Microsoft Secure Score - Simply Explained

Let me ask you something. Have you ever logged into your Microsoft 365 admin center and stumbled across a number called secure score? Immediately, you feel that not in your stomach. You see a score, maybe 42% or 31% and you think, oh no, are we in trouble? So you click around, panic a little, turn on one or two settings, then close the tab and never look at it again for six months. Sound familiar? You're not alone. It happens to the best of us. Here's the thing, that number is trying to tell you something, but most people misunderstand what it actually means. I'm Mirko Peters and today we're going to fix that. By the end of this episode, you'll understand exactly what secure score measures and more importantly, what it doesn't. We'll break down the building blocks, bust the myth of the perfect 100% and show you how to use this tool as a practical roadmap instead of a guilt trip. Let's start with the simplest possible definition. The simplest definition. Microsoft secure score is a percentage, plain and simple. It shows you how many of Microsoft's recommended security settings you've turned on in your tenant. That's it. It's not a measure of how likely you are to get hacked and it's not a score for how your team responds to threats. It's a report card for your security configuration. Think of it like your car's dashboard. The speedometer tells you how fast you're going, but it doesn't tell you whether you know how to drive or if you're about to hit a patch of black eyes. It just tells you one thing, your speed. Secure score is the same way. It tells you how many security switches you flipped, nothing more, nothing less. The same principle applies here. Secure score gives you a clear snapshot of where you stand with your security settings, so you know exactly what to tackle next. You'll find this score inside the Microsoft Defender Portal under a section called Exposure Management. And here's the key thing to understand. Secure score is a control coverage metric. That means it measures whether a control exists, not whether it's working perfectly. A high score doesn't mean your bullet proof and a low score doesn't mean you'll definitely get hacked. It just means you have some work to do, so don't panic if your score is low. Instead, see it as a to-do list. Each recommended action improves your score and potentially your security posture. One more thing about that number. The total points available, the denominator in that percentage, depends on what licenses you have. A tenant with business premium is scored against a different set of possible points than a tenant with E5, so comparing your score to someone else's doesn't always make sense. Different licenses mean different ceilings, so now you know what it is. But how does Microsoft actually calculate that number? How secure score works under the hood? Here's the simplest definition. Secure score is points earned divided by total points possible multiplied by 100, but how you earn those points is what matters. There are two ways to earn points. First, binary actions. These are things you either did or you didn't. Did you turn on multi-factor authentication for all users? Full points of yes, zero if no? Simple. Then there are proportional actions. These give partial credit based on how many users or devices have the setting applied. Say you have 10 devices and BitLocker encryption is enabled on eight of them. You get 80% of the points for that action. It's a fair way to show progress, even when you're not at full coverage yet. Each action is worth up to 10 points, most fall between four and eight points, so the math adds up across dozens of recommendations. Now, here's the part that catches people of God. That denominator I mentioned, total points possible, it grows over time. Microsoft adds new recommendations every month, new features, new settings, new best practices, so your score can drop even if you didn't change anything. You're moving forward, but the ground keeps shifting. It's like running on a treadmill that someone keeps speeding up. The score recalculates regularly. Most changes show up within 24 hours, though some take longer to reflect. So don't panic if you flip the switch and don't see the number move right away. Give it a day. Now that we understand the math, let's answer the real question. What is a good score? What a good score actually looks like. Let me bust a myth right now. A 100% secure score is neither realistic nor desirable. I know that sounds strange coming from someone who just explained how the score works. But hear me out, the average Microsoft 365 tenant sits somewhere between 30% and 45%. Most organizations are under 50%. So if you're looking at a score in the 30s or 40s, you're not failing, you're normal. That's where most people start. Now, why can't you get to 100%? A few reasons. First, some recommendations simply don't apply to your setup. Maybe you don't have on-premises servers. Maybe you're not using certain features the score checks for. The score doesn't know your environment. It only knows what settings exist. So it might ask you to configure something you don't even use. Second, some recommendations create friction that hurts productivity. Take password policies. The score might recommend a minimum password length of 14 characters with complex requirements. That sounds great in theory. But if you have a legacy application that only accepts passwords up to eight characters, enforcing that policy breaks the app, suddenly your accounting team can't log into their invoicing system. Is that really worth a few points? This is where risk accepted comes in. You can mark a recommendation as intentionally not implemented with a note explaining why. That doesn't earn you points, but it's honest. It tells your team and your auditors. We looked at this. We made a deliberate choice not to do it. And here's why. That's much better than ignoring it or implementing it badly. There's also an alternative approach. If you use a non-microsoft tool for the same job, you can mark the recommendation as resolved through third party. Say you're using a third party anti-fishing solution instead of defender for Office 365. You can note that and the score will still give you credit. Microsoft can't verify your third party tool is actually working, but they accept your intent. So what's a realistic target? For most organizations aim for 70% to 85%, that's a strong practical score that shows you've addressed the most important controls without breaking your business. Pass that point. The effort to reward ratio gets steep. This all sounds theoretical. Let's look at the four categories where your score lives to see what's really being measured. The four pillars of secure score. Secure score breaks down into four main categories and each one covers a different area of your security configuration. Let's walk through them. Identity is the first category and it's the one with the biggest impact. It includes multi-factor authentication, conditional access policies, blocking legacy authentication and password policies. Why does identity matter so much? Because most attacks start here. Someone guesses a password or steals credentials. So this category carries the most weight in your score. Enabling MFA alone is worth about 10 points and it's the single best thing you can do to stop credential theft. If you only focus on one thing, make it this. Next is device, the second pillar, which is all about endpoint security, bitlocker encryption, Windows Defender Antivirus, attack surface reduction rules, temper protection. These are the settings that protect the actual computers and phones your people use. Device often has the most total actions, sometimes over 100, but each action gives fewer points, usually two or three per recommendation. It's a grind, but those small points add up. The third category is data, which focuses on information protection, sensitivity labels, data loss prevention policies, encryption settings. These are the tools that keep your sensitive information from leaking out. This category depends a lot on your licensing. Some of the best data protection features require E5 or purview licenses. If you don't have those, your score here will naturally be lower and that's okay. The score shows you what's possible, not what you must implement. The fourth pillar is apps covering app governance, third party app permissions and cloud app security policies. It controls which applications can access your data and what they're allowed to do with it. Think of it as the bouncer at your nightclub, checking IDs and making sure nothing unwanted gets in. Now here's a practical tip. If you enable security defaults in Enter ID, it's basically a single switch. It automatically awards full points for three key identity recommendations. MFA for all users, MFA for admins and blocking legacy authentication. That's about 26 points right there from one setting. For small businesses without dedicated IT teams, this is the most powerful action you can take. You might notice some categories show lower coverage than others, often that's because you don't have the right license. The score isn't meant to make you feel bad, it's meant to show you what's possible, even if you're not licensed for it yet. Use that information to plan, not to panic. But before you run off to chase a perfect score, there are some common mistakes you need to know about. The three biggest misconceptions about secure score. What are the three biggest misconceptions about secure score? Let's clear them up. First people think a high score means you're secure. That's the most dangerous myth. Secure score only checks if a setting exists, not if it actually works. For example, you can enable a fishing simulation filter, check the box and get the points. But if the threshold is set too low, it's only catching obvious scams and not really protecting you. Your score says you're covered, but attackers can still get through. Microsoft themselves say secure score isn't an absolute measure of how likely you are to be breached. It measures configuration coverage, not real world threat resistance. Two tenants with identical scores can have very different security postures. One might have well designed policies that work. The other might have boxes checked that do nothing useful. The score can't tell the difference. Another common mistake is thinking you need to get to 100%. This causes a lot of stress. People see a score in the 40s and think they're failing. But some recommendations conflict with each other. Implementing one can make another impossible. Others require licenses you don't have like E5 or Perview features not available on your plan. The score shows those recommendations anyway as a preview, but you can't implement what you don't own. And there's a practical problem going for 100% can break things. Strict device controls can block legitimate administrative tools. You might lock down a setting so tightly that your IT team can't do their jobs. Is that worth a few points? Probably not. A realistic target for most organizations is 70% to 85%. That's where you've addressed high impact controls without sacrificing usability. Pass that you're chasing diminishing returns. And finally, many people think once you hit a score, it stays fixed. But it's a moving target. Microsoft regularly adds new recommendations, new features, settings, best practices. Every time they do the denominator expands. So your score can drop even if you haven't changed anything. You didn't get less secure. The target just moved. That's why you should revisit your score at least monthly, not obsessively, but regularly. In the defender portal, there's a score regression view that shows exactly what caused losses in the last 90 days. Was it a new recommendation? Did someone change a setting? That view tells you the story behind the number. Use it. So if secure score isn't the final answer, what should you actually do with it? How to use secure score as a practical roadmap? So stop treating secure score like a report card. Start treating it like a prioritized work queue instead. It's not a grade you have to defend. It's a list of improvements sorted by what matters most. Open the Microsoft Defender Portal and head to secure score. Then click Recommended Actions. That's your starting point right there. The default sort is by highest point impact first, and that's intentional. Microsoft has already run the numbers for you. The actions at the top of that list will move your score the most with the least effort. Here's a simple workflow. Start with the top recommendation. Read what it's asking you to set up. Don't just skim it, actually understand what that setting does. Then ask yourself two questions. Does this apply to my environment? And do I have the right license to use it? If the answer to both is yes, click the Manage link. That takes you straight to the settings page where you make the change. No hunting around, no guessing. If the answer is no, maybe it doesn't apply or you don't have the license, don't just ignore it. Mark it. Use the Edit Status feature. You can set a recommendation to plan if you intend to do it later. Set it to risk accepted if you've made a deliberate decision not to implement it. Or set it to resolved through alternative mitigation if you're using a third party tool to handle the same thing. Each option lets you add a note explaining your reasoning. That's documentation your future self or your auditor will thank you for. The great thing about this method is it takes the pressure off the number. You're not chasing a percentage. You're working through a list. Every action you complete or document is progress. And you can see that progress in the status changes, not just in the score. Set a monthly review routine, put a recurring 30 minute block on your calendar. That's it. Half an hour once a month. Open the recommended actions, check for new items, work through the top few and mark your decisions. Over time, that small habit builds into a much stronger security posture. Now let's zoom out and see how secure score fits into your overall security picture. How secure score fits into your bigger security picture. Let's zoom out for a second. Secure score is one piece of the puzzle. An important piece, but not the whole picture. Think of it like your home security. Secure score is the checklist you run through when you leave the house. Lock the front door? Yes. Close the windows? Yes. Set the alarm? Yes. Great. You've covered the basics. But that checklist doesn't tell you if the alarm company is actually monitoring your system. It doesn't tell you if the floodlights work at night. It doesn't tell you if your neighbors are watching for suspicious activity. Secure score works the same way. It tells you if the settings are configured, it doesn't tell you if someone is actively watching for threats. It doesn't tell you if your users know how to spot a fishing email. It doesn't tell you if your software is up to date. So what else do you need? A few things. Microsoft Defender for XDR gives you real threat detection and response across your environment. That's the alarm monitoring. Microsoft Sentinel is a CM platform for hunting threats and building custom detections. That's your security camera system. A tax simulation training test your users, not just your settings. That's the neighborhood watch. And regular patching and vulnerability management keeps your software current. That's changing the locks when needed. None of these things show up in your secure score, but they're just as important. Here's the takeaway. Secure score is a starting point. It's where you begin your security journey, not where you end it. Use it as one metric in a broader security, maturity program, track it over time, celebrate the improvements. But never mistake a high score for a secure organization. So what should you do right now if you want to improve your organization's security posture? Your first three actions right now. So here are three things you can start doing today, not next quarter today. First turn on security defaults. If you're not already using conditional access and most small businesses aren't, go into your enter ID settings and flip the switch. One toggle. That's all it takes. Blocking the front door of your office instead of trying to secure every individual room. Security defaults gives you MFA for everyone, blocks all authentication methods and covers three of the highest value identity recommendations in one click. For a small business without a dedicated IT team, it's the single biggest security improvement you can make right now. Second, focus on your top five recommended actions. Don't try to tackle all 200 at once. You'll burn out and give up. Instead, open your secure score dashboard, sort the recommended actions by point impact and pick the top five. For each one, make a decision. Implemented now if you can, market is planned if you need to schedule it, except the risk if it doesn't apply. Or note an alternative mitigation if you're using another tool. Then schedule a 30 minute follow-up in one month to review your progress. Five actions per month. That's sustainable. That's how you build momentum. Third, stop chasing 100%. I mean it. Set a realistic target based on your environment and licensing. For most organizations, that's 70 to 80%. Mark actions that don't apply as risk accepted with clear notes explaining why. Then focus your energy on the controls that actually reduce risk, MFA, conditional access, bitlocker, attack surface reduction. Those are the ones that matter. The rest is noise. Secure score is a compass, not a destination. It shows you where to look, not what you'll find. Use it as a prioritized to-do list. Review it monthly and don't stress over the number. Start with the highest impact action, usually MFA and build from there. Subscribe on your favorite podcast platform and share this with someone just starting their security journey.