ScubaGear Files

Major Changes

• Add a GUI to ScubaGear for creating configuration files by @DickTracyII in https://github.com/cisagov/ScubaGear/pull/1812
• Add authentication strength capability for MS.AAD.3.2v1 by @dagarwal-ecs in https://github.com/cisagov/ScubaGear/pull/1766
• Update policy migration state for MS.AAD.3.4v1 by @MichaelHicks-MSFT in https://github.com/cisagov/ScubaGear/pull/1778
• Risky delegated/application permissions update by @amart241 in https://github.com/cisagov/ScubaGear/pull/1757
• Add DNS configuration options by @adhilto in https://github.com/cisagov/ScubaGear/pull/1758
• Update MS.AAD.6.1v1 to consider non-root domains by @mitchelbaker-cisa in https://github.com/cisagov/ScubaGear/pull/1755
• Sort conditional access policies by state by @MichaelHicks-MSFT in https://github.com/cisagov/ScubaGear/pull/1787
• Modify the ScubaResults JSON schema to better define policy omission/annotation fields by @mitchelbaker-cisa in https://github.com/cisagov/ScubaGear/pull/1795
• Updated AAD provider for robust license handling by @dagarwal-ecs in https://github.com/cisagov/ScubaGear/pull/1791
• Add risky apps/service principals to the AAD HTML report by @mitchelbaker-cisa in https://github.com/cisagov/ScubaGear/pull/1780
• Update Invoke-CheckScubaGearVersion function by @MichaelHicks-MSFT in https://github.com/cisagov/ScubaGear/pull/1833
• Clean up the parameter battlefield location in Invoke-SCuBA by @skirkpatrickMSFT in https://github.com/cisagov/ScubaGear/pull/1832
• Add service principal module to ScubaGear by @MichaelHicks-MSFT in https://github.com/cisagov/ScubaGear/pull/1880
• Implement ScubaConfig validation with JSON schema and defaults by @DickTracyII in https://github.com/cisagov/ScubaGear/pull/1904
• Enhance module dependency checks and improve Initialize-SCuBA by @MichaelHicks-MSFT in https://github.com/cisagov/ScubaGear/pull/1948
• See full list of enhancements here

Bugs Fixed

• Fix bug when tenant has no conditional access policies by @adhilto in https://github.com/cisagov/ScubaGear/pull/1762
• Correct false negative for MS.TEAMS.1.7v2 by @dagarwal-ecs in https://github.com/cisagov/ScubaGear/pull/1775
• Updated manual download OPA pointer when OPA installation fails during initialization. by @ahuynhECS in https://github.com/cisagov/ScubaGear/pull/1771
• Update write permissions for the PS version bump workflow by @skirkpatrickMSFT in https://github.com/cisagov/ScubaGear/pull/1740
• Update Orchestrator.psm1 validation to terminate ScubaGear execution if config file is incorrect by @skirkpatrickMSFT in https://github.com/cisagov/ScubaGear/pull/1781
• Fix configuration documentation broken links by @DickTracyII in https://github.com/cisagov/ScubaGear/pull/1820
• Fix anchor tags issue by @dagarwal-ecs in https://github.com/cisagov/ScubaGear/pull/1806
• Fix version comparison to use System.Version rather than Strings by @buidav in https://github.com/cisagov/ScubaGear/pull/1861
• Refactor dependency status recommendations and improve version mismatch by @MichaelHicks-MSFT in https://github.com/cisagov/ScubaGear/pull/1857
• Update ResolutionDate from N/A to null by @dagarwal-ecs in https://github.com/cisagov/ScubaGear/pull/1891
• Fix policies missing from the config UI control JSON by @DickTracyII in https://github.com/cisagov/ScubaGear/pull/1872
• Fix encoding issue for Invoke-SCuBACached by @DickTracyII in https://github.com/cisagov/ScubaGear/pull/1906
• Set the default for -LogIn parameter to $false for Invoke-SCuBACached by @DickTracyII in https://github.com/cisagov/ScubaGear/pull/1905
• Detect single module versions outside min/max range by @MichaelHicks-MSFT in https://github.com/cisagov/ScubaGear/pull/1975
• See full list of bug fixes here

Baselines

BOD 25-01 required configuration policy changes

This section lists baseline policy changes that affect current BOD 25-01 Required Configurations.

Additions

No new required configuration policies added in this release.

Removals

• MS.TEAMS.3.1v1 (SHALL) - The option to restrict contact with Skype users found in policy MS.TEAMS.3.1v1 has been deprecated by Microsoft. All references, including the policy and its implementation steps, have been removed since the setting is no longer present.

Updates

• MS.TEAMS.1.2v2 (SHALL) - policy version bumped to v2 due to changes where the configuration settings are located.
• MS.TEAMS.2.1v2 (SHALL) - policy version bumped to v2 due to changes where the configuration settings are located.
• MS.TEAMS.2.2v2 (SHALL) - policy version bumped to v2 due to changes where the configuration settings are located.

Other baseline changes

• Update AAD baseline to reflect new Microsoft Entra ID portal changes by @Michael-Dahlke in https://github.com/cisagov/ScubaGear/pull/1744
• Microsoft Defender baseline UI updates by @Jeremye22 in https://github.com/cisagov/ScubaGear/pull/1764
• Update Teams baseline information with UI changes by @skirkpatrickMSFT in https://github.com/cisagov/ScubaGear/pull/1777
• See full list of baseline updates here

Documentation

• Add full config file to include all possible parameters by @DickTracyII in https://github.com/cisagov/ScubaGear/pull/1779
• Update documentation to include list of required min/max powershell module versions in Dependencies.md by @skirkpatrickMSFT in https://github.com/cisagov/ScubaGear/pull/1793
• Create update Instructions by @MichaelHicks-MSFT in https://github.com/cisagov/ScubaGear/pull/1804
• Enhance ScubaGear documentation and sample configurations by @DickTracyII in https://github.com/cisagov/ScubaGear/pull/1786
• Update parameters.md -DisconnectOnExit description by @jorenminer-nexus in https://github.com/cisagov/ScubaGear/pull/1850
• Add documentation for Invoke-SCuBACached by @DickTracyII in https://github.com/cisagov/ScubaGear/pull/1881
• Update service principal module documentation by @MichaelHicks-MSFT in https://github.com/cisagov/ScubaGear/pull/1953
• See full list of documentation updates here

Dependencies

• Bump AST version from 5.0.0 to 6.0.1 by @mitchelbaker-cisa in https://github.com/cisagov/ScubaGear/pull/1843
• Bump latest supported OPA version to v1.13.1 by GitHub Actions in https://github.com/cisagov/ScubaGear/pull/1957
• Bump maximum supported version for the MicrosoftTeams module to v7.5.0 by GitHub Actions in https://github.com/cisagov/ScubaGear/pull/1897
• Pin maximum supported version for the Microsoft.Graph.Authenticatino module to v2.25.0 by GitHub Actions in https://github.com/cisagov/ScubaGear/pull/1844

Full Changelog: https://github.com/cisagov/ScubaGear/compare/v1.6.0...v1.7.0