ConfigCobra vs ScubaGear
ScubaGear is CISA's free, open-source tool that checks a Microsoft 365 tenant against the CISA SCuBA Secure Configuration Baselines, which suits Microsoft 365 administrators who need to assess against those baselines from Windows PowerShell. ConfigCobra checks against CIS benchmarks across Microsoft 365, Azure, Google Cloud and AWS and adds an inventory, impact analysis, monitoring and reports, which suits teams that want one read-only platform for several clouds.
At a glance
| ConfigCobra | ScubaGear | |
|---|---|---|
| What it is | A platform you connect to your cloud accounts with read-only access. It runs CIS benchmark checks and also holds an inventory, impact analysis, monitoring and reports. No agents to install. | An assessment tool that checks whether a Microsoft 365 tenant's configuration conforms to the CISA SCuBA Secure Configuration Baselines |
| Clouds covered | Microsoft 365, Azure, Google Cloud and AWS | Microsoft 365: Entra ID, Security Suite, Exchange Online, Power BI, Power Platform, SharePoint and Teams |
| Benchmarks / checks | CIS Microsoft 365 Foundations v7.0.0 (160 controls, Level 1 and 2); four CIS Azure benchmarks (339 controls); CIS Google Cloud Platform Foundation v5.0.0 (93 controls); four CIS AWS benchmarks (306 controls) | The SCuBA baselines for those seven products, evaluated with Open Policy Agent (Rego policies). A YAML file records exclusions, annotations and omissions. No CIS benchmark is listed in the README |
| Asset inventory (what objects it collects) | One inventory across clouds. Microsoft 365: users, guests, admins, groups, devices, enterprise apps, app registrations, mailboxes, SharePoint sites, policies, domains, licences, directory roles. Azure, Google Cloud and AWS: resources with their security properties | Not documented |
| Risk views (inactive users, guests, app secrets…) | Built-in views such as users inactive 90 days, guests who never signed in, groups without owner, expired or soon-expiring app credentials, high-privilege app permissions | Not documented |
| Cost and licence savings (unused paid licences, licences of inactive users, unattached disks) | Unused paid licences view; unattached disks view (Azure). The inventory also holds licences and the users-inactive-90-days view | Not documented |
| Remediation impact analysis (what a fix changes before you apply it) | Yes. For a failing control it shows what changes in your environment if you apply the fix, with an impact level of High, Medium, Low or None | Not documented |
| Drift monitoring and scheduled scans | Yes. Daily, weekly or monthly scans of any mix of controls or rule sets; you are alerted when a control regresses | Invoke-SCuBADiff compares two saved result files offline and reports what changed. Scheduling is not described in the README; ScubaConnect, a separate CISA project, automates runs across tenants |
| Notifications | Email, for findings and drift | Not documented |
| Reports and evidence | PDF report with findings, evidence and a timestamped tenant snapshot; audit-ready evidence export; CSV export of the inventory; read-only auditor seat | HTML, JSON and CSV output |
| AI assistant (MCP) | Yes, a native MCP server for MCP-compatible assistants, answering from live scan data | Not documented |
| Multi-tenant / MSP use | Yes, one workspace for several tenants | A troubleshooting page covers testing several tenants; ScubaConnect runs the tool across multiple tenants from a central location |
| How it runs (install, agent, SaaS, script) | Web platform, nothing to install in the tenant | PowerShell module installed from the PowerShell Gallery, run from a Windows computer (its docs say it runs on Windows only); Install-ScubaDependencies also installs OPA |
| Access it needs | Read-only. Microsoft 365: read-only Microsoft Graph permissions. Azure: Reader plus a read-only Graph policy permission, certificate-based app registration. Google Cloud: read-only service account. AWS: read-only assume-role | Interactive: user roles such as Global Reader per product, plus Graph permissions for Entra ID and SharePoint. Non-interactive: a service principal that authenticates with a certificate. Its docs say a few Power Platform and SharePoint permissions carry write privileges because of those APIs, and that ScubaGear never uses them |
| Licence / pricing model | 14-day free trial with full access; then an annual subscription sized by licensed Microsoft 365 users, or a per-tenant assessment licence for MSPs and auditors | Distributed under the Creative Commons Zero licence (free) |
What ScubaGear does well
ScubaGear is built around one clear goal: checking a Microsoft 365 tenant against the CISA SCuBA baselines. Its README names Microsoft 365 administrators as the target audience.
- The SCuBA baselines. If you must show alignment with the CISA baselines, for example under the directive its README cites, ScubaGear is the tool made for that. ConfigCobra checks CIS benchmarks and does not assess the SCuBA baselines.
- Seven products. It covers Entra ID, Security Suite, Exchange Online, Power BI, Power Platform, SharePoint and Teams.
- Risk decisions in a file. The YAML configuration lets you record exclusions, annotations and omissions, and the README says this keeps a record of accepted risks. A configuration UI, started with Start-ScubaConfigApp, helps you build that file.
- Comparing runs. Invoke-SCuBADiff compares two result files without contacting the tenant and writes JSON, CSV and HTML.
- Outputs and cost. HTML, JSON and CSV results, and a free licence. A separate project, ScubaConnect, automates running it across tenants.
Where ConfigCobra is different
ScubaGear answers one question for one cloud: does this Microsoft 365 tenant follow the SCuBA baselines? ConfigCobra covers more clouds and more modules, and it never changes the tenant.
CSPM
CIS benchmarks for Microsoft 365 (v7.0.0, 160 controls, Level 1 and Level 2 profiles, 143 of the 160 automated and 17 needing manual verification), Azure (339 controls), Google Cloud (93 controls) and AWS (306 controls). Every finding has evidence and a severity estimate that ConfigCobra uses to prioritise fixes. Predefined rule sets and a dashboard come with it.
Inventory & Insights
An inventory of users, guests, admins, groups, devices, enterprise apps, app registrations, mailboxes, SharePoint sites, policies, domains, licences and directory roles on Microsoft 365, plus resources on Azure, Google Cloud and AWS. Risk views include users who never signed in, groups without owner, sites allowing Anyone links and domains without DKIM or DMARC. A relation graph, links from findings to objects and a CSV export are included.
Cost & licence optimisation
The unused paid licences and unattached disks views, plus the inactive-user view and the licence data in the inventory.
Remediation impact analysis
Before you apply a fix, ConfigCobra shows who and what it would affect, with an impact level, a confidence level and a prepare step. Copy-paste remediation scripts (PowerShell or portal steps) are generated per finding but never run by ConfigCobra.
Monitoring, reports, AI and teams
Scheduled scans (daily, weekly or monthly), drift alerts when a control regresses and email notifications replace manual run-and-diff. A PDF report with a timestamped snapshot, an audit-ready evidence export and a read-only auditor seat serve outside parties. An MCP server lets an AI assistant query live scan data, and one workspace holds many tenants.
Which one to choose
- Choose ScubaGear if the CISA SCuBA baselines are your target, you work on Windows with PowerShell, and a free command-line tool fits your process.
- Choose ConfigCobra if your standard is the CIS benchmarks, you also run Azure, Google Cloud or AWS, or you want an inventory, scheduled monitoring and shareable reports.
- Use both if you must assess against the SCuBA baselines and also want CIS benchmark results, inventory and monitoring. The two use different baselines, so their findings will not match one to one.
How to move or run them side by side
- Decide which baseline you are measured against. ConfigCobra does not assess the SCuBA baselines, so keep ScubaGear for that requirement.
- Leave your ScubaGear setup as it is. Its YAML file, results and scheduled runs do not need to change.
- Connect the tenant to ConfigCobra with read-only access, then run a scan during the 14-day free trial, which has full access.
- Compare the two results by topic, for example Conditional Access or external sharing, rather than line by line.
- Use the impact analysis before changing any setting that ScubaGear or ConfigCobra flags, and apply fixes yourself with the portal steps or scripts.
- Use ConfigCobra's scheduler for ongoing CIS monitoring. If you need to compare two ScubaGear runs, keep using Invoke-SCuBADiff.
Facts about ScubaGear come from its own repository documentation, last checked 2026-10-18. Check the repository for current details.
Sources
- raw.githubusercontent.comhttps://raw.githubusercontent.com/cisagov/ScubaGear/main/README.md
- raw.githubusercontent.comhttps://raw.githubusercontent.com/cisagov/ScubaGear/main/LICENSE
- raw.githubusercontent.comhttps://raw.githubusercontent.com/cisagov/ScubaGear/main/docs/prerequisites/permissions.md
- raw.githubusercontent.comhttps://raw.githubusercontent.com/cisagov/ScubaGear/main/docs/prerequisites/interactive.md
- raw.githubusercontent.comhttps://raw.githubusercontent.com/cisagov/ScubaGear/main/docs/prerequisites/noninteractive.md
- raw.githubusercontent.comhttps://raw.githubusercontent.com/cisagov/ScubaGear/main/docs/prerequisites/dependencies.md
- raw.githubusercontent.comhttps://raw.githubusercontent.com/cisagov/ScubaGear/main/docs/troubleshooting/tenants.md
- raw.githubusercontent.comhttps://raw.githubusercontent.com/cisagov/ScubaGear/main/docs/execution/diff.md
- raw.githubusercontent.comhttps://raw.githubusercontent.com/cisagov/ScubaConnect/main/README.md
Facts about ScubaGear come from its public documentation, last checked 17 Oct 2026. Product names and trademarks belong to their owners. Spotted something out of date? Tell us.
See where your cloud stands
ConfigCobra checks Microsoft 365, Azure, Google Cloud and AWS against the CIS benchmarks, read-only.