Microsoft Secure Score is a number in the Microsoft Defender portal that measures how many of Microsoft’s recommended security settings your business has switched on. Microsoft shows the score as points achieved out of the total points available. It also displays the result as a percentage. Moreover, it is there in any Microsoft 365 tenant, Business Standard included. IThe system calculates it whether anyone checks it or not. Ask whoever manages the tenant for read-only access, and an owner can quickly see whether the business has actually set up the security included with its licence. Microsoft calls the thing it measures your security posture. This is a grand phrase for a list of settings.
What it does not measure is how likely you are to be breached. Microsoft says so in plain words on the Secure Score overview: it represents the extent to which you are using the controls available to you, and it is no guarantee against anything. Read it as a to-do list with a progress bar and it is useful. However, as a safety rating it misleads in both directions.
How the score is put together
Every recommendation is worth ten points or fewer. Most are all or nothing: create the policy or switch on the setting and you get the full points, leave it and you get none. Some are scored in proportion, so protecting half your users earns half the points. After adding them up, divide by the total available, and that is the percentage.
Microsoft groups the recommendations into four categories.
Identity covers accounts and admin roles. Devices covers how the business configures and protects laptops and phones. Apps covers settings in email, Teams and SharePoint. Data covers labelling and information protection.Each recommendation in the portal shows the steps to complete it, the licence it needs and the points it carries. This makes the list readable by somebody who is not an administrator. The identity list is where most small businesses should start. Furthermore, it is the ground the case for phishing-resistant identity covers in more depth.
Why the number changes when your licence does
The total available depends on which products you hold, because recommendations only appear for products you are licensed for. Microsoft shows the full set for each product whatever edition of it you have. Following that rule through produces two effects. On our reading, a Business Standard tenant already sees the identity recommendations that need Entra ID P1, such as conditional access policies, and scores zero on them. So its headline percentage is dragged down by controls it cannot reach without upgrading. Move the tenant to Microsoft 365 Business Premium and new products arrive with their own rows.Microsoft adds Defender for Endpoint device recommendations through Defender for Business. It also adds the data recommendations available through Purview Information Protection.Thus, the percentage can fall soon after an upgrade with nothing having got worse, because the denominator grew.
Microsoft’s own guidance on improvement actions offers three views that make this fair: a planned score, a current licence score showing what you could reach with the licences you hold, and an achievable score that also allows for risks you have formally accepted. The last two are the numbers worth tracking. The headline percentage, which counts rows your licence cannot complete, is the one to ignore.
The licence effect is also why a comparison between two businesses tells you little unless they hold the same plans. The portal offers a comparison with organisations of a similar seat count and a history of your own score. The history is the honest one, because no other tenant has your exact licence mix and starting point.
Reading a Microsoft Secure Score without a benchmark
Microsoft publishes no target, and the round-number thresholds that circulate online are other people’s opinions. Three readings are more useful than any threshold.
The trend. A score that has not moved in a year is a sign either that nobody is looking at the list or that the easy items are done and the rest need budget. Whichever it is, the number on its own will not tell you. The identity category on its own. The identity recommendations cover MFA for every account and phishing-resistant methods for administrators, blocking legacy sign-in, having more than one global administrator while using least-privileged roles for everyone else, and risk-based conditional access policies. These are the controls that stop the common attacks and the first things Unite’s piece on cyber insurance renewals lists insurers asking for. The exact titles in your portal change over time; the themes do not. A tenant with a low identity score has the wrong problem to be worrying about the other three categories.
The current licence score. If that is low, you are paying for controls nobody has switched on. This is the finding a licence audit tends to arrive at from the other direction.
Using the list without gaming it
Recommendations in the identity, apps and data categories can be given a status. Device ones are handled through Defender’s vulnerability management instead.
| Status | What it does | What it needs |
| To address, Planned | The working statuses: the item stays on the list | Nothing beyond doing the work |
| Risk accepted | Earns no points and leaves the headline score alone; drops the item from the achievable score, stays in the history, can be undone | A written reason for every accepted risk |
| Resolved through third party | Awards the points for a control run with another vendor’s tool, such as an email security service in front of Exchange; Microsoft has no way to check it | The same written note |
‘Risk accepted’ is legitimate when a recommendation does not fit how the business works. A tidy achievable score can sit on top of a long list of accepted risks, which is why the reasons matter.
Used that way, the score becomes evidence. A dated screenshot of the trend, with the accepted risks and their reasons, is something to attach to a cyber insurance proposal or a client’s security questionnaire. It will not answer every question on the form, and insurers decide what they accept. However, it comes from Microsoft’s own data, which beats a form filled in from memory.
Three numbers for the next review
Put three numbers on the agenda of your next IT review, whoever runs it:
- the current licence score, which shows whether the licence is being used
- the identity score on its own, which shows whether the controls that matter most are in place
- the count of accepted risks, with their written reasons, which shows whether the score is honest. Review those three areas each quarter, and the score becomes much more useful. Instead of a number nobody understands, it becomes a short conversation about what the business should do next. Furthermore, it is a conversation that fits the quarterly reviews in The Unite Group’s managed IT services.