List view

Create new Security Suite Baseline

enhancementThis issue or pull request will add new or improve existing functionalityThis issue or pull request will add new or improve existing functionality

epicA high-level objective issue encompassing multiple issues instead of a specific unit of workA high-level objective issue encompassing multiple issues instead of a specific unit of work

Status: Open.

Epic

#2016 In cisagov/ScubaGear;

· adhilto opened on Mar 4, 2026

ScubaGear incorrectly passes conditional access policies that combine user and sign-in risk

bugThis issue or pull request addresses broken functionalityThis issue or pull request addresses broken functionality

Status: Open.

#2029 In cisagov/ScubaGear;

· tkol2022 opened on Mar 9, 2026

Display privileged users in Entra report

enhancementThis issue or pull request will add new or improve existing functionalityThis issue or pull request will add new or improve existing functionality

Status: Open.

#2031 In cisagov/ScubaGear;

· tkol2022 opened on Mar 9, 2026

Add the capability to visualize Defender Anti-phishing policies in the Security Suite report

enhancementThis issue or pull request will add new or improve existing functionalityThis issue or pull request will add new or improve existing functionality

Status: Open.

#2024 In cisagov/ScubaGear;

· adhilto opened on Mar 5, 2026

Add the capability to visualize Defender Anti-malware policies in the Security Suite report

enhancementThis issue or pull request will add new or improve existing functionalityThis issue or pull request will add new or improve existing functionality

Status: Open.

#2021 In cisagov/ScubaGear;

· adhilto opened on Mar 5, 2026

Add the Security Suite baseline to the ScubaGear core modules

Status: Open.

#2019 In cisagov/ScubaGear;

· adhilto opened on Mar 4, 2026

Investigate privileged roles assigned to users who have granted consent to delegated permissions

enhancementThis issue or pull request will add new or improve existing functionalityThis issue or pull request will add new or improve existing functionality

Status: Open.

#2010 In cisagov/ScubaGear;

· mitchelbaker-cisa opened on Feb 25, 2026

Review RiskyPermissions.json to identify missing permissions

enhancementThis issue or pull request will add new or improve existing functionalityThis issue or pull request will add new or improve existing functionality

Status: Open.

#2004 In cisagov/ScubaGear;

· tkol2022 opened on Feb 23, 2026

Investigate EXO failures with v3.9.0 of the ExchangeOnlineManagement module

bugThis issue or pull request addresses broken functionalityThis issue or pull request addresses broken functionality

public-reportedThis issue is reported by the public users of the tool.This issue is reported by the public users of the tool.

Status: Open.

#1980 In cisagov/ScubaGear;

· mitchelbaker-cisa opened on Feb 11, 2026

Review Entra ID baseline for Entra portal vs admin center differences

baseline-documentIssues relating to the text in the baseline documents themselvesIssues relating to the text in the baseline documents themselves

enhancementThis issue or pull request will add new or improve existing functionalityThis issue or pull request will add new or improve existing functionality

Status: Open.

#1977 In cisagov/ScubaGear;

· adhilto opened on Feb 10, 2026

Defender Pester Tests results in license warnings

bugThis issue or pull request addresses broken functionalityThis issue or pull request addresses broken functionality

Status: Open.

Bug

#576 In cisagov/ScubaGear;

· schrolla opened on Oct 6, 2023

Implement checks for MS.SECURITYSUITE policy group 3

blockedThis issue or pull request is awaiting the outcome of another issue or pull requestThis issue or pull request is awaiting the outcome of another issue or pull request

Status: Open.

#2025 In cisagov/ScubaGear;

· adhilto opened on Mar 5, 2026

Implement checks for MS.SECURITYSUITE policy group 2

blockedThis issue or pull request is awaiting the outcome of another issue or pull requestThis issue or pull request is awaiting the outcome of another issue or pull request

Status: Open.

#2023 In cisagov/ScubaGear;

· adhilto opened on Mar 5, 2026

Ensure the tags for the Security Suite policies accurately reflect the ScubaGear checks

baseline-documentIssues relating to the text in the baseline documents themselvesIssues relating to the text in the baseline documents themselves

Status: Open.

#2022 In cisagov/ScubaGear;

· adhilto opened on Mar 5, 2026

Implement checks for MS.SECURITYSUITE policy group 1

blockedThis issue or pull request is awaiting the outcome of another issue or pull requestThis issue or pull request is awaiting the outcome of another issue or pull request

Status: Open.

#2020 In cisagov/ScubaGear;

· adhilto opened on Mar 5, 2026

Update removedpolicies.md for the Security Suite baseline

baseline-documentIssues relating to the text in the baseline documents themselvesIssues relating to the text in the baseline documents themselves

Status: Open.

#2018 In cisagov/ScubaGear;

· adhilto opened on Mar 4, 2026

Update Sign-in Risk conditional access policy implementation steps and control code to align them to Microsoft Best Practice

enhancementThis issue or pull request will add new or improve existing functionalityThis issue or pull request will add new or improve existing functionality

Status: Open.

Feature

#2037 In cisagov/ScubaGear;

· skirkpatrickMSFT opened on Mar 17, 2026

Update User Risk conditional access policy implementation steps and control code to align them to Microsoft Best Practice

enhancementThis issue or pull request will add new or improve existing functionalityThis issue or pull request will add new or improve existing functionality

Status: Open.

Feature

#2038 In cisagov/ScubaGear;

· skirkpatrickMSFT opened on Mar 17, 2026

Update product name from Azure AD to Microsoft Entra ID in baseline identifiers and all source code references

baseline-documentIssues relating to the text in the baseline documents themselvesIssues relating to the text in the baseline documents themselves

breaking changeThis issue or pull request involves changes to existing functionalityThis issue or pull request involves changes to existing functionality

enhancementThis issue or pull request will add new or improve existing functionalityThis issue or pull request will add new or improve existing functionality

ScubaGear 2.0This issue is designated for version 2.0This issue is designated for version 2.0

Status: Open.

#888 In cisagov/ScubaGear;

· schrolla opened on Feb 5, 2024

Create new Entra baseline policy to block high risk Entra AI agents

enhancementThis issue or pull request will add new or improve existing functionalityThis issue or pull request will add new or improve existing functionality

Status: Open.

#1947 In cisagov/ScubaGear;

· tkol2022 opened on Jan 23, 2026

Conduct prototyping to simulate an Agent marked as risky in Entra Identity Protection

analysis-requiredThis issue requires review or analysis work to completeThis issue requires review or analysis work to complete

hands-on-prototypingReviewing an M365 feature by performing hands-on prototypingReviewing an M365 feature by performing hands-on prototyping

Status: Open.

#1949 In cisagov/ScubaGear;

· tkol2022 opened on Jan 27, 2026

Update rego for Defender policy group 2 false positives for runs that do not have any user, group or domains configured for impersonation protection.

bugThis issue or pull request addresses broken functionalityThis issue or pull request addresses broken functionality

enhancementThis issue or pull request will add new or improve existing functionalityThis issue or pull request will add new or improve existing functionality

Status: Open.

Bug

#1840 In cisagov/ScubaGear;

· FollyBeachGurl opened on Oct 14, 2025

Update MS.DEFENDENDER2.1v1, MS.DEFENDENDER2.2v1, and MS.DEFENDENDER2.3v1 implementation steps to require at least a user, group or domain to be configured for impersonation protection

baseline-documentIssues relating to the text in the baseline documents themselvesIssues relating to the text in the baseline documents themselves

blockedThis issue or pull request is awaiting the outcome of another issue or pull requestThis issue or pull request is awaiting the outcome of another issue or pull request

enhancementThis issue or pull request will add new or improve existing functionalityThis issue or pull request will add new or improve existing functionality

Status: Open.

Bug

#1842 In cisagov/ScubaGear;

· FollyBeachGurl opened on Oct 15, 2025

Total User Count is empty causing invalid JSON parsing downstream

bugThis issue or pull request addresses broken functionalityThis issue or pull request addresses broken functionality

Status: Open.

#1914 In cisagov/ScubaGear;

· buidav opened on Jan 7, 2026

Restrict Maximum Certificate Lifetime for Applications

enhancementThis issue or pull request will add new or improve existing functionalityThis issue or pull request will add new or improve existing functionality

Status: Open.

Feature

#1963 In cisagov/ScubaGear;

· MichaelHicks-MSFT opened on Feb 5, 2026