Microsoft Secure Score Explained: What to Fix First

Microsoft Secure Score Explained: What to Fix First

Microsoft Secure Score is a number in the Microsoft Defender portal that measures how many of Microsoft’s recommended security settings your organization has turned on across Microsoft 365 — identities, devices, email, apps, and data. Each recommendation is worth points, and the score is the percentage you have earned. Treat it as a prioritized to-do list, not a grade: some recommendations close the doors attackers actually use, and others barely matter for a small business.

What the score actually measures

You will find Secure Score in the Microsoft Defender portal at security.microsoft.com — search for it if the menu has moved again. Behind the headline number is a list of recommended actions, each showing the points available, the effort required, the user impact, and whether it is completed, partially completed, or not started. A few things to know:

• Your licenses change the list. Microsoft 365 Business Premium unlocks recommendations for Defender, Intune, and conditional access that Business Standard tenants never see, so scores are not comparable between different license levels.
• Third-party tools count if you say so. If you use another vendor’s endpoint protection or email filter, you can mark the matching recommendations “resolved through third party” and receive the points.
• The score moves on its own. Microsoft adds new recommendations over time, so a score that drops did not necessarily get less secure — there is simply more to do.

Fix these first

If you only work through part of the list, start with the items that block the most common real attacks against small businesses.

1. Require MFA for every user. Especially administrators. Security defaults do this for free; conditional access does it with more control. Nothing else on the list matters as much.
2. Block legacy authentication. Older sign-in methods that cannot do MFA — basic authentication used by some old mail clients, scripts, and devices — let anyone holding a password skip the second factor. Microsoft has retired most of them in Exchange Online; a conditional access block closes whatever remains.
3. Have fewer global admins. Two to four, each a separate admin-only account, never the account someone reads email with.
4. Turn on anti-phishing protections. Safe Links, Safe Attachments, and impersonation protection in Defender for Office 365 — included with Business Premium and often left at defaults.
5. Stop users consenting to unverified apps. “Consent phishing” tricks people into granting a malicious app access to their mailbox without ever stealing a password.
6. Block automatic forwarding to outside addresses. A forwarding rule to a Gmail account is a classic sign of a compromised mailbox and a quiet way to leak every email.
7. Confirm audit logging is on. Without logs, an investigation after a breach is guesswork.
8. Enable self-service password reset with MFA. It cuts help desk resets, which are themselves a target for social engineering.

What you can skip or defer

Not every point is worth chasing. Recommendations for products you do not use, controls you already cover with another tool, and settings with high user impact for little risk reduction can be marked as risk accepted or planned — with a note explaining why. A small business at 60% with the eight items above done is safer than one at 80% that skipped MFA for the owner because it was inconvenient.

Do not break things chasing points

Several high-value recommendations can interrupt real work if they are flipped on without testing. Blocking legacy authentication breaks old copiers that scan to email and line-of-business apps that sign in the old way. Strict conditional access can lock out a remote employee. Run conditional access policies in report-only mode first, inventory what still uses basic authentication, and roll out changes during a planned window.

Make it a monthly habit

Secure Score is most useful as a recurring check: look at new recommendations once a month, review any change in the score, and keep notes on why accepted risks were accepted. Many businesses already own most of what they need — we covered that in Business Premium security you are already paying for.

Want a second set of eyes on your score?

Equal Tech Solutions reviews Secure Score as part of our Microsoft 365 management and cybersecurity services, fixing the high-impact items without breaking the tools your team relies on. Contact us for a walkthrough of where your tenant stands.