Secure Score is an indicator, not an absolute security grade

Microsoft Secure Score measures the proportion of recommended actions addressed across products connected to the tenant. A higher score means more recommended actions are detected as implemented, but it does not prove that an organization is secure, compliant, or prepared to respond to an incident.

The score does not cover every attack surface. It may not understand the criticality of a business application, the quality of a recovery procedure, a poorly documented exception, a vulnerable local network, or a supplier-specific risk. Conversely, a well-designed compensating control can reduce risk without matching Microsoft's expected configuration exactly.

The right use of Secure Score is to turn a long list into a prioritized backlog with owners, evidence, pilots, deadlines, and risk decisions. The objective is not to chase 100% at any cost.

What raises the score — and what can distort it

Microsoft generally assigns no more than ten points to each action. Some are binary; others award points in proportion to protected users, devices, or objects. The denominator changes when Microsoft adds recommendations, a product becomes active, or tenant licensing changes.

Track the raw score, maximum, percentage, and—most importantly—the controls that actually changed. Comparing only two percentages can hide real improvement or create a false alarm.

Mechanism	Score effect	Interpretation limit
Recommended configuration	Full or partial points depending on the action	Detection can lag and does not validate every scenario
Security task	Points after the expected action or review	A one-time task does not guarantee a lasting process
Third-party solution	Points when marked as covered	Equivalent protection must be documented
Alternate mitigation	Points when recorded as a compensating control	A note alone does not prove effectiveness
Risk accepted	No points awarded	Legitimate when approved, time-bound, and reviewed
New license or product	Maximum score and actions can change	A lower percentage is not necessarily regression

Start with the actual data coverage

Secure Score aggregates recommendations from products including Microsoft Entra ID, Exchange Online, SharePoint, Teams, Defender for Endpoint, Defender for Identity, Defender for Office 365, Defender for Cloud Apps, App governance, and Purview. Other providers can also feed the experience. A missing recommendation does not necessarily mean a control is compliant; the product, connector, or license that evaluates it may simply be inactive.

Before prioritizing, document the licenses you own, products deployed, their coverage, and the sources feeding the score. Use achievable score views to distinguish what can be implemented with current licensing while separately retaining gaps that require investment.

Licensed user count and the population that is actually active.
Windows, macOS, Linux, mobile, and server coverage in Microsoft tools.
Domains, mailboxes, SharePoint sites, teams, and enterprise apps included.
Third-party solutions that genuinely replace a Microsoft control.
Nonapplicable actions, technical dependencies, and regulatory constraints.
Roles allowed to read the score and change statuses in Microsoft Defender XDR.

The priority matrix: risk before points

A two-point action that closes an exposed admin path can outrank a ten-point action for a control already covered by an effective compensating measure. Use Microsoft's fields—threats, tier, implementation cost, user impact, rank, and service—as inputs, not as an automatic decision.

Assign a P1 through P4 priority with a short rationale. When two actions carry similar risk, favor the one that produces measurable reduction quickly or unlocks several later actions.

Criterion	Question	Practical weight
Attack path	Does the control stop a common or observed attack?	Very high
Breadth	Does it protect all admins, users, devices, or data?	Very high
Potential impact	Could compromise enable elevation, exfiltration, or disruption?	Very high
Current gap	Is the control absent, partial, or bypassed by exceptions?	High
Effort and dependencies	Can it be piloted with a clear rollback?	Modifier
User impact	Does it change authentication or business flows?	Modifier
Remaining points	How many points are available?	Secondary indicator
License	Is the control available and sustainable with current licensing?	Constraint, not a risk measure

A practical work sequence for SMBs and hybrid organizations

This order is a starting point, not a universal rule. An organization under active attack, a hospital with legacy devices, a plant with strict availability, or a company heavily exposed through SharePoint can require a completely different sequence.

Prioritize controls that reduce several scenarios at once. Phishing-resistant authentication for administrators, for example, usually reduces more risk than an easy score increase on a peripheral setting.

Wave	Example controls	Why now
1 — Privileged identities	Phishing-resistant MFA, emergency accounts, Conditional Access, permanent roles	One compromised admin identity can cross multiple services
2 — Authentication and apps	Legacy protocols, OAuth grants, app secrets, risky access	Reduces token theft, illicit consent, and unattended access
3 — Email and collaboration	Anti-phishing, links and attachments, SPF/DKIM/DMARC, external forwarding	Email remains a major entry and exfiltration channel
4 — Devices and servers	EDR, antivirus, ASR, vulnerabilities, obsolete systems	Reduces execution, persistence, and lateral movement
5 — Data and sharing	External sharing, DLP, labels, exposed sites	Limits the impact of a compromised account or device
6 — Governance	Owners, alerts, reviews, evidence, compensating controls	Prevents gradual return of security gaps

Triage example: do not sort by points alone

Points do not replace inventory. A critical Graph permission might not be the easiest way to gain points, but it can close the tenant's most dangerous path. Conversely, a poorly tested mass deployment may quickly improve the dashboard while breaking a business process.

Action	Points	Risk	Decision
Protect administrators with strong authentication	Low to medium	Very high	Immediate pilot, tested emergency accounts, then rollout
Reduce an overly broad Graph application permission	Sometimes no direct points	Very high	Immediate priority despite low score gain
Enable another anti-phishing policy	Medium	High	Validate licenses, domains, and mail flow, then pilot
Deploy an ASR rule to every endpoint	High	High with possible impact	Audit, targeted exclusions, rings, then block
Configure DLP everywhere	High	Variable	Start with genuinely sensitive data and scenarios
Action already covered by a third party	High	Already mitigated	Document equivalence and monitor instead of duplicating

Validate licenses, prerequisites, and hidden costs

Achievable score helps filter actions based on licensing and accepted risk, but an unlicensed recommendation can still represent real exposure. Keep a separate register of unfunded risks so they remain visible during budgeting and the next review.

Separate portal visibility from the license required to enforce the control for every user or device.
Confirm prerequisites such as Intune enrollment, Defender integration, connectors, logging, roles, and pilot groups.
Estimate recurring work: alert handling, exceptions, certificate renewal, and access reviews.
Check whether a trial feature artificially changed the maximum score or action plan.
Price additional licensing separately from risk; do not mark an action resolved merely because it is expensive.
Document a compensating control when the Microsoft feature is unsuitable, including an owner and evidence of effectiveness.

Deploy each recommendation as a real change

Every recommendation needs technical and business validation. Read its prerequisites, detection method, stated impact, and implementation link. Then verify the actual configuration in the source product; the Secure Score summary is not always enough to understand exceptions or scope.

For high-impact changes, use a representative pilot group, audit or report-only mode when available, success criteria, an observation window, and rollback. Do not combine several major controls in the same wave when that would prevent you from identifying the cause of an incident.

Define the population, temporary exclusions, and owner.
Capture the state before the change and the expected behavior.
Test standard users, administrators, unmanaged devices, and relevant service accounts.
Measure errors, tickets, security events, and bypasses.
Expand in rings only when exit criteria are met.
Put an expiry date on every exception.

Use statuses correctly

Microsoft awards points for actions resolved through a third party or alternate mitigation. That capability exists to reflect the real posture, not to game the percentage. A note without evidence, scope, or testing is not a compensating control.

Risk accepted awards no points. It is often the right decision when a change would create greater operational risk, as long as acceptance has an owner, duration, and next review date. For some Device category recommendations, the portal redirects to the matching Defender Vulnerability Management recommendation instead of offering these statuses directly.

Status	When to use it	Expected evidence
To address	Recognized gap without a committed plan	Initial analysis and triage owner
Planned	Project, owner, and deadline are defined	Change ticket, pilot, and dependencies
Risk accepted	Residual risk is understood and approved	Decision-maker, rationale, review date
Resolved through third party	A non-Microsoft product provides the control	Configuration, coverage, monitoring, and test
Resolved through alternate mitigation	A different control reduces the same scenario	Clear mapping between threat and compensating control
Completed	Microsoft detection confirms the action	Product validation and operational tests

Export history with Microsoft Graph

Microsoft Graph exposes daily Secure Score snapshots and control profiles. The v1.0 API documents SecurityEvents.Read.All as the least-privileged delegated or application permission. Use a dedicated collection identity, protect the export, and avoid SecurityEvents.ReadWrite.All when collection is read-only.

The secureScore resource retains 90 days of data by default. A scheduled export preserves a longer trend and helps explain changes in currentScore and maxScore. The following script changes no status.

PowerShell — current score, controls, and CSV export

Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes 'SecurityEvents.Read.All' -NoWelcome

$scores = (Invoke-MgGraphRequest -Method GET -Uri `
  'https://graph.microsoft.com/v1.0/security/secureScores?$top=90').value
$latest = $scores | Sort-Object { [datetime]$_.createdDateTime } -Descending |
  Select-Object -First 1

[pscustomobject]@{
  Date = $latest.createdDateTime
  CurrentScore = $latest.currentScore
  MaxScore = $latest.maxScore
  Percent = if ($latest.maxScore) {
    [math]::Round(100 * $latest.currentScore / $latest.maxScore, 1)
  }
  LicensedUsers = $latest.licensedUserCount
  ActiveUsers = $latest.activeUserCount
}

$profiles = (Invoke-MgGraphRequest -Method GET -Uri `
  'https://graph.microsoft.com/v1.0/security/secureScoreControlProfiles').value

$controlReport = foreach ($control in $latest.controlScores) {
  $profile = $profiles | Where-Object id -eq $control.controlName |
    Select-Object -First 1
  [pscustomobject]@{
    Control = $control.controlName
    Title = $profile.title
    Category = $profile.controlCategory
    Service = $profile.service
    Score = $control.score
    MaxScore = $profile.maxScore
    Rank = $profile.rank
    Tier = $profile.tier
    ImplementationCost = $profile.implementationCost
    UserImpact = $profile.userImpact
    Threats = ($profile.threats -join '; ')
  }
}

$controlReport | Sort-Object Rank | Export-Csv `
  .\SecureScore-ControlReport.csv -NoTypeInformation -Encoding UTF8

Build a report leadership can use

Present the trend together with denominator and license changes, then focus the report on the five to ten most important risks. Include completed actions, incidents prevented or detected, expiring exceptions, and decisions required from leadership.

Avoid goals such as 'reach 90%' without context. A more useful objective is 'protect every privileged account from phishing without lockouts and with two tested emergency accounts,' followed by the corresponding Secure Score effect.

Field	Example	Decision value
Risk	Administrator phishing	Connects the action to an understandable scenario
Control	Phishing-resistant authentication	Describes the risk reduction
Coverage	Pilot admins, then every privileged role	Shows actual scope instead of a global status
Dependencies	FIDO2 keys, emergency accounts, temporary methods	Prevents lockouts
Measure	Registration rate, failures, incidents, points	Separates operational outcome from score
Decision	Planned for next quarter	Provides owner, deadline, and approval

Monthly governance checklist

Capture currentScore, maxScore, percentage, licenses, and active products.
Explain every material numerator or denominator change.
Review new recommendations and any whose calculation Microsoft changed.
Check overdue planned actions and expired exceptions.
Sample-test the actual coverage of controls marked completed.
Revalidate third-party protections and compensating controls.
Connect recent incidents, threat intelligence, and business changes to priorities.
Present risk and budget decisions, not only a percentage chart.

Secure Score becomes useful when it drives decisions

Secure Score is excellent for discovering gaps, tracking trends, and starting conversations among security, operations, and leadership. It becomes dangerous when treated as a certification or an automatically executable checklist.

A full Microsoft 365 assessment validates recommendations against architecture, licensing, logs, dependencies, and real attack scenarios. It identifies the controls that reduce the most risk even when they award few points, and documents what should legitimately wait.

About the author

Marc-Antoine Lambert

Montréal-based senior IT consultant and Team Lead specializing in architecture, cybersecurity, Microsoft infrastructure, networking and business continuity.

Discuss your environment →