Microsoft Secure Score is a numerical score that shows how well your Microsoft 365 environment follows Microsoft’s recommended security settings. A higher score means you’ve taken more of the recommended actions. You can see yours in the Microsoft Defender portal, along with a prioritized list of what to change, which makes it a useful starting point for Microsoft 365 security.
It’s useful, and easy to misread. Here’s how it works, what a good score actually means, and where to start if yours is low.
What Is Microsoft Secure Score?
Microsoft describes Secure Score as a measurement of an organization’s security posture, with a higher number indicating more recommended actions taken. It lives in the Microsoft Defender portal (formerly called the Microsoft 365 Defender portal), and it gives you one dashboard for the security of your Microsoft 365 identities, apps, and devices. You’ll also see it called the Microsoft 365 Secure Score, the Microsoft security score, or just your security score, and Microsoft 365 is often shortened to M365. The recommended actions are built on recommended security best practices, so each one comes with actionable security recommendations rather than a vague warning.
Recommendations fall into four main categories: identity, data, devices, and apps. They cover products like Microsoft Entra ID (where your users sign in), Exchange Online, SharePoint Online, Teams, and the Microsoft Defender tools, plus recommendations for some non-Microsoft products. Because it works per tenant, managed providers often track scores across many Microsoft 365 tenants at once.
Secure Score does three things for you: it reports where your security posture stands today, it tells you what to change to improve it, and it lets you compare against benchmarks and track progress over time.
How Does Microsoft Secure Score Work?
You earn points for configuring recommended security features, doing security-related tasks, or addressing a recommended action with a non-Microsoft tool or an alternate mitigation.
Each recommended action is worth 10 points or less. Most are scored as all or nothing: turn on the setting, get the points. Others give partial credit based on coverage. Microsoft’s own example: an action worth 10 points for protecting all users with multifactor authentication (MFA). If only 50 of your 100 users are protected, you earn 5 points.
A few details are worth knowing:
- Non-Microsoft tools count. If another product already handles the recommendation, you can mark it as addressed by that tool and earn the points.
- It updates on a schedule. The dashboard updates in real time, while points for completed actions sync daily. Some Entra and Teams recommendation states refresh weekly or monthly, so a change you just made may not show up immediately.
How Do You Check Your Microsoft Secure Score?
To see your score, sign in to the Microsoft Defender portal and open Secure Score, or go directly to security.microsoft.com/securescore. You’ll see your current score, a breakdown by category, and the list of recommended actions, which helps you identify areas where there are gaps in your security.
Not everyone can see it. Roles with read and write access include Security Administrator (or higher), Exchange Administrator, and SharePoint Administrator. Roles with read-only access include Security Reader, Security Operator, Global Reader, Helpdesk Administrator, and User Administrator. Microsoft recommends using roles with the fewest permissions, so you don’t need to hand someone Global Administrator rights just so they can look at the score.
What Is a Good Microsoft Secure Score?
There’s no single number that counts as “good.” Microsoft’s overview doesn’t set a target score. It points you toward two comparisons instead: how you compare with similar organizations (you can see how your score compares with organizations like yours), and how your own score trends over time. If you have a low Secure Score, that comparison and your own history are the best places to start.
Chasing 100% isn’t the goal either. Microsoft itself notes that security should be balanced with usability, and that not every recommendation will work for your environment. A recommendation that breaks a workflow your business depends on may be better accepted as a risk than forced through.
A more useful question than “is our score high?” is “does our organization understand why it’s where it is?” A score of 60% with clear, documented reasons for each open item is healthier than a score of 80% that nobody can explain.
Does Your Microsoft 365 License Affect Your Secure Score?
Less than you’d think, but it affects what you can do about it. Microsoft shows you the full set of recommendations for a product regardless of your license edition, and it says your absolute security posture, as represented by Secure Score, stays the same no matter what licenses you own.
What licensing does change is what you can actually implement. In our experience, some recommendations map to features that need a higher license tier, and tier choices can limit detection capability too: in one recent security review across client environments, gaps in our ability to detect a type of account takeover traced partly to licensing tiers that didn’t include the monitoring features the business assumed it had. Licensing is a budget decision with security consequences, which is exactly the kind of connection we describe in our guide to virtual CIO services.
How to Improve Your Microsoft Secure Score: What to Fix First
To improve your Secure Score and your overall security posture, follow four steps.
- Check your score. Note your current score and which categories are weakest, so you know where to address security risks first.
- Rank the recommended actions. Sort by impact and effort, not just by points. Start with high-impact, low-disruption changes. Mark anything you won’t do as accepted risk, with a reason.
- Fix the gaps. Make changes in a controlled way. We recommend testing policies in report-only mode before enforcing them, so a new Conditional Access rule doesn’t lock people out on a Monday morning.
- Track progress. Use the score history and comparison tools to confirm the changes took, to improve your score over time, and to show leadership the trend.
Start with identity. Several of the highest-value actions are about identity and access management, meaning how people sign in, for good reason. Microsoft’s 2025 Digital Defense Report found that more than 97% of identity attacks are password attacks, and that identity-based attacks rose 32% in the first half of 2025 alone. Microsoft also reports that phishing-resistant MFA can stop over 99% of these attacks, even when the attacker has the correct username and password.
One honest distinction: Secure Score rewards MFA broadly, while Microsoft’s 99% figure applies specifically to phishing-resistant MFA, such as hardware security keys or passkeys. Basic MFA is a big improvement, and phishing-resistant MFA is the stronger target.
The easiest identity wins may already be available. If you turn on security defaults in Microsoft Entra ID, Microsoft awards full points for these actions:
| Recommended action | Points | What it does |
| Require MFA for administrative roles | 10 | Protects the accounts with the most power |
| Ensure all users can complete MFA | 9 | Extends MFA protection to everyone |
| Block legacy authentication | 7 | Closes older sign-in methods that can’t prompt for MFA |
Security defaults are meant for organizations that haven’t built their own Conditional Access policies. If you’re already using Conditional Access, you meet the same actions through your own policies instead.
Beyond the basics, here’s what we see in practice:
- Reduce standing admin access. In one recent engagement, a small professional-services client was working to move its administrators to just-in-time role assignments, so powerful roles are only active when needed, rather than leaving always-on global admin accounts.
- Plan for people without smartphones. One manufacturer we work with planned to buy hardware security keys for users who don’t carry smartphones, so MFA could cover everyone, not just office staff.
- Test before you enforce. The same client is planning its phishing-resistant MFA and Conditional Access rollout around report-only testing first, to see who would be affected before turning policies on.
- Fix devices. Device recommendations lean on endpoint protection, patching, and data encryption. Devices that fail security checks such as anti-malware status, patching, and encryption can pull your score down, which ties directly to the work in our guide to vulnerability management.
What Microsoft Secure Score Can’t Tell You
This is the part most summaries skip. Microsoft is direct about it: Secure Score is a numerical summary of your security posture based on system configurations, user behavior, and other security-related measurements. It isn’t an absolute measurement of how likely your systems or data are to be breached, and it shouldn’t be read as a guarantee against a data breach.
Three practical limits follow from that.
It measures configuration, not risk
The score reflects how many recommended controls you’ve enabled. It doesn’t know which of your systems hold your most sensitive data, how likely a given threat is for your business, or what a breach would cost you. That’s what a risk assessment adds.
It only sees part of your environment
The recommendations cover Microsoft products and a limited set of others, and Microsoft notes they don’t cover everything each product can be exposed to. Your network, your line-of-business applications, your vendors, and your other security measures sit largely outside it.
It’s one lens, not the whole baseline
In one security review, we recommended pairing Secure Score with a CIS benchmark assessment of Microsoft 365, an industry standard for secure configuration, and scoped that assessment for the client. That gives them both a running score and a deeper baseline to measure against. Used together, they catch more than either does alone.
If you’re not sure what your score is telling you, or whether the things it doesn’t measure are where your real exposure sits, that’s a good reason to look at it alongside a broader assessment. Our team builds managed IT services around exactly this kind of practical, risk-based approach.
Learn about our Risk & Maturity Assessment to see what a real assessment would find in your environment.
FAQs
What is the URL for Microsoft Secure Score?
security.microsoft.com/securescore. You’ll need to sign in with an account that has permission to view it.
How often does Microsoft Secure Score update?
The dashboard and recommended action pages update in real time, and Secure Score syncs daily to pick up the points for completed actions. For some Entra and Teams recommendations, the state refreshes weekly or monthly, so changes can take a while to appear.
Does a higher Secure Score mean I can’t be breached?
No. Microsoft says plainly that the score isn’t an absolute measure of how likely you are to be breached and shouldn’t be read as a guarantee. It shows how many recommended security controls you’re using, which helps reduce risk but doesn’t remove it.
Is Microsoft Secure Score the same as a third-party security rating?
No. Secure Score looks at the configuration of your own Microsoft environment from the inside. Third-party security ratings estimate your posture from the outside, using information visible from the internet. They answer different questions, and customers or insurers who ask for one aren’t asking for the other.
Is Microsoft Secure Score the same as Cloud Secure Score or the SC-900 exam?
No on both. Microsoft has other scores, such as Cloud Secure Score in Microsoft Defender for Cloud, which measures cloud posture across Azure and other clouds. SC-900 is a Microsoft certification exam on security, compliance, and identity fundamentals. It’s unrelated to scoring your own tenant.
Who should look at our Microsoft Secure Score?
Assign Microsoft 365 administrators regular security reviews, use read-only access, and report trends and accepted risks to leadership.
