Assess, assign, and track Microsoft 365 security baselines in one operating view.

CISA's Secure Cloud Business Applications (SCuBA) project publishes minimum viable secure configuration baselines for Microsoft 365 and Google Workspace, built for US federal agencies but published openly and widely adopted as a reference baseline by other organisations. If your estate runs Microsoft 365, the SCuBA baselines are a usable, independently published conformity target regardless of sector, and EtherInsights scores your tenant against them alongside Microsoft's own Security Baselines.

Secure Score is one input, not the whole picture. It scores Microsoft's own recommendations but does not check conformity against CISA SCuBA or NSA CISS overlays, does not track drift between review cycles, and does not turn a finding into an owner-assigned remediation task with evidence attached. EtherInsights keeps Secure Score in the same operating view alongside baseline conformity, Zero Trust pillar coverage, and drift detection, so a score becomes a tracked action rather than a number that goes stale.

Yes. Conformity reporting is built for repeat use across a customer base, producing the same baseline, overlay, and drift evidence per tenant rather than a one-off assessment format that has to be rebuilt manually for every review.

Baselines and overlays do not change often, but tenant configuration does, through new licences, changed conditional access policies, app registrations, and admin changes. A monthly or quarterly reassessment catches drift before it becomes an audit finding; EtherInsights tracks drift continuously between formal review cycles rather than only at the point of a scheduled report.

No. Baseline and overlay conformity scoring is a continuous configuration-assurance layer, not a substitute for independent penetration testing or a formal external audit. It is designed to make those exercises faster and cheaper by having current, evidenced conformity data ready before the auditor asks for it.

Configuration drift is when a tenant's actual settings quietly diverge from the policy or baseline that was originally approved, across Entra, Exchange, Teams, Intune, Defender, and Purview. It builds up through one-off admin changes, partial rollbacks, and settings that get touched during troubleshooting and never get reset. Microsoft's own Unified Tenant Configuration Management APIs (UTCM, in beta on Microsoft Graph since early 2026) are the first native way to baseline a tenant's configuration and monitor it for drift across workloads through one API surface, rather than relying on separate PowerShell scripts per service. EtherInsights tracks configuration drift against your own baseline continuously, so a change is caught and evidenced when it happens rather than at the next scheduled review.

Improving a security score means turning findings into completed changes, not just reading a number. EtherInsights keeps Microsoft Secure Score in the same operating view as baseline conformity (CISA SCuBA, Microsoft Security Baselines) and drift detection, and turns each gap into an owner-assigned action with evidence, so score improvement is tracked as work getting done rather than a dashboard that goes stale between reviews.