Small-business owner reviewing Microsoft Secure Score

Microsoft Secure Score is a number that shows how well your Microsoft 365 environment is configured against Microsoft’s recommended security actions. You find it in the Microsoft Defender portal, and it comes with a ranked to-do list for raising it. For a small business, it is one of the fastest free ways to see where your identities, devices and apps are exposed. It is a useful measure, but it is not a verdict on whether you will be breached.

This guide explains what the score covers, how the points work, how to read the recommendations, and how to improve the score without locking your team out of their work.

Mavericks Office Solutions
Strengthen Your Business’s IT Security
Mavericks provides cybersecurity and managed IT services to help small businesses address security and operational technology needs with a local, USA-based help desk.

TL;DR

  • Secure Score measures how many recommended security actions you have completed across Microsoft 365 identities, apps and devices. A higher number means more actions taken.
  • Check it at the Microsoft Defender portal. Start with the Recommended actions list, which ranks items by points, difficulty and user impact.
  • Turn on multi-factor authentication (MFA) first. It is the highest-value early step for most small businesses.
  • The score is not a guarantee against breach. Use it as a checklist and a trend line, not a grade to chase.
  • Changes take 24 to 48 hours to show up, so make a few at a time and watch the effect.

Table of Contents

What Microsoft Secure Score is

According to Microsoft Learn, Secure Score is a numerical measurement of an organization’s security posture. It reflects how extensively you use Microsoft security controls and complete recommended actions. The dashboard sits in the Microsoft Defender portal and covers Microsoft 365 identities, apps and devices.

Three points matter for a business owner.

  1. It measures configuration and behavior, not outcomes. The score summarizes system configurations, user behavior and other security-related measurements. It is not an absolute measure of how likely you are to be breached.
  2. It is a ratio. You see a percentage, along with points achieved against points possible. Two companies with the same percentage may have very different numbers of actions behind them.
  3. It depends on what you own. The recommendations you see depend on the products and licenses in your tenant. A business on a basic plan sees a different list than one on a premium plan.

Think of it as a first line of defense checklist. It tells you which doors are unlocked. It cannot tell you whether someone is already standing in the lobby.

How to check your Microsoft Secure Score

You need an admin account with the right permissions. Then:

  1. Sign in to the Microsoft Defender portal and go to the Secure Score page at security.microsoft.com/securescore.
  2. Read the overview. Microsoft’s guidance says it shows your percentage, achieved versus possible points, category breakdowns, history, comparisons and recommended actions.
  3. Look at the groupings (identity, devices, apps and data) to see which area is dragging the total down.
  4. Open the history view to see how the number has moved over time.

If you cannot reach the page, the usual reason is permissions. Ask whoever manages your Microsoft 365 tenant to grant the right role rather than sharing a global admin login. Shared admin credentials create a bigger problem than the one you are trying to solve.

Reading the history and the comparisons

Two parts of the overview get ignored and shouldn’t. The history chart shows whether your posture is improving or quietly decaying as new users, devices and licenses arrive. The comparison view lets you put your number next to a benchmark. Treat the benchmark as context, not a target. A business with a different size and risk profile than the comparison group may reasonably land elsewhere.

If you want to think about how a score trend and comparison should be presented to executives, this walkthrough of cybersecurity dashboard design covers what a security dashboard should show first. The same principle applies to your own reporting: lead with the trend and the few actions that matter, not every metric at once.

How the points are calculated

Microsoft’s documentation explains the scoring rules. The facts that matter in practice:

  • Each action is worth 10 points or less. No single recommendation can swing the score by itself.
  • Most actions are all or nothing. Configuration actions can earn partial points, so you gain some credit as you roll a control out to more users or devices.
  • Points come from three kinds of work. Configuring recommended features, completing security-related tasks, and addressing a recommendation with non-Microsoft software or an alternate mitigation.
  • Your available points shift. They are affected by your licenses, the number of users or devices covered, completed tasks, third-party mitigations and accepted risk.

The last two points explain why your score can drop even when you did nothing wrong. Add a new batch of laptops, and the share of devices covered falls until you onboard them. Buy a higher license tier, and new recommendations appear, raising the points possible.

Third-party tools still count

If you protect email with a non-Microsoft product, or use a different endpoint tool, you can mark the recommendation as addressed by that alternative. That matters for businesses that already pay for security products. A low score does not always mean you are unprotected. It can mean Microsoft cannot see the protection you have.

What is a good Microsoft Secure Score?

There is no official pass mark. Microsoft describes a higher number as more recommended actions taken, and says plainly that the score is not a guarantee against breach. Any chart that sorts scores into “excellent” and “poor” bands is a rule of thumb from whoever wrote it, not a standard.

A more useful way to judge your number:

Question Why it matters
Is the trend moving up over the last 90 days? A rising line shows you are closing gaps. A falling line shows drift.
Are the high-value identity actions done? MFA and admin protections matter more than many small points elsewhere.
Are any gaps documented as accepted risk on purpose? A conscious exception is different from an overlooked item.
Does the score cover all users and devices? Partial coverage hides unmanaged devices and forgotten accounts.
Do you know who owns each open action? Unowned recommendations stay open forever.

A score in the 80s with a handful of unowned, deliberate exceptions can be healthier than a 90 that was reached by switching on settings nobody understood. Chasing the last few points often costs more in user friction than it returns in protection.

Open the Recommended actions page. Per Microsoft’s documentation, you can search, filter or group the list. The ranking considers points remaining, implementation difficulty, user impact and complexity.

For each recommendation, open the detail pane and review:

  • The attacks it addresses
  • Which users or devices are affected
  • Prerequisites you need first
  • The implementation steps

Then set a status. Use Planned when you have scheduled the work. Use Risk accepted when you have decided, on purpose, not to act, for example because the control would break a workflow you rely on. Record the reason somewhere your successor can find it.

A simple triage order for a small business

Ranking by points alone can send you toward fiddly settings. This order tends to work better for an office of 10 to 100 people:

  1. Identity first. MFA for every user, then for admins with stronger methods.
  2. Admin hygiene. Fewer global admins, separate admin accounts from daily-use accounts.
  3. Email and collaboration protection. Anti-phishing, safe attachments and link handling where your license supports them.
  4. Device protection. Enroll devices, require basic protections, and keep them patched.
  5. Data. Labels, sharing limits and retention, once the basics hold.

The order is our judgment, built on the research below and on what we see in small business environments. Your own risk profile may change it.

Raising your score without disrupting work

The worst way to improve the score is to flip every switch on a Friday afternoon. The best way is a staged rollout with a short communication to staff.

Start with MFA

CISA’s guidance for small businesses says that any MFA is better than none and reduces the risk of attack, while phishing-resistant MFA gives stronger protection against phishing. That supports a sensible path: get MFA on everywhere now, then strengthen the method over time.

We have written the practical steps up separately. Our MFA implementation guide for business covers rollout planning, and the 10-minute Microsoft 365 MFA setup includes a recovery checklist so nobody gets locked out. When you are ready to move beyond basic prompts, see our steps for phishing-resistant authentication and why MFA fatigue attacks mean a simple approve button is not the end of the road.

Know what your license already gives you

Microsoft’s small-business security best practices are written for organizations with up to 300 users. The page says security defaults are on by default and suit most Microsoft 365 business organizations. For more stringent requirements, Conditional Access is available with Microsoft 365 Business Premium, which also adds advanced protection for devices, email and collaboration content, and data.

In practice that means two things. First, check whether security defaults are still enabled before you build custom policies, because the two interact. Second, if you are on a lower tier and many recommendations are out of reach, a license review may be a faster route to a better posture than hours of manual workarounds. Many teams also leave paid features unused, which we cover in features your team probably isn’t using in Microsoft 365.

Know what your license already gives you — overview diagram

Pilot, then expand

For any change that touches how people sign in or open files:

  1. Apply it to the IT team or a small pilot group.
  2. Wait a few days and collect problems.
  3. Expand to a department, then to everyone.
  4. Tell staff beforehand what will change and who to call.

Remember that completed changes take 24 to 48 hours to appear in the score. Do not panic when the number does not move right away, and do not stack five changes in a day, because you will not know which one caused a problem.

Cover the areas the score only hints at

Secure Score does not replace the rest of your security program. Several areas deserve attention alongside it:

What Secure Score cannot tell you

A number can create false comfort. Keep these limits in mind.

  • It reflects Microsoft’s recommendations for Microsoft services. Your line-of-business software, vendor accounts and printers sit outside it.
  • It does not detect an active intrusion. Threat detection and monitoring are a separate job.
  • It does not measure people. A phishing email that convinces an employee to approve a prompt is not captured by a configuration setting.
  • It can be gamed. Marking items as accepted risk or addressed by a third party can raise the number without improving protection. Review those exceptions regularly.
  • It does not satisfy a compliance audit on its own. If you have contractual or regulatory obligations, the score is one input, not evidence of compliance.

Use it as a smoke detector for configuration drift, and pair it with monitoring, backups, training and a response plan.

Our perspective

Most small businesses we meet in Ohio and Michigan have never opened the Secure Score page. They have a Microsoft 365 subscription, a handful of admin accounts and a vague belief that Microsoft handles security. The score is often the first moment an owner sees how much of that work is left to the customer.

We treat the score as a conversation starter, not a report card. When we review a new client’s tenant, we look at the trend, the identity controls, the exceptions and the licensing. We also ask who is watching the environment after the settings are changed, because a configuration that was right in March can be wrong by October. That is why we run it as part of an outsourced IT department with 24/7 monitoring, backed by a local, USA-based help desk with an average response under 12 minutes. When a policy change locks someone out at 8 a.m., a person in Ohio picks up, not an offshore queue.

Our advice is simple. Fix identity first, document your exceptions, and recheck the score every month. A 10-minute review beats a once-a-year scramble.

— Jeffrey

Getting help with Secure Score

If you would rather not spend your evenings in the Defender portal, we can do it with you. Our managed IT services team monitors your environment, and our cybersecurity services cover the policies, protection and response behind the number. If your Microsoft 365 licensing needs a review, start with our Microsoft 365 page.

Mavericks Office Solutions

Not sure whether an outsourced IT department fits your business? Our scorecard for choosing a managed IT provider lists eight criteria to compare any provider, including us.

A 30-day plan you can start this week

If you want a concrete path, here is one that fits a small team without a full-time IT person.

Week 1: Baseline. Record your current percentage and take a screenshot of the category breakdown. Confirm who holds admin roles and remove any that are not needed. Check whether security defaults are on.

Week 2: Identity. Roll out MFA to a pilot group, then to everyone. Make sure each person has a recovery method registered. Plan a move toward phishing-resistant methods for admins.

Week 3: Email and devices. Work through the top email protection and device recommendations that your license supports. Record any you decide to postpone as Planned, with a date.

Week 4: Review. Wait for the 24 to 48 hour refresh, then compare. Mark exceptions as Risk accepted with a written reason. Schedule the next review for the same day next month.

Four-week plan for improving Microsoft Secure Score

At the end you will have a higher number, but more importantly you will have a list of decisions with names and dates beside them.

FAQ

How can I check my Microsoft Secure Score?

Sign in to the Microsoft Defender portal with an account that has the right permissions and open the Secure Score page. The overview shows your percentage, points achieved and possible, category breakdowns, history and recommended actions. If you cannot see it, ask your tenant admin to check your role.

Is a higher Microsoft Secure Score always better?

Not always. A higher score means more recommended actions are complete, but Microsoft states it is not an absolute measure of breach likelihood. A score raised by marking items as accepted risk, or by settings that frustrate staff into workarounds, may add little real protection.

Why did my Secure Score go down?

The most common causes are new users or devices that are not yet covered, a license change that adds new recommendations, or a setting that was reversed. Because points depend on licenses, users, devices and completed tasks, the total can move without anyone doing anything wrong. Check the history view to see when it changed.

How long does it take for changes to show up?

Allow 24 to 48 hours for completed actions to appear in the score. Make a few changes at a time so you can connect any user complaints to a specific change.

Does Secure Score replace a security assessment?

No. It covers Microsoft 365 configuration and does not detect active threats or measure employee behavior. Use it alongside monitoring, backups and a written response plan.

Sources