Federal Agencies Got Free Tools and Clear Deadlines. Most Still Failed the Cloud Security Check.

October 9, 2026

Rodney Hall, COO— AI-assisted and reviewed prior to publication.

A Department of Homeland Security inspector general audit found that most federal civilian agencies missed a mandatory deadline to secure their Microsoft 365 environments, even though the government gave them a free assessment tool, a published checklist, and eight months of lead time. The report shows the gap wasn't unclear guidance. It was too few people who knew how to read the guidance and configure the controls it specified.

What Did the DHS Inspector General Actually Find?

The audit, tied to Binding Operational Directive 25-01, found that 88 of 102 federal civilian agencies, or 86%, had not implemented all mandatory SCuBA policies by the June 20, 2025 deadline. A follow-up check in February found little improvement, with 78 of 102 agencies, or 76%, still out of compliance.

The specifics matter more than the headline number. Investigators found that agencies failed to block outdated authentication methods, failed to enforce multifactor authentication consistently, and failed to implement policies protecting sensitive and personally identifiable information. These aren't exotic controls. They're the same identity and access fundamentals tested in every serious security certification, and they went unimplemented in the one environment where compliance was mandatory and free tooling existed.

What Is CISA Actually Asking Teams to Configure?

CISA built the Secure Cloud Business Applications project in 2022 to address cybersecurity and visibility gaps exposed by SaaS cyber intrusions and compromises, and it now publishes secure configuration baselines for Microsoft 365 and Google Workspace along with a no-cost scanning tool called ScubaGear. Binding Operational Directive 25-01 turned those baselines from optional guidance into a mandate, with agencies required to identify all cloud tenants by February 2025, deploy the assessment tooling by April 2025, and implement every mandatory policy by June 2025.

The Entra ID baseline sits at the center of the requirement set because identity is the layer everything else depends on. Specific mandates include phishing-resistant multifactor authentication for all users, blocking legacy authentication protocols entirely, and removing standing privileged access in favor of just-in-time role activation. The baseline document itself is explicit that users assigned to highly privileged roles shall not have permanent active role assignments, and that conditional access policies must require both MFA and a managed device before granting access.

Here's how the required timeline actually broke down:

Every one of those dates passed months before the inspector general published its findings, and most agencies still hadn't cleared the bar.

Why Did Compliance Fail With Free Tools and Clear Deadlines?

The honest answer is that writing a baseline and running a scanner are not the same as configuring a tenant correctly, and the second task requires people who understand conditional access logic, role scoping, and authentication protocols well enough to change them without breaking business operations. ScubaGear tells you what's wrong. It doesn't fix it for you, and a misapplied conditional access policy can lock out an entire agency's workforce just as easily as a missing one can let an attacker in.

The inspector general's report also noted something uncomfortable for anyone who assumes a mandate solves itself: CISA has no legal authority to force agencies into compliance once the directive is issued. The directive can require reporting, and CISA can see who's failing, but it has no enforcement lever beyond visibility. That places the entire burden of actually closing the gap on each agency's own security and identity staff, and staff shortages don't resolve because a deadline arrived.

This lines up with a broader pattern federal auditors and outside researchers keep documenting. The NSA has warned for years that cloud customers routinely misunderstand where their responsibility starts, noting that cloud service providers deliver highly automated, API-driven platforms that do exactly what customers tell them to, without human oversight on the provider's side. Misconfiguration isn't a provider failure. It's a customer-side execution failure, and the SCuBA results are a large-scale, publicly audited example of exactly that.

What Does This Mean If You Run a Tenant, Federal or Not?

CISA has said plainly that although the directive only binds federal civilian agencies, it strongly recommends every organization implement the same baselines and use the same free assessment tooling to reduce risk. If the agencies with the clearest mandate and the most oversight still missed the deadline on phishing-resistant MFA and legacy authentication blocking, a commercial security team without that mandate has no reason for confidence its own tenant is any better configured.

The practical fix isn't more paperwork. It's building the specific competency to read a conditional access policy, understand what a managed-device requirement actually enforces, and know why blocking legacy authentication protocols closes off an entire class of credential-stuffing attacks. That competency is exactly what identity and access administration training is built around, and it's a good gauge of whether your own team could pass the same audit the DHS inspector general just ran against 102 federal agencies.

If you're responsible for a Microsoft 365 or Entra ID environment and want to close this gap deliberately rather than reactively, Forge University's SC-300: Identity and Access Administrator training walks through conditional access design, privileged role management, and authentication policy configuration at the level auditors actually check. You can review how the curriculum maps to real-world identity operations on the certification resources page, and if you're ready to put a structured plan behind it, you can start training whenever it fits your schedule.

The Bigger Lesson for Security Teams

A published checklist and a free scanner reduce the excuse for noncompliance, but they don't reduce the amount of skilled judgment required to apply the checklist correctly across a live production tenant. The DHS audit is a rare case where that gap got measured at scale, publicly, with specific named failures.

Treat it as a preview of what an external assessor or insurer might find in your own environment if they ran the same scan. Phishing-resistant MFA, legacy authentication blocking, and least-privilege role assignment are not optional hardening steps anymore. They're the baseline, and the agencies that missed them had every resource except the people who knew how to finish the job.

Start training free at Forge University