If you run security audits for Microsoft 365 tenants, you've probably hit the same question we hear from MSPs constantly: which standard do I actually measure against? There are three serious options in circulation — the CIS Microsoft 365 Benchmark, EIDSCA, and CISA's SCUBA — and they aren't interchangeable. Each was built for a different audience with different goals, and picking the wrong one for your client base means wasted effort or findings that don't hold up in a client conversation.
This post breaks down what each standard is, where they overlap, and how to decide which one (or which combination) belongs in your audit process.
The CIS Microsoft 365 Benchmark
The CIS Microsoft 365 Benchmark is the one most MSPs already know. It's published by the Center for Internet Security — the same nonprofit behind the widely referenced CIS Controls — and it's part of a larger family of benchmarks covering everything from Windows to AWS.
A few things make the CIS Microsoft 365 Benchmark the default starting point for most auditors:
- It's prescriptive. Each recommendation tells you the exact setting, the rationale, the impact, and often the PowerShell or portal path to check and remediate it. There's little ambiguity about what "pass" looks like.
- It has two profile levels. Level 1 covers baseline settings that are safe to apply broadly with minimal disruption. Level 2 covers hardened settings that improve security but may affect usability — useful for higher-risk clients but worth discussing before enforcing.
- It maps cleanly to the CIS Controls. If your clients are already working toward a CIS Controls posture, the benchmark slots in naturally.
- It's recognized. When you hand an IT director a report that says "measured against the CIS Microsoft 365 Benchmark," they generally know what that means. That recognition carries weight in renewal and compliance conversations.
The tradeoff: CIS covers the broad Microsoft 365 surface (Exchange, SharePoint, Teams, Defender, admin settings) but it isn't the deepest resource on Entra ID specifically. It also moves on its own release cycle, so a given version may lag slightly behind the newest tenant features.
EIDSCA: The Entra ID Specialist
EIDSCA — the Entra ID Security Config Analyzer — is a community-driven project focused exclusively on the identity layer. Where CIS is broad, EIDSCA is deep. It defines a large set of specific configuration controls for Entra ID: Conditional Access, authentication methods, authorization policies, consent settings, app registration behavior, and more.
If your clients live and die by identity — and in Microsoft 365, most security incidents trace back to identity — EIDSCA fills gaps that a broad benchmark can't. It gets into the granular settings that attackers actually exploit: legacy authentication, risky consent grants, token lifetime policies, and the exact Conditional Access conditions that separate a hardened tenant from an exposed one.
The character of EIDSCA is different from CIS. It's:
- Technical and current. It tracks Entra ID closely and reflects newer identity features faster than a formal benchmark release cycle.
- Narrow by design. It won't tell you anything about SharePoint sharing settings or Exchange transport rules. It's an identity tool, not a tenant-wide standard.
- Less "official." It's an excellent community resource, but it doesn't carry the same brand recognition as CIS in a boardroom. That's fine for the engineers doing the work — just know it's a supplement, not a replacement.
SCUBA: The US Federal Baseline
SCUBA (Secure Cloud Business Applications) is CISA's project, and its Microsoft 365 component — sometimes called the M365 Secure Configuration Baseline — exists primarily to help US federal civilian agencies lock down their tenants. CISA also ships ScubaGear, an open-source PowerShell tool that assesses a tenant against the baseline and produces a report automatically.
SCUBA is worth understanding even if you don't serve government, because:
- It's a well-reasoned baseline from a credible authority. The recommendations are thoughtful and the rationale is public.
- ScubaGear is a real, usable tool you can run against a tenant for free. It's a reasonable way to get a second data point.
- It's mandatory context for certain clients. If you have — or want — public-sector or government-adjacent clients, SCUBA is the language they speak.
The caveats: SCUBA is scoped to federal needs. Some of its assumptions and priorities reflect government risk tolerance rather than a typical MSP's commercial client. It's also narrower in product coverage than CIS in some areas. For a general MSP book of business, SCUBA is a strong reference point but an awkward fit as your only standard.
How They Overlap — and Where They Don't
All three agree on the fundamentals. Disable legacy authentication. Enforce MFA. Restrict risky app consent. Limit global admin count. Protect privileged roles. If a tenant fails these across any standard, it fails everywhere.
The divergence is in depth and scope:
- CIS = broadest tenant coverage, prescriptive, two risk levels, strong recognition.
- EIDSCA = deepest identity coverage, most current, narrow to Entra ID.
- SCUBA = credible federal baseline with a free tool, best suited to government-aligned clients.
They are not competitors so much as different lenses. The mistake is treating this as a single either/or choice.
Which Should Your MSP Follow?
For most MSPs serving commercial clients, the practical answer is:
Lead with CIS, enrich with EIDSCA.
Use the CIS Microsoft 365 Benchmark as your backbone. It gives you broad, recognizable, prescriptive coverage across the whole tenant,