Microsoft Secure Score is a number that shows how many of Microsoft's recommended security controls you have turned on in your Microsoft 365 tenant. Microsoft describes it as a measurement of your security posture, where a higher number means more recommended actions completed. It is a useful to-do list and a good way to track progress. It is not a verdict on whether you are secure.
This guide explains what the score measures, where to find it, how points are earned, how to read your result and how to raise it without breaking how your people work.
TL;DR
- Secure Score is a percentage of available points you have earned by configuring Microsoft-recommended controls across identity, devices, apps and data.
- Check it at the Microsoft Defender portal under Secure Score. You need a supported admin role.
- A higher score means more recommendations completed. It does not guarantee you will avoid a breach, and it does not prove compliance.
- Start with high-point, low-friction actions such as multifactor authentication, then work toward harder changes.
- Microsoft also has Defender for Cloud and Entra Identity scores. They are separate numbers, so do not mix them up.
Table of Contents
- What Microsoft Secure Score actually measures
- How to check your score
- How points are earned
- What is a good Secure Score?
- What the score does not tell you
- Which Secure Score are you looking at?
- How to raise your score without disrupting work
- Licensing and who can see what
- Using the score for reporting
- Our perspective on Secure Score
- When to bring in help
- FAQ
- Sources
What Microsoft Secure Score actually measures
Secure Score looks at your Microsoft 365 configuration and compares it with Microsoft's recommended settings. Per Microsoft's documentation, it is a numerical summary of how much of the recommended security control set you are using. It lets you report on where you stand, improve through guided actions and compare against benchmarks.
If you search for the M365 Secure Score, this is the same tool. The recommendations you see depend on the products you license. With a license for a supported Microsoft product, you see recommendations for that product.
In practice, the recommendations fall into a few areas:
- Identity: MFA, admin account hygiene, legacy sign-in blocking, conditional access.
- Devices: endpoint protection, encryption, configuration baselines.
- Apps: email protection, safe attachments, sharing settings.
- Data: labeling, retention and loss prevention policies.
The score is a configuration scorecard. It sees what is switched on. It does not see whether your staff will spot a convincing invoice scam, whether your backups restore, or whether a vendor with access to your network is careful.
How to check your score
- Sign in to the Microsoft Defender portal as an admin.
- Open the Secure Score page at security.microsoft.com/securescore. Microsoft's guidance confirms this path.
- Review your overall percentage, the breakdown by category and the list of improvement actions.
Access is controlled through Microsoft Defender Unified RBAC permissions or supported Microsoft Entra global roles, according to Microsoft. If you cannot see the page, your account probably lacks the right role. Give read access to the people who need to report on the score, and keep edit rights with the people who change configurations.
How points are earned
You earn points by configuring a recommended feature, completing a security task or applying an alternate mitigation, such as a third-party tool that covers the same risk. Microsoft says actions are scored either as all-or-nothing or as a percentage based on how widely you applied the setting across users or devices (source).
That second type matters. If you enable MFA for 40 of 50 users, you earn a share of the points, not none and not all. The last ten accounts are usually the shared mailboxes, service accounts and the executive who asked for an exception. Those are also the accounts attackers like.
The same principle applies beyond Microsoft 365. Each point you earn is a hardening step, and server hardening follows the same logic of reducing attack surface through documented settings. If you run Windows servers alongside your tenant, this Windows Server hardening guide covers practical admin steps in that spirit.
Why your score can drop
The score moves. Microsoft's security team notes it can fall when routine security tasks are not done regularly or when configurations change, and it points to what changed. A drop is a prompt to investigate. Common causes are new users added without the right policies, a new device class, a policy someone disabled to fix a login problem, or new recommendations Microsoft adds over time.
What is a good Secure Score?
There is no official passing grade. Microsoft compares your result with organizations of similar size, but that comparison tells you about the crowd, not about your risk. A company at 55% with MFA everywhere and tested backups can be in better shape than a company at 80% that skipped identity controls and never reviews alerts.
Use these reference points instead:
| Situation | How to read the score |
|---|---|
| Low score, no MFA or conditional access | Fix identity first. This is the fastest risk reduction. |
| Middle score, steady progress | Good. Track the trend and the quality of what is left. |
| High score, few reviews | Check that exceptions, admin accounts and alerts are managed. |
| Score flat for months | Someone needs to own the list, with dates. |
Aim for steady improvement and documented decisions for the actions you choose not to take. Some recommendations conflict with how a plant floor, a law office or a dental practice runs. Declining one on purpose, with a written reason, is a legitimate result.
What the score does not tell you
Microsoft is direct about this. Secure Score represents how much you use controls that can help offset breach risk. It is not an absolute measure of breach likelihood and does not guarantee you will avoid a breach.
Two cautions follow for regulated businesses:
- It is not a compliance report. A high score does not mean you meet HIPAA, FTC Safeguards, CMMC or NIST 800-171. If you handle controlled unclassified information, you need a separate assessment against the actual control set. Our NIST 800-171 self-assessment guide shows how to score yourself honestly.
- It only sees Microsoft. Your firewall, line-of-business software, phones, backup platform and vendor access are outside the number unless you map them in as alternate mitigations.
Which Secure Score are you looking at?
Microsoft uses "secure score" for several different tools, and they do not share a scale.
| Score | Where it lives | What it covers |
|---|---|---|
| Microsoft Secure Score | Defender portal | Microsoft 365 posture across identity, devices, apps and data |
| Identity Secure Score | Microsoft Entra admin center | Identity configuration, shown as a percentage |
| Cloud Secure Score | Defender for Cloud | Azure, AWS and GCP resources |
The Identity Secure Score is an indicator of how closely your Entra tenant matches Microsoft's recommendations. It is available to free and paid customers, though some recommendations need a paid license. The Defender for Cloud documentation says its two score models use different calculations and values, so a number from one cannot be compared with the other.
If you run a typical small or mid-sized business on Microsoft 365 with no Azure workloads, the Defender portal score is the one that matters most.
How to raise your score without disrupting work
The fastest way to waste a month is to switch on everything at once. Microsoft ranks improvement actions by points available, implementation difficulty, user impact and complexity. Use those columns as your sorting tool.
Step 1: Take a baseline and export it
Record your current percentage and the list of open actions. Without a baseline you cannot show progress to an owner, an insurer or an auditor.
Step 2: Fix identity first
Most small-business email compromises start with a stolen password. Require MFA for all users and admins, block legacy authentication and reduce the number of global admins. Our MFA setup guide for Microsoft 365 walks through the rollout, including the exceptions that cause the most help desk calls.
Step 3: Pilot anything with user impact
For actions marked as medium or high user impact, test with a small group for a week. In a manufacturer, include someone from the shop floor and someone from the front office. In a law firm or dental office, include the person who uses the oldest software.
Step 4: Batch the easy wins
Many actions are low effort and have no visible effect on staff. Do these together and note the date on each.
Step 5: Document what you skip
If you accept the risk or cover it another way, mark the action accordingly and write down who decided and why. That record is useful in a cyber insurance renewal or customer security questionnaire.
Step 6: Review on a schedule
Put a monthly review on a calendar. Look at what changed, what dropped and what Microsoft added. Our security assessment checklist gives a way to score, prioritize and fix findings in order.
Licensing and who can see what
You see recommendations for the Microsoft products you license, so a tenant with more advanced security products will see more actions than one without. Some actions you cannot complete at all without the matching license, which can leave you with points you cannot earn on your current plan. Before you buy an upgrade to chase points, confirm the action solves a risk you actually have.
For access, assign the least privilege that works. Reporting roles can view the score. Only the people who change tenant configuration should hold roles that let them act on it.
Using the score for reporting
The score gives you a number that non-technical leaders understand. Microsoft has said its analyzer lets you chart progress over time and export data for board reports. That makes it a good fit for a quarterly slide, as long as you pair it with a few facts the score cannot show: MFA coverage, backup restore test results, patch status and incident count.
Avoid making the score a target on its own. Teams that are rewarded for the number sometimes accept an action just to add points, without checking its effect on the business.
Our perspective on Secure Score
We look at Secure Score in almost every Microsoft 365 environment we assess. We like it. It is free, it is built into the tenant and it gives owners something concrete to ask about.
We also see where it misleads. A business can score well and still have shared passwords on a spreadsheet, a backup nobody has restored and a vendor account with permanent admin rights. The opposite happens too: a well-run company lags on points because it deliberately declined recommendations that did not fit.
Our view is that IT is infrastructure, not an expense to minimize. That means someone should own the score, the exceptions and the follow-through, every month. For our clients, that is part of a fixed per-user managed stack with 24/7 monitoring and proactive support. Strategic planning and audit readiness are included, not sold as extras.
Use the number as a starting point. Ask what it cannot see, and fill that gap with testing, documentation and people who answer the phone.
, Dustin Collett
When to bring in help
If your score is low, if you have regulated data, or if nobody on staff has time to own the list, an outside review saves months. Our IT & Security Assessment looks at your Microsoft 365 tenant, your network and your policies, then gives you a prioritized, documented plan. For a focused look at your tenant alone, see our Microsoft 365 environment assessment.
If you want ongoing ownership rather than a one-time review, our managed IT services cover monitoring, security management, backup and an unlimited help desk for a fixed cost per user. For businesses near us, we also offer Microsoft 365 consulting in West Bend. Book the IT & Security Assessment and we will walk you through what your score means for your business.
FAQ
How do I check my Microsoft Secure Score?
Sign in to the Microsoft Defender portal as an admin and open the Secure Score page. You need Defender Unified RBAC permissions or a supported Entra role. If the page does not load, ask your global admin to check your role.
What is a good Microsoft Secure Score?
Microsoft does not publish a passing grade. Treat the trend and the quality of the remaining actions as more important than the raw percentage. Focus first on identity controls, then document any recommendation you decide to skip.
Does a high Secure Score mean we are compliant?
No. Microsoft states the score is not a guarantee against a breach, and it does not map to a specific regulation. Compliance needs an assessment against the actual framework that applies to you.
Why did our Secure Score go down?
The usual causes are configuration changes, new users or devices without the right policies, and tasks that were not repeated on schedule. Review the history and the recommendation list to see what changed, then fix or document it.
Is Microsoft Secure Score the same as Defender for Cloud secure score?
No. They are different tools with different calculations, so the numbers cannot be compared. Microsoft Secure Score covers Microsoft 365, while Defender for Cloud scores your cloud resources.
Sources
- Microsoft Secure Score, Microsoft Defender XDR
- Assess your security posture through Microsoft Secure Score
- Improvement actions ranking, Microsoft Secure Score
- Identity Secure Score, Microsoft Entra ID
- Secure score in Defender for Cloud
- A quick wins approach to securing Azure AD and Office 365
- Understand and improve your security posture, Microsoft