Using Microsoft Secure Score without chasing points

Microsoft Secure Score, in the Microsoft Defender portal, measures how many of Microsoft's recommended security configurations you've adopted across identity (Entra accounts and roles), devices (Defender for Endpoint), apps (email and cloud apps, including Office 365) and data. Each recommended action is worth 10 points or less. Most are binary, some give partial credit (for example, MFA for 50 of 100 users earns half the points), and the score updates as Microsoft detects changes, with a daily sync from connected products.

Your score is shown against the maximum available for the products you licence. The overview also shows a planned score (if you finish what you've planned) and an achievable score (what's possible with your licences and current risk acceptance).

Sort by what stops the attacks small and mid-sized Canadian businesses actually face: credential phishing, business email compromise and payment fraud, ransomware through a compromised account. In our experience these are worth doing before anything else, whatever their point value:

Secure Score lets you mark each recommended action as To address, Planned, Risk accepted, Resolved through third party or Resolved through alternate mitigation. Use these honestly. 'Resolved through third party' and 'alternate mitigation' award the points, so only use them when another tool truly does the job, for example a separate email security gateway or a different EDR product. Write down which tool, and check it.

'Risk accepted' gives no points, and that's fine. Typical candidates in a small organization are controls that need licences you don't have, settings that break a business process with no workaround yet, or controls aimed at threats outside your risk profile. Record who accepted the risk, why, and when it will be revisited. A risk acceptance with no owner is just a forgotten gap.

• Record the score, and more usefully the status of your top ten recommendations, monthly. The History tab shows what changed and when.
• Report to leadership in plain terms: 'All staff now use MFA; legacy sign-in is blocked; two admin accounts remain without phishing-resistant keys.' Not '62 to 71 percent'.
• Compare yourself with your own past, not with industry averages. Comparisons depend on licences and size.
• Watch for drops. A falling score can mean a new recommendation was added, a licence changed, or someone switched a control off. The last one is worth investigating.
• Keep evidence for insurance and client questionnaires: a screenshot of the recommendation status plus the underlying policy export carries more weight than the headline number.

• It only sees Microsoft products. Your accounting system, line-of-business apps, firewall and backups are invisible to it.
• It checks configuration, not behaviour. A perfect score doesn't tell you whether someone is already inside.
• It weighs recommendations by Microsoft's view of impact, not your business. A law firm, a clinic and a manufacturer have different crown jewels.
• Points can be gamed. Marking items 'resolved through third party' without a real tool makes the number look good and the tenant no safer.
• Recommendations change. Microsoft adds and retires actions, so the denominator moves.

Sources: Microsoft Learn, 'Microsoft Secure Score' and 'Assess your security posture with Microsoft Secure Score' (Defender XDR documentation).

1. 01

   Export the recommendations list

   Filter to identity and apps first; that's where most small-business risk sits.

2. 02

   Pick ten

   Use the table above, then tag each as Planned with an owner and date.

3. 03

   Fix in report-only where possible

   Conditional Access changes go through report-only before enforcement.

4. 04

   Record risk acceptances

   With an owner and a review date.

5. 05

   Review monthly

   Status first, score second.