MS.AAD.5.2 says user consent to applications “SHALL be restricted,” and the BOD list pairs it with an admin approval workflow so legitimate requests still get through.

Turn off auto-forwarding to outside domains, and turn on mailbox auditing

Policy MS.EXO.1.1 disables automatic forwarding to external domains. The Exchange Online baseline explains why: “Adversaries can use automatic forwarding to gain persistent access to a victim’s email.” MS.EXO.13.1 requires mailbox auditing, so if something does go wrong, you have records to investigate.

While you’re in there, look at file sharing: MS.SHAREPOINT.1.1 limits SharePoint external sharing to existing guests or people inside your organization.

Step 3: Write down your exceptions

Not every setting fits every business. BOD 25-01 lets an agency’s authorizing official accept the risk of a deviation, as long as it’s identified and explained. ScubaGear supports the same idea through its configuration file, where you document exclusions and risk acceptances.

Your version: keep a one-page exception log. For each skipped setting, note the business reason, the owner, and a date to revisit it. Auditors, insurers, and future you will all appreciate it.

Step 4: Re-run it on a schedule

Settings drift, and baselines change. ScubaGear includes a feature for comparing two runs, and BOD 25-01 asks agencies that report manually to do so quarterly. Quarterly is a reasonable rhythm for a mid-market company too.

What this won’t cover

SCuBA hardens Microsoft 365 configuration. It doesn’t cover laptops, backups, vendor access, or your people. Treat it as one strong piece of a security program, not the whole program.

The bottom line

A free government checklist plus a free scanner removes most of the guesswork from Microsoft 365 security. The hard parts are prioritizing the fixes, rolling them out without locking anyone out, and keeping them in place. That’s the kind of work a Yellow Coop fractional CISO handles for growing companies. Let’s talk.

Sources