Microsoft
MicrosoftGreat overview, KirkpatrickMSFT -- the CISA/Microsoft partnership on ScubaGear has been a real force multiplier for M365 security posture across federal and beyond.
Since this post went up, BOD 25-01 has added federal mandate weight behind ScubaGear adoption, which is driving a lot of organizations to formalize their scanning cadence. The point you made about settings fluctuating over time really resonates -- in practice, configuration drift between scans is one of the hardest operational problems to manage, especially in multi-admin GCC Moderate tenants where changes can come from multiple directions.
We've been working on exactly that problem: a governance layer that consumes ScubaGear's JSON/CSV output and maintains continuous drift detection against a canonical desired state between scans. The idea is that ScubaGear tells you where you stand at scan time, and a persistent governance substrate tracks what changed since the last scan, who owns the remediation, and whether SLA timelines are being met.
Curious whether others in the community are seeing the same operational gap -- the space between "scan revealed a deviation" and "deviation was actually remediated by an accountable owner within a defined timeframe." That seems to be where a lot of organizations struggle, especially as BOD 25-01 reporting requirements tighten.
Would love to hear how other M365 admins are handling continuous compliance state between ScubaGear runs.
