ConfigCobra vs Monkey365
Monkey365 is a free, open-source PowerShell assessment framework for Microsoft 365, Entra ID and Azure with built-in CIS rulesets and editable JSON rules, which suits consultants and administrators who want a scriptable scan they can extend. ConfigCobra is a read-only platform for Microsoft 365, Azure, Google Cloud and AWS that adds an inventory, impact analysis, scheduled monitoring and reports, which suits teams that want those results without running scripts.
At a glance
| ConfigCobra | Monkey365 | |
|---|---|---|
| What it is | A platform you connect to your cloud accounts with read-only access. It runs CIS benchmark checks and also holds an inventory, impact analysis, monitoring and reports. No agents to install. | A PowerShell-based security assessment framework for Microsoft 365, Microsoft Entra ID and Azure. It collects configuration data, evaluates it against rules and produces reports |
| Clouds covered | Microsoft 365, Azure, Google Cloud and AWS | Microsoft 365, Entra ID and Azure (Azure Public, China and Government environments). Microsoft 365 workloads named: Exchange Online, SharePoint Online, Teams, Purview, Fabric. AWS and Google Cloud are not listed |
| Benchmarks / checks | CIS Microsoft 365 Foundations v7.0.0 (160 controls, Level 1 and 2); four CIS Azure benchmarks (339 controls); CIS Google Cloud Platform Foundation v5.0.0 (93 controls); four CIS AWS benchmarks (306 controls) | Built-in rulesets: CIS Microsoft Azure Foundations v6.0.0, Database Services v2.0.0, Compute Services v2.0.0, CIS Microsoft 365 Foundations v7.0.0, and a Monkey365 Entra ID ruleset. Rules are JSON files you can add to |
| Asset inventory (what objects it collects) | One inventory across clouds. Microsoft 365: users, guests, admins, groups, devices, enterprise apps, app registrations, mailboxes, SharePoint sites, policies, domains, licences, directory roles. Azure, Google Cloud and AWS: resources with their security properties | Collectors gather configuration data for the services you select. No inventory view is documented |
| Risk views (inactive users, guests, app secrets…) | Built-in views such as users inactive 90 days, guests who never signed in, groups without owner, expired or soon-expiring app credentials, high-privilege app permissions | Not documented |
| Cost and licence savings (unused paid licences, licences of inactive users, unattached disks) | Unused paid licences view; unattached disks view (Azure). The inventory also holds licences and the users-inactive-90-days view | Not documented |
| Remediation impact analysis (what a fix changes before you apply it) | Yes. For a failing control it shows what changes in your environment if you apply the fix, with an impact level of High, Medium, Low or None | Not documented |
| Drift monitoring and scheduled scans | Yes. Daily, weekly or monthly scans of any mix of controls or rule sets; you are alerted when a control regresses | Not documented |
| Notifications | Email, for findings and drift | Not documented |
| Reports and evidence | PDF report with findings, evidence and a timestamped tenant snapshot; audit-ready evidence export; CSV export of the inventory; read-only auditor seat | HTML, JSON and CSV, with findings, evidence and remediation guidance |
| AI assistant (MCP) | Yes, a native MCP server for MCP-compatible assistants, answering from live scan data | Not documented |
| Multi-tenant / MSP use | Yes, one workspace for several tenants | Not documented |
| How it runs (install, agent, SaaS, script) | Web platform, nothing to install in the tenant | PowerShell module from the PowerShell Gallery; its dependencies are bundled. Docker images for Linux and Windows are documented |
| Access it needs | Read-only. Microsoft 365: read-only Microsoft Graph permissions. Azure: Reader plus a read-only Graph policy permission, certificate-based app registration. Google Cloud: read-only service account. AWS: read-only assume-role | Read-only by design, according to its docs. Interactive: Global Reader and Security Reader (plus SharePoint Administrator for SharePoint Online). Service principal: a list of read Graph permissions and the Azure Reader role. Some Microsoft 365 services need a certificate rather than a client secret |
| Licence / pricing model | 14-day free trial with full access; then an annual subscription sized by licensed Microsoft 365 users, or a per-tenant assessment licence for MSPs and auditors | Apache 2.0 licence (free) |
What Monkey365 does well
Monkey365 is a collect, evaluate and report tool for Microsoft environments, and its README is clear about how it works.
- Built-in CIS rulesets. It lists the Azure Foundations v6.0.0, Database Services v2.0.0 and Compute Services v2.0.0 benchmarks and the Microsoft 365 Foundations v7.0.0 benchmark, the same Microsoft 365 version ConfigCobra uses.
- Editable rules. Rules are declarative JSON files evaluated separately from the collectors, so you can add organisation-specific checks without changing the engine. ConfigCobra has no custom controls.
- Many sign-in methods. Interactive, service principal, certificate and direct access token authentication are supported, and Azure Public, China and Government clouds are covered.
- Self-contained. Its dependencies are bundled, so it does not need the Azure CLI, Az PowerShell, ExchangeOnlineManagement or the Microsoft Graph PowerShell SDK.
- Read-only and free. Its documentation says it only performs read operations, and it is Apache 2.0 licensed.
- Where it runs. Workstations, jump boxes and automation pipelines, and Docker images for Linux and Windows.
Its README also notes that a benchmark mapping identifies the control behind a finding and does not by itself establish certification or compliance. The same is true of ConfigCobra's results.
Where ConfigCobra is different
Both tools read configuration and never change it. The difference is in what sits around the scan: more clouds, an inventory, planning, monitoring and sharing.
CSPM
CIS benchmarks for Microsoft 365 v7.0.0 (160 controls), Azure (Foundations v6.0.0, Compute, Database and Storage Services, 339 controls in all), Google Cloud v5.0.0 (93 controls) and AWS (four benchmarks, 306 controls). Findings carry evidence and a severity estimate that ConfigCobra uses to prioritise remediation, with Level 1 and Level 2 profiles, rule sets and a dashboard.
Inventory & Insights
One inventory with per-cloud and All clouds views. Azure resources span compute, storage, networking, databases, Key Vault, identity and monitoring, with security properties such as public network access and minimum TLS. Built-in risk views cover key vault secrets without expiry, over-permissive SQL firewall rules and expiring app credentials. A relation graph shows resource dependencies, findings link to objects, and the data exports to CSV.
Cost & licence optimisation
The unattached disks view on Azure and the unused paid licences view on Microsoft 365 are part of the inventory.
Remediation impact analysis
For a failing control ConfigCobra lists the identities and resources a fix would affect, with the effect, a confidence level and an impact level, before you apply anything. Remediation scripts or portal steps are generated per finding for you to run yourself.
Monitoring, reports, AI and teams
Scans run daily, weekly or monthly on a schedule, drift alerts fire when a control regresses and email notifications go out. Reports include a PDF with a timestamped snapshot and an audit-ready evidence export, and an auditor seat is read-only. An MCP server connects AI assistants to live scan data. One workspace manages several tenants, and Azure scans cover every readable subscription or a selected list.
Which one to choose
- Choose Monkey365 if you are a consultant or administrator who is comfortable in PowerShell, assesses Microsoft 365, Entra ID and Azure, and wants to adjust the rules or run it in a container.
- Choose ConfigCobra if you also need Google Cloud or AWS, want an inventory with risk views, want to know a fix's impact first, or want scheduled monitoring and reports to share.
- Use both if you want your own JSON rules next to a managed, scheduled view. Both read the same Microsoft 365 benchmark version, so the results are easy to line up.
How to move or run them side by side
- Note any custom JSON rules you maintain. They stay in Monkey365, as ConfigCobra has no custom controls.
- Connect the tenant and subscriptions to ConfigCobra using its read-only access: Reader on the Azure subscriptions and a certificate-based app registration.
- Run a scan in the 14-day free trial, which has full access.
- Line up Monkey365's CIS Microsoft 365 v7.0.0 findings with ConfigCobra's by control number to see where they agree.
- Check the impact analysis before you fix anything, then apply fixes yourself.
- Schedule ConfigCobra scans for ongoing monitoring and keep Monkey365 for ad hoc runs and custom rules.
Facts about Monkey365 come from its README, licence and documentation, last checked 2026-10-18. Check its site for current details.
Sources
- raw.githubusercontent.comhttps://raw.githubusercontent.com/silverhack/monkey365/main/README.md
- raw.githubusercontent.comhttps://raw.githubusercontent.com/silverhack/monkey365/main/LICENSE
- silverhack.github.iohttps://silverhack.github.io/monkey365/getting_started/permissions/
- silverhack.github.iohttps://silverhack.github.io/monkey365/docker/docker/
Facts about Monkey365 come from its public documentation, last checked 17 Oct 2026. Product names and trademarks belong to their owners. Spotted something out of date? Tell us.
See where your cloud stands
ConfigCobra checks Microsoft 365, Azure, Google Cloud and AWS against the CIS benchmarks, read-only.