Microsoft Secure Score is the number on the front page of the Defender portal that every owner eventually asks about. “We are at 42 percent, is that bad?” The honest answer is that the number alone tells you very little. What matters is which points you are missing, why, and whether the fix is worth it for your business.
This guide explains how Secure Score actually works, how to read it without panicking, and the order I use to work through the recommended actions in a typical 20 to 500 person tenant.
What Microsoft Secure Score measures
Secure Score is a list of security recommendations across Microsoft 365, each worth a number of points. You earn points when Microsoft can see that you have configured a setting or completed a task. Your score is the points you have earned divided by the points available.
A few details matter more than the headline percentage:
Each action is worth 10 points or less. Some are all-or-nothing. Others give partial credit, for example MFA coverage scored as a share of your users.
Recommendations cover products you may not own. Microsoft shows the full set of recommendations for a product regardless of your license edition. That means some points are effectively out of reach unless you upgrade.
It is not real time for everything. After you complete an action, Microsoft says it can take 24 to 48 hours for the change to show up. Some identity recommendations refresh on a weekly cycle.
Third-party tools count if you say so. You can mark an action as “Resolved through third party” or “Resolved through alternate mitigation” and receive the points. Microsoft cannot verify those, so use them honestly.
You find it in the Microsoft Defender portal at security.microsoft.com/securescore.
Why Secure Score is not a grade
A school grade tells you how you did against a fixed standard. Secure Score is closer to a checklist written by someone who does not know your business. That has three consequences.
A low score can still be a reasonably safe tenant
If you run a third-party email filter, an endpoint product from another vendor, or you simply do not use a service like Teams external access, you will be “missing” points that do not reflect real risk. Mark those correctly and the number moves.
A high score can hide a serious gap
Because points are capped at 10 per action, a single critical item, like one Global Administrator with no MFA, can be worth fewer points than a cluster of low-impact settings. I have seen tenants in the 70s with a wide-open admin account, and tenants in the 40s that were well protected.
Comparisons are only a rough guide
The portal lets you compare your score to organizations of a similar size. That is interesting, but it says nothing about whether those organizations are secure. Use it as context, not as a target.
How to read your score in five minutes
Open Secure Score and select the Include option next to your score. Turn on Current license score and Achievable score. These show what you could reach with the licenses you already own. The gap between your score and the current license score is the most useful number on the page.
Go to the Recommended actions tab. Microsoft ranks these by points remaining, difficulty, user impact, and complexity.
Group by Category (Identity, Data, Device, Apps). Identity items are usually where the biggest risk reduction sits.
Filter to To address so you only see open items.
Open the top ten and read the User impact and Implementation sections. These tell you whether a change will generate help desk calls.
What to fix first
Do not work strictly top to bottom. Use risk first, then effort. This is the order I recommend for most small and mid-sized businesses.
Priority
Recommended action type
Why it comes first
1
Require MFA for administrative roles
Admin takeover is the worst-case scenario in any tenant
2
Ensure all users can complete MFA / require MFA for all users
Stops most password spray and credential stuffing
3
Block legacy authentication
Older protocols cannot do MFA and are used to bypass it
4
Automatic forwarding and outbound spam settings
Shuts down a favorite data theft trick after mailbox compromise
Important, but often needs Intune rollout planning
If you use security defaults in Microsoft Entra ID, Microsoft awards full points for the MFA registration, admin MFA, and legacy authentication actions. Moving to Conditional Access (which needs Entra ID P1, included in Business Premium) gives you more control, but the score may not change much. That is fine. You are doing it for flexibility, not points.
Using statuses correctly
Every recommended action can be given a status. Using them well keeps your score honest and your to-do list clean.
To address: the default. You plan to deal with it at some point.
Planned: you have a concrete plan and date. Use the notes field to record it.
Risk accepted: you have decided not to do it. You get no points. Write down why, and who approved it.
Resolved through third party / alternate mitigation: something else covers it. You get the points. Only use this if you can point to the control.
A short note on each “Risk accepted” item is one of the most useful things you can do for a future auditor or cyber insurance questionnaire. It shows the decision was deliberate.
Building a Secure Score routine
Secure Score works best as a monthly habit, not a one-time project. A simple routine:
Check the History tab once a month for drops. A sudden fall usually means someone changed a setting or a new recommendation was added.
Pick two or three actions per month to complete or formally decide on.
Share the score trend with leadership quarterly, along with a one-line explanation of what changed.
There is no universal good number. A better target is closing the gap between your current score and your current license score, while making sure the identity actions (admin MFA, MFA for all users, blocking legacy authentication) are complete.
Why did my Secure Score drop when I did not change anything?
Microsoft adds new recommendations over time, which increases the total points available and can lower your percentage. A setting may also have been changed by another admin. Check the History tab to see which.
Does buying more licenses raise my Secure Score?
Not by itself. Points come from configuring features, not owning them. A new license makes more actions achievable, but you still have to turn them on.
Not sure which Secure Score actions matter for your business? Get a free Microsoft 365 security assessment and we will translate your score into a short, prioritized plan.
Microsoft Secure Score is the number on the front page of the Defender portal that every owner eventually asks about. “We are at 42 percent, is that bad?” The honest answer is that the number alone tells you very little. What matters is which points you are missing, why, and whether the fix is worth it for your business.
This guide explains how Secure Score actually works, how to read it without panicking, and the order I use to work through the recommended actions in a typical 20 to 500 person tenant.
What Microsoft Secure Score measures
Secure Score is a list of security recommendations across Microsoft 365, each worth a number of points. You earn points when Microsoft can see that you have configured a setting or completed a task. Your score is the points you have earned divided by the points available.
A few details matter more than the headline percentage:
You find it in the Microsoft Defender portal at
security.microsoft.com/securescore.Why Secure Score is not a grade
A school grade tells you how you did against a fixed standard. Secure Score is closer to a checklist written by someone who does not know your business. That has three consequences.
A low score can still be a reasonably safe tenant
If you run a third-party email filter, an endpoint product from another vendor, or you simply do not use a service like Teams external access, you will be “missing” points that do not reflect real risk. Mark those correctly and the number moves.
A high score can hide a serious gap
Because points are capped at 10 per action, a single critical item, like one Global Administrator with no MFA, can be worth fewer points than a cluster of low-impact settings. I have seen tenants in the 70s with a wide-open admin account, and tenants in the 40s that were well protected.
Comparisons are only a rough guide
The portal lets you compare your score to organizations of a similar size. That is interesting, but it says nothing about whether those organizations are secure. Use it as context, not as a target.
How to read your score in five minutes
What to fix first
Do not work strictly top to bottom. Use risk first, then effort. This is the order I recommend for most small and mid-sized businesses.
If you use security defaults in Microsoft Entra ID, Microsoft awards full points for the MFA registration, admin MFA, and legacy authentication actions. Moving to Conditional Access (which needs Entra ID P1, included in Business Premium) gives you more control, but the score may not change much. That is fine. You are doing it for flexibility, not points.
Using statuses correctly
Every recommended action can be given a status. Using them well keeps your score honest and your to-do list clean.
A short note on each “Risk accepted” item is one of the most useful things you can do for a future auditor or cyber insurance questionnaire. It shows the decision was deliberate.
Building a Secure Score routine
Secure Score works best as a monthly habit, not a one-time project. A simple routine:
For a deeper look at where your tenant stands beyond the score, our Microsoft 365 security assessment reviews the settings Secure Score does not weigh well. If you are weighing whether E5 features are worth the extra points, the E5 vs E3 calculator helps with the licensing side, and our managed security service can own the monthly routine for you. Microsoft documents the scoring rules in its Microsoft Secure Score overview.
Frequently asked questions
What is a good Microsoft Secure Score?
There is no universal good number. A better target is closing the gap between your current score and your current license score, while making sure the identity actions (admin MFA, MFA for all users, blocking legacy authentication) are complete.
Why did my Secure Score drop when I did not change anything?
Microsoft adds new recommendations over time, which increases the total points available and can lower your percentage. A setting may also have been changed by another admin. Check the History tab to see which.
Does buying more licenses raise my Secure Score?
Not by itself. Points come from configuring features, not owning them. A new license makes more actions achievable, but you still have to turn them on.
Not sure which Secure Score actions matter for your business? Get a free Microsoft 365 security assessment and we will translate your score into a short, prioritized plan.