Microsoft Secure Score

What it is

Secure Score lives in the Microsoft Defender portal. It gives your tenant a score and a ranked list of recommended actions, with links to the setting each one refers to. Recommendations cover Microsoft Entra ID, Exchange Online, SharePoint, Teams, Defender for Endpoint, Defender for Office 365 and several other products.

Each recommended action is worth up to 10 points. Most are all-or-nothing: create the policy or turn on the setting and you get the full points. Others are scored in proportion. Microsoft’s example is MFA: if 50 of your 100 users are protected, you get half the points for that action. If you deal with a recommendation some other way, or decide to accept the risk, you can mark it as such.

Turning on Security Defaults gives full points for three actions: making sure all users can complete MFA, requiring MFA for admin roles, and blocking legacy authentication.

Why it matters for a UK small business

It is the quickest way to see where your tenant stands, and a useful before-and-after measure for any security work. It also gives you something concrete to show a customer or insurer.

What it doesn’t tell you

Microsoft is clear that Secure Score is not an absolute measure of how likely you are to be breached, and not a guarantee against one. It reflects how far you are using the controls available. Microsoft also says security has to be balanced with usability and not every recommendation suits every environment.

In practice that means using it as a to-do list rather than a pass mark. A few actions, such as MFA and blocking legacy sign-in, matter far more than their points suggest, and some don’t fit a ten-person business at all. The score also moves as Microsoft adds recommendations, so check it regularly.

How &DEV helps: the Microsoft 365 MOT works through the recommendations that matter for your business and records Secure Score before and after.