SECUREGAUGE — FREE, READ-ONLY M365 POSTURE SCANNER

Score it. Share it. Secure it.

WHAT IT DOES
- Connects to Microsoft 365 with delegated, read-only permissions only.
- Evaluates security controls across Identity, Mail, Sharing, and Posture.
- Calculates a 0–100 score and prioritizes findings by severity.
- Writes a JSON report, a shareable 1200×630 PNG scorecard, and a self-contained HTML scorecard with findings.

WHAT IT NEVER DOES
- Does not create, update, delete, remediate, or change Microsoft 365 settings.
- Uses Get-* and other read operations only.

REQUIREMENTS
1. PowerShell 5.1+; use `-SkipScoreCard` on non-Windows hosts.
2. The script needs these modules:
   Microsoft.Graph.Authentication
   Microsoft.Graph.Identity.SignIns
   Microsoft.Graph.Users
   Microsoft.Graph.Identity.DirectoryManagement
   Microsoft.Graph.Reports
   ExchangeOnlineManagement (unless you use -SkipExchange)
   Microsoft.Online.SharePoint.PowerShell (unless you use -SkipSharePoint)
3. If a required module is missing, the script can prompt to install it from PSGallery for the current user. Use your administrator-approved process instead if preferred.
4. Delegated Microsoft Graph consent for:
   Directory.Read.All, Policy.Read.All, UserAuthenticationMethod.Read.All,
   AuditLog.Read.All, Reports.Read.All, RoleManagement.Read.Directory

RUN THE FULL SCAN
  .\SecureGauge.ps1

RUN FOR A SPECIFIC TENANT AND OUTPUT FOLDER
  .\SecureGauge.ps1 -TenantId yourorg.onmicrosoft.com -OutputPath C:\Reports

RUN WITHOUT OPTIONAL EXCHANGE OR SHAREPOINT CHECKS
  .\SecureGauge.ps1 -SkipExchange -SkipSharePoint

SHARE A SCORECARD SAFELY
  .\SecureGauge.ps1 -AnonymizeTenant

OUTPUT
The script writes these files to `C:\Scripts` by default, creating that folder if needed:
- `SecureGauge-Report-YYYYMMDD-HHMMSS.json`
- `SecureGauge-Scorecard-YYYYMMDD-HHMMSS.png`
- `SecureGauge-Scorecard-YYYYMMDD-HHMMSS.html`

Use `-OutputPath` to choose another folder. Use `-SkipScoreCard` to skip the PNG (useful on non-Windows hosts) and `-SkipHtml` to skip the HTML scorecard.

SCORING BOUNDARY
The score is a prioritization aid, not a compliance certification, guarantee, or substitute for a full audit. Checks that cannot run are marked as skipped and are not included in the score.