Microsoft Secure Score

Understanding why It Matters and How to Improve It

In today’s cybersecurity landscape, businesses of all sizes face increasing threats to their digital infrastructure. As more organizations adopt Microsoft 365, it’s essential to understand and improve your Microsoft Secure Score to strengthen overall protection.

Microsoft Secure Score is a built-in security measurement tool that helps organizations identify risks, implement recommended security controls, and continuously improve their Microsoft 365 security posture. By reviewing your Secure Score and applying Microsoft’s best-practice recommendations, businesses can reduce vulnerabilities, improve compliance, and gain greater visibility into their organization’s security health.

Cyber Security Questions?

Useful Links

Learn About Microsoft Secure Score

Microsoft Secure Score helps organisations measure and improve their security posture by providing recommendations, tracking security settings, and identifying ways to strengthen Microsoft 365 protection.

What is the Microsoft Secure Score?

Microsoft Secure Score is a built-in security measurement tool within Microsoft 365 and Microsoft Defender that helps organisations understand and improve their cybersecurity posture. It provides a numerical score that represents how well your Microsoft 365 environment is protected against common security threats such as phishing, malware, and unauthorised access.

The score is calculated based on the security controls and configurations enabled across your Microsoft 365 services. As recommended security settings are implemented, the score increases, giving businesses a clear way to track improvements and identify areas that require attention.

Microsoft Secure Score evaluates security across areas such as:

Identity protection – Multi-Factor Authentication (MFA) and secure sign-in policies
Device security – Compliance policies and endpoint protection
Data protection – Email security and file protection controls
Application security – Safe configuration of Microsoft 365 services

By following Secure Score recommendations, organisations can reduce cyber risk, strengthen security controls, and better protect sensitive business data.

Why Does Secure Score Matter?

Microsoft Secure Score is more than just a number — it provides organisations with a clear and measurable view of their Microsoft 365 security posture. By analysing security configurations across identities, devices, applications, and data, Secure Score highlights areas where improvements can significantly reduce cybersecurity risks.

Secure Score provides actionable insights that help businesses strengthen their Microsoft 365 security configuration and protect against threats such as phishing, ransomware, and unauthorised access.

Key benefits of Microsoft Secure Score include:

Visibility: Understand what security controls are enabled and where improvements are needed.
Accountability: Assign recommended actions to IT teams and track security improvements over time.
Continuous Improvement: Monitor how your organisation’s security posture evolves as new protections are implemented.
Benchmarking: Compare your Secure Score against similar organisations and industry standards.
Compliance Alignment: Many recommendations support frameworks such as the ACSC Essential Eight and other cybersecurity best practices.

By regularly reviewing Secure Score recommendations, organisations can reduce risk, strengthen security controls, and maintain a more resilient Microsoft 365 environment.

How Is the Score Calculated?

Understanding how your Microsoft Secure Score is calculated is key to improving your Microsoft 365 security posture and strengthening your overall cybersecurity framework. Secure Score provides a measurable benchmark to assess how effectively your organisation protects identities, devices, data, and applications.

Each recommended action within Microsoft 365 Defender is assigned a weighted point value based on its risk reduction impact. As security controls are implemented, points are awarded and your score increases. Some recommendations require full deployment to gain points, while others provide partial credit depending on user or device coverage.

Key elements of Microsoft Secure Score calculation include:

  • Security recommendations (e.g., Multi-Factor Authentication (MFA)) carry specific score values.
  • Partial credit is awarded based on implementation coverage.
  • Total possible points depend on your Microsoft 365 licences and enabled services.
  • The score formula is: (Points Achieved ÷ Total Possible Points) × 100%.
  • The dashboard updates regularly to reflect configuration changes.

Importantly, Secure Score is a benchmarking tool—not a guarantee of protection.

How to Interpret Your Secure Score

Your Microsoft Secure Score is displayed as a percentage that reflects how your current security configuration compares to Microsoft’s recommended best practices. Here’s a general guide for interpreting your score:

  • 🔴 Below 60% — Low: This score indicates a significant security risk. Immediate improvements should be made to address critical vulnerabilities such as missing MFA, open access policies, or lack of monitoring tools.

  • 🟡 60% to 80% — Good: This range shows that your organization has implemented many essential security features but still has room to improve. You should focus on tightening controls and adding more advanced protections.

  • 🟢 Above 80% — Excellent: This reflects a strong security posture, with most of Microsoft’s recommended controls in place. The focus here should be on continuous monitoring, alert tuning, and refining policies for long-term resilience.

⚠️ Note: Even an “excellent” score doesn’t guarantee total protection—ongoing assessment and adaptation are key to staying ahead of evolving threats.

1. Visibility into Security Posture

Secure Score gives IT admins and business leaders a centralized view of current security configurations and practices. It surfaces risks that might otherwise go unnoticed and helps prioritize actions.

3. Benchmarking

You can compare your Secure Score to:

  • The average score of organizations like yours
  • Microsoft’s baseline recommendations
  • Your previous scores (for tracking improvement over time)

2. Prioritized Recommendations

Secure Score doesn’t just show you where you’re lacking—it tells you what to do next. The recommendations are ranked based on their impact and feasibility, allowing for strategic decision-making.

4. Compliance Support

While Secure Score isn’t a compliance tool, improving your score often aligns with regulatory frameworks like ISO 27001, NIST, and GDPR. It’s a solid step in your compliance journey.

Key Categories in the Secure Score

Identity (Microsoft Entra ID)
MFA for users and admins
Risk-based conditional access
Blocking legacy authentication

Device Security
Device compliance policies
Defender for Endpoint integration
Mobile application management (MAM)

Data Protection
DLP policies
Sensitivity labeling
Email encryption

Apps
App governance
Third-party app control
OAuth permissions management

Infrastructure
Defender for Cloud integration
Endpoint threat detection

How Often Should You Review It?

Regularly reviewing your Microsoft Secure Score is essential for maintaining a strong Microsoft 365 security posture. We recommend reviewing your Secure Score monthly, or weekly for high-risk industries such as healthcare, finance, or legal services. As your environment evolves—adding new users, devices, applications, or licences—new security recommendations may appear. Making Secure Score reviews part of your ongoing IT security checklist ensures continuous improvement and proactive risk management.

How to Access Your Secure Score

You can access your Microsoft Secure Score dashboard via:
👉 https://security.microsoft.com/securescore

Appropriate permissions are required, such as Global Admin, Security Admin, or Security Reader roles.

Limitations to Be Aware Of

While Secure Score is a powerful benchmarking tool, there are limitations:

  • Not all third-party security tools are reflected.
  • Some recommendations may not apply to your licensing or business needs.
  • Secure Score is not a guarantee of protection, but a baseline framework to guide stronger cybersecurity resilience.

Final Thoughts

Microsoft Secure Score is a powerful tool for organizations looking to enhance their Microsoft 365 security posture. It offers visibility, direction, and measurable goals in a format that’s easy to understand. Whether you’re an SMB or an enterprise, reviewing your Secure Score regularly and acting on its recommendations should be a core part of your cybersecurity strategy.

If your organization hasn’t reviewed its Secure Score in a while, now is the time to get started. Cyber threats aren’t slowing down—and neither should your security.

Top Actions to Improve Your Secure Score

Here are high-impact recommendations to get your score moving quickly:

  1. Enable Multi-Factor Authentication (MFA) for all users
  2. Disable legacy authentication protocols (e.g., POP, IMAP, SMTP basic auth)
  3. Apply Intune compliance policies for device health and encryption
  4. Use Microsoft Defender for Office 365 to protect against phishing and malware
  5. Deploy Sensitivity Labels to classify and protect data
  6. Implement Conditional Access to enforce secure access rules
  7. Audit privileged roles and restrict global admin usage
  8. Enable Safe Links and Safe Attachments for real-time content scanning

These actions not only improve your score but significantly reduce real-world risks.

High Impact Secure Score Enhancements

+.94%

Secure Score Boost

Enable Microsoft Defender Real-Time Protection

Microsoft Defender Real-Time Protection is a critical security feature in Microsoft 365 that continuously monitors devices for malware, ransomware, and suspicious activity. Unlike traditional antivirus software, real-time protection actively scans files, applications, and system behaviour as they are accessed, allowing threats to be blocked immediately.

Enabling Microsoft Defender Real-Time Protection is a high-priority Microsoft recommendation and delivers a high-impact improvement to Microsoft Secure Score, typically increasing the score by approximately 0.94%. Microsoft Secure Score measures an organisation’s security posture against Microsoft best practices and is used to identify security gaps and prioritise improvements.

This control significantly reduces the risk of malware infections, ransomware attacks, and endpoint compromise, particularly from email attachments and downloaded files. During implementation, we ensure Microsoft Defender is correctly enabled across supported devices, check for conflicts with other security software, and confirm endpoints are reporting correctly to Microsoft security services.

Microsoft Defender Real-Time Protection forms a foundational component of a strong Microsoft 365 security posture and is reviewed as part of ongoing quarterly security assessments.

+.94%

Secure Score Boost

Turn on Microsoft Defender for Endpoint Sensor

The Microsoft Defender for Endpoint sensor enables advanced threat detection, investigation, and response capabilities across your devices. The sensor collects behavioural and security telemetry that allows Microsoft to identify suspicious activity and potential attacks that traditional antivirus tools may miss.

Enabling the Defender for Endpoint sensor is a high-impact Microsoft Secure Score improvement, typically contributing approximately 0.94% to your Secure Score. This control significantly improves visibility into endpoint activity and supports proactive threat detection.

When the sensor is not enabled, security teams have limited insight into endpoint threats, increasing the risk of undetected attacks and delayed response. As part of implementation, we ensure the sensor is correctly activated, devices are successfully onboarded, and telemetry is flowing correctly to Microsoft security services.

This capability is a critical component of modern endpoint security and supports automated investigation and response features within Microsoft 365. It is reviewed and prioritised as part of ongoing Secure Score and cybersecurity posture assessments.

+.94%

Secure Score Boost

Fix Microsoft Defender for Endpoint Impaired Communications

Microsoft Defender for Endpoint relies on secure communication between devices and Microsoft security services to deliver alerts, telemetry, and automated responses. Impaired communications can prevent security events from being reported correctly, creating blind spots in endpoint protection.

Fixing impaired Defender for Endpoint communications is a high-impact Secure Score action, typically improving Microsoft Secure Score by approximately 0.94%. Restoring proper communication ensures endpoints are fully protected and security insights are accurate.

Communication issues can occur due to network restrictions, proxy configurations, firewall rules, or misconfigured security policies. During remediation, we identify and resolve the underlying cause, validate connectivity to Microsoft Defender services, and confirm devices are reporting normally.

If left unresolved, impaired communications can delay threat detection and response, increasing organisational risk. Ensuring Defender for Endpoint communicates correctly is essential for maintaining visibility, compliance with Microsoft best practices, and a strong overall Microsoft 365 security posture.

+.94%

Secure Score Boost

Fix Microsoft Defender for Endpoint Sensor Data Collection

Microsoft Defender for Endpoint sensor data collection enables Microsoft to analyse device activity and detect advanced threats. Without proper data collection, threat detection capabilities are reduced and Secure Score improvements cannot be fully realised.

Fixing sensor data collection is a high-impact Secure Score improvement, typically contributing approximately 0.94% to Microsoft Secure Score. This control ensures Defender for Endpoint has the telemetry required to perform effective detection and investigation.

Data collection issues may occur due to misconfigured policies, device onboarding problems, or permission restrictions. During implementation, we verify required data collection settings, confirm devices are correctly reporting telemetry, and ensure no conflicts exist within the environment.

Without proper data collection, security events may go unnoticed and response actions may be delayed. Restoring Defender for Endpoint sensor data collection improves endpoint visibility, supports automated threat response, and strengthens your overall Microsoft 365 security posture.

+.94%

Secure Score Boost

Ensure Multi-Factor Authentication for All Administrative Roles

Administrative accounts represent the highest-risk identities within Microsoft 365, as they have access to critical systems and sensitive data. Enforcing Multi-Factor Authentication (MFA) for all administrative roles significantly reduces the risk of tenant-wide compromise.

This control delivers a high-impact Microsoft Secure Score improvement, typically increasing the score by approximately 0.94%, and is strongly recommended by Microsoft. MFA prevents attackers from gaining access using stolen or guessed passwords alone.

During implementation, we review all administrative roles, ensure MFA is enforced via Conditional Access, and validate secure access methods for administrators. Exceptions are carefully managed to avoid disruption while maintaining strong security controls.

Without MFA, compromised admin credentials can result in severe security incidents, including data breaches and service disruption. Enforcing MFA for administrative roles is a foundational identity security measure and a key component of a strong Microsoft 365 security strategy.

+.94%

Secure Score Boost

Turn on Microsoft Defender Firewall

Microsoft Defender Firewall helps protect devices from unauthorised network access and malicious traffic. It monitors inbound and outbound connections, reducing the risk of network-based attacks and lateral movement within an environment.

Enabling Microsoft Defender Firewall is a high-impact Secure Score improvement, typically contributing approximately 0.94% to Microsoft Secure Score. This control strengthens endpoint and network security by enforcing consistent firewall protection across devices.

During implementation, we ensure the firewall is enabled, properly configured, and aligned with existing business requirements. Policies are validated to avoid disrupting legitimate applications or services while maintaining strong security controls.

Without an active firewall, devices are more vulnerable to network threats and exploitation. Microsoft Defender Firewall plays a critical role in a layered security approach and is reviewed as part of ongoing Secure Score and cybersecurity posture assessments.

+.94%

Secure Score Boost

Turn on Microsoft Defender Antivirus

Microsoft Defender Antivirus provides built-in malware protection for Windows devices and is tightly integrated with Microsoft 365 security services. It protects against viruses, ransomware, spyware, and other malicious software.

Enabling Microsoft Defender Antivirus is a high-impact Microsoft Secure Score recommendation, typically improving Secure Score by approximately 0.94%. It ensures devices have active and up-to-date antivirus protection aligned with Microsoft best practices.

During implementation, we confirm Defender Antivirus is enabled, verify it is receiving updates, and check for conflicts with other security software. Devices are validated to ensure consistent protection across the environment.

Without active antivirus protection, endpoints are significantly more vulnerable to malware infections and data compromise. Microsoft Defender Antivirus forms a core component of endpoint security and supports a strong, measurable Microsoft 365 security posture.

+.94%

Secure Score Boost

Enable Microsoft Defender Antivirus Scanning of Downloaded Files and Attachments

Malware is commonly introduced through downloaded files and email attachments. Enabling Microsoft Defender Antivirus scanning for downloads and attachments ensures these files are inspected before users can open them.

This control delivers a high-impact Secure Score improvement, typically increasing Microsoft Secure Score by approximately 0.94%, and is a key Microsoft-recommended security measure.

During implementation, we ensure scanning is enabled across supported devices and verify that downloads and attachments are actively inspected. This reduces the likelihood of malicious files executing and causing harm.

Without scanning enabled, malicious files may bypass security controls and execute on user devices. Enabling antivirus scanning for downloads and attachments significantly reduces malware risk and supports a layered Microsoft 365 security strategy reviewed during quarterly security assessments.

Microsoft Secure Score – Frequently Asked Questions

Microsoft Secure Score is a built-in tool in Microsoft 365 that helps organizations understand and improve their security posture. It analyzes your current configuration and behaviors and provides a score along with recommended actions to enhance security.

You can access it via the Microsoft 365 Defender portal:
https://security.microsoft.com/securescore
You’ll need the appropriate admin permissions to view the score.

A “good” score varies based on the size of your organization, licensing, and business needs. Generally:

  • Below 60%: Needs improvement

  • 60–80%: Reasonable/Good

  • Above 80%: Strong, but keep in mind that 100% is not always achievable or necessary.

Microsoft assigns point values to different security configurations and user behaviors. Your score is based on:

  • Security features you’ve enabled (e.g., MFA)

  • Actions you’ve taken

  • Device and app configurations

  • User behaviors (e.g., use of modern authentication)

Each recommended action includes points, and completing that action adds to your score.

Not necessarily. Secure Score shows how well you align with Microsoft’s best practices, but it doesn’t account for everything (like third-party tools or internal processes). It’s a great guide, but not a guarantee of total security.

We recommend reviewing it at least monthly — or weekly if you’re in a regulated industry or working toward compliance. Secure Score updates automatically as your environment changes.

Yes. You can filter recommendations based on what’s applicable to your environment. For example, if you don’t use Exchange Online, you can ignore those recommendations.

It covers major services such as:

  • Exchange Online

  • SharePoint Online

  • Microsoft Teams

  • Microsoft Defender for Office 365

  • Microsoft Entra (Azure AD)

  • Intune
    But it doesn’t measure security from third-party integrations or on-prem environments.

Start with high-impact actions like:

  • Enabling MFA for all users

  • Disabling legacy authentication

  • Configuring antivirus and endpoint detection

  • Setting conditional access policies

  • Enforcing device compliance in Intune

Absolutely. We specialize in Microsoft 365 security, and we can:

  • Assess your current score

  • Implement best-practice policies

  • Remediate high-risk items

  • Monitor improvements over time

  • Provide Secure Score reports in our quarterly IT reviews

What is Microsoft Secure Score?

To check your Secure Score, simply visit https://security.microsoft.com/securescore, and log in using your Microsoft 365 administrator account to view the results.

Key Features of Microsoft Secure Score

  1. Holistic Security Overview: Secure Score gives you a broad perspective on the security status of your Microsoft 365 environment. It evaluates multiple aspects, from identity protection to device management, providing you with a unified view of your security posture.
  2. Actionable Recommendations: Based on the analysis, Secure Score offers a list of actions you can take to boost your security score. These recommendations are practical and easy to implement, making it easier for organizations to gradually improve their defenses.
  3. Customizable Experience: Every business has unique security needs. Microsoft Secure Score recognizes this by allowing IT teams to tailor recommendations to suit their specific environment. You can choose which actions to prioritize based on your organizational goals and resources.
  4. Continuous Monitoring: Security is not a one-time task; it’s an ongoing effort. Microsoft Secure Score tracks your progress over time, showing you how implementing recommended changes impacts your overall security. You can also monitor how your security score changes when you add new services or change configurations.
  5. Third-Party Integrations: While Secure Score focuses on Microsoft products, it also allows integrations with third-party solutions. This feature broadens the scope of the security assessment, offering a more comprehensive view of your entire digital ecosystem.

How Microsoft Secure Score Helps Your Organization

  1. Identifies Weaknesses: Secure Score helps uncover vulnerabilities that may have gone unnoticed. It systematically reviews your security practices and highlights areas of improvement, helping you strengthen your defenses before an attack happens.
  2. Guided Improvement: It’s one thing to know where the issues are, but Secure Score also provides step-by-step guidance on how to resolve them. The platform prioritizes recommendations, making it easier for IT teams to address critical issues first.
  3. Improves Compliance: Secure Score aligns with industry standards, and by following its recommendations, your organization can also improve its compliance posture. This is particularly important for businesses operating in highly regulated industries like healthcare and finance.
  4. Promotes Accountability: The tool allows administrators to assign actions to specific users, ensuring that security tasks are distributed among the right people. The built-in tracking mechanisms hold teams accountable and offer visibility into progress.
  5. Risk Reduction: Ultimately, the goal of Microsoft Secure Score is to reduce your organization’s risk of being compromised. By continually improving your score and implementing the recommended actions, you reduce the likelihood of security breaches and other incidents that could impact your business.

Why Use Microsoft Secure Score?

Microsoft Secure Score serves as a valuable tool for assessing and enhancing your organization’s security posture. By identifying existing security flaws and suggesting actionable steps for improvement, it enables you to prioritize addressing vulnerabilities and thwart potential cyber threats.

The benefits of utilizing Secure Score extend to benchmarking your security against companies of similar industry and size. This comparison serves as a reference point for establishing key performance indicators (KPIs) unique to your organization.

Moreover, Microsoft Secure Score provides tailored protection for the specific Microsoft products in use within your organization. These include

  1. Microsoft 365 (including Exchange Online).
  2. Azure Active Directory.
  3. Microsoft Defender for Endpoint.
  4. Microsoft Defender for Identity.
  5. Microsoft Defender for Cloud Apps.
  6. Microsoft Teams.

What is an acceptable Secure Score?

Determining an acceptable Secure Score is context-dependent. For example, a small not-for-profit with fewer than a hundred users might consider an average Secure Score of 44% as good. However, it’s crucial to recognize that the acceptable average Secure Score varies based on factors such as industry, existing licenses, and the number of users. This nuanced approach ensures that benchmarks align with your organization’s unique risk acceptance and security requirements.

In summary, Microsoft Secure Score empowers organizations to proactively manage their security posture, establish meaningful benchmarks, and implement tailored protection across Microsoft’s suite of products.

How to improve my organisation’s Secure Score?

We recommend following these tips if you fall short of your industry’s benchmark but aim to improve your Secure Score.

  • Check the ‘Recommended Actions’ in Secure Score and sort by ‘Points Achieved’. It will tell you which actions will contribute to getting a higher score. In this screenshot for example, this organisation enabled multi-factor authentication (MFA) but only for select individuals. Turning it on for everyone else will give them a maximum of ten points.
  • Check the History tab in Secure Score to see if your score is dropping. It shows your score in real-time and will tell you exactly the reasons why so you can remediate them.
  • Ensure you have configured your Microsoft 365 security correctly so you have full visibility of your servers and workstations. It is not hard to bring up your Secure Score in Microsoft 365 and Azure environments with just emails and some servers on them. But the moment you integrate them with your endpoint and put Microsoft Defender for Endpoint, it will pick up security issues in your workstations which then pulls your score down.So many times we see people getting fooled when they see a high or good enough number on their Secure Score, but in reality they have not yet integrated it with one of the most important piece of hardware they have: their users’ workstations. Workstations are one of the main entry points for hackers and can be easily compromised without the right protection.

Improving your Secure Score is an ongoing process. Here are some best practices to get started:

  1. Prioritize Identity Protection: Implement multi-factor authentication (MFA) for all users, especially administrators. Identity protection is one of the most critical components of cybersecurity, and enabling MFA significantly reduces the risk of unauthorized access.
  2. Secure Devices: Ensure that all devices connecting to your organization’s network are secure. Implement mobile device management (MDM) and ensure that security patches are regularly applied.
  3. Data Protection: Protect your sensitive data by implementing encryption policies, data loss prevention (DLP) rules, and cloud app security. This ensures that even if data is accessed or stolen, it remains protected.
  4. Leverage Conditional Access: Conditional Access policies in Microsoft 365 provide an additional layer of security. They allow you to control who can access specific resources, based on location, device, and other factors.
  5. Monitor and Respond to Threats: Use the insights from Secure Score to implement threat detection and response systems, such as Microsoft Defender for Endpoint, to stay on top of potential risks.

How do Essential Eight and Microsoft Secure Score align?

  • Can an organisation just use one or the other to get an accurate reading of its security posture? Essential Eight is one security framework you can use to strengthen your security stance, but the Secure Score is built right into your Microsoft 365 platform. Both frameworks overlap to some degree, but they’re not 100% match for match because they focus on slightly different things.

    Secure Score focuses more on prevention, and a lot of the solutions in the Microsoft Defender suite aid in helping organisations get to a better maturity level in Essential Eight. In contrast, Essential Eight focuses on recovery to ensure your business gets back on track when a cyber incident happens, which the Secure Score doesn’t look at.

    We highly recommend using these two frameworks to reinforce your security, for example, by going through your Secure Score and using it for reference to prevent lateral movement in your network. Lateral movement is where an attacker gets access to a compromised admin account and goes deeper into your network in search of sensitive data or intellectual information. Using the least privilege and just-in-time domain admin access as much as possible would not only tick off the lateral problem but also pick up Microsoft Defender and some of the items in the Essential Eight maturity level. Without local admin credentials, compromised servers reduce significantly.

Conclusion

  • Microsoft Secure Score is a powerful tool to get an overview of your organisation’s current state of security posture along with the steps you can take to improve it. Combining it with an industry-recommended framework such as Essential Eight further fortifies your IT security strategy against evolving cyber threats.

    Doing this could be tough for most organisations because not everyone has the expertise or time to do so, but you don’t have to do it alone. Partnering with a proven and skilled Microsoft 365 + Security partner like Total Solutions IT can help you achieve the best combination between a secure IT environment and a great user experience.

    Contact us today to learn how to get your Secure Score reviewed or if you have other questions about this blog post.