Microsoft 365 security recommendations with PowerShell script

A Microsoft tenant has so many Microsoft admin centers and configuration settings. Checking if the security is on point every time can take much of your time. Everyone wants to have a security baseline so they know where to start or where to look. You can also see it as a security recommendations checklist. In this article, you will learn how to use a PowerShell script to get all the Microsoft 365 security recommendations and what the reports look like.

Secure Cloud Business Applications (SCuBA)

CISA (Cybersecurity and Infrastructure Security Agency) created the Secure Cloud Business Applications (SCuBA) project, which provides guidance and capabilities to secure agencies’ cloud business application environments and protect federal information that is created, accessed, shared, and stored in those environments.

SCuBA will help secure Federal Civilian Executive Branch (FCEB) information assets stored within cloud environments through consistent, effective, modern, and manageable security configurations for the below products:

1. Microsoft Defender for Office 365
2. Microsoft Azure Active Directory
3. Microsoft Exchange Online
4. Microsoft Sharepoint and OneDrive for Business
5. Microsoft Power BI
6. Microsoft Power Platform
7. Microsoft Teams

Minimum user permissions

Users with the Global Administrator role always have the necessary user permissions to run the tool. If you want to set minimum user permissions to create a security report, you can do that.

The minimum user roles needed for each product are described below:

Product	Role
Azure Active Directory	Global Reader
Defender for Office 365	Global Reader (or Exchange Administrator)
Exchange Online	Global Reader (or Exchange Administrator)
Power Platform	Power Platform Administrator with a “Power Apps for Office 365” license
Sharepoint Online	SharePoint Administrator
Microsoft Teams	Global Reader (or Teams Administrator)

How to get a Microsoft 365 security baseline report

To create a Microsoft 365 security recommendations report, follow these steps:

Step 1. Install ScubaGear module

Only PowerShell 5.1 is currently supported. PowerShell 7 may work, but has not been tested. Full PowerShell 7 support will be added in a future release.

Run PowerShell as administrator and run the Set-ExecutionPolicy to RemoteSigned or Unrestricted.

Set-ExecutionPolicy Unrestricted

Start Windows PowerShell and install the ScubaGear module.

Install-Module -Name ScubaGear -Force

Run Initialize-SCuBA after installation to install its other dependencies.

Initialize-SCuBA

You can get the below error at the end:

Unable to download OPA executable. To try manually downloading, see details in README under ‘Download the required OPA executable’.

We will fix that error by manually downloading the OPA executable and placing the file in the correct folder.

Step 2. Download OPA executable

Download the latest OPA executable (opa_windows_amd64.exe) from here.

Paste the file into C:\Temp\ScubaGear.

Check the downloaded OPA version.

C:\Temp\ScubaGear\.\opa_windows_amd64.exe version

This is how the output looks.

Version: 0.64.1
Build Commit: 298f97d79da33ede2bd9ec9cbc5641daa63a8587
Build Timestamp: 2024-04-26T18:20:43Z
Build Hostname: bc237e847b63
Go Version: go1.22.2
Platform: windows/amd64
WebAssembly: available

Step 3. Run ScubaGear PowerShell script

Note: You will get a couple of Microsoft sign-in prompts where you have to enter your Microsoft 365 global administrator credentials. This is needed to retrieve the information from all the Microsoft products.

Run the script against all products and create a report.

Invoke-SCuBA -OPAPath "C:\Temp\ScubaGear\" -OutPath "C:\Temp\ScubaGear\"

Run the script against Microsoft Entra ID and create a report.

Invoke-SCuBA -OPAPath "C:\Temp\ScubaGear\" -ProductNames aad -OutPath "C:\Temp\ScubaGear"

Run the script against multiple products and create a report.

Invoke-SCuBA -OPAPath "C:\Temp\ScubaGear\" -ProductNames aad, exo, teams -OutPath "C:\Temp\ScubaGear"

Step 4. Check Microsoft 365 security baseline report

An HTML report will appear automatically. If not, open the report from the folder.

The report shows the Microsoft products and the details in numbers. Click on a product to view all the details with the information.

In our example, we will click on Exchange Online.

The Exchange Online Baseline Report shows everything in excellent detail.

Look into it and fix what you can so the tests will pass the next time you run the report. Don’t immediately adjust every setting so the results will pass. Every organization is different, and you need to approach this carefully.

Disconnect SCuBA session

Disconnect from all the Microsoft sessions after you finish, or if you want to run it against another tenant.

Disconnect-SCuBATenant

That’s it!

Read more: Office 365 Recommended Configuration Analyzer »

Conclusion

You learned how to check the Microsoft 365 security recommendations with the CISA SCuBA PowerShell script. You can create your own PowerShell script, but that takes time, and you need to keep it up to date with the highest standards, which is difficult because it’s changing so fast.

The CISA team provides this script with new features and bug fixes so you will be up to date with the latest security changes to protect your Microsoft 365 organization. Best of all, it’s completely free. It’s a script that I can recommend using against your Microsoft 365 tenant to secure your environment.

Did you enjoy this article? You may also like How to Restrict access to Microsoft Entra admin center. Don’t forget to follow us and share this article.