What this check looks at
Compares the tenant's Secure Score with Microsoft's average across all Microsoft 365 tenants.
Microsoft Secure Score measures how many of Microsoft’s recommended security settings a tenant has in place, across identity, devices, apps and data, as points achieved out of points available. Each recommended action carries a weight, and Microsoft re-scores the tenant about once a day from the live configuration. Microsoft also reports the average score across all Microsoft 365 tenants, which is the peer average this check uses.
The check passes when the score is 70% or more of the points available. Below that it fails when the score is under the average across all Microsoft 365 tenants, or under 50% whatever that average is; a score between 50% and 70% that is level with or above the peers is a warning. The evidence lists up to 15 of the actions Microsoft reports as not yet completed.
A low score is rarely one big gap. It is usually dozens of defaults nobody changed: MFA not required for everyone, legacy authentication still allowed, no Safe Links or Safe Attachments policies, audit settings left alone. An attacker needs only one of them: an administrator without MFA or a legacy protocol still open is enough for a password spray or a phishing kit to succeed.
Why it matters
Secure Score is the measure Microsoft itself uses, and the one most clients have already seen. Sitting below the average across all tenants is a clear signal that the tenant is less well protected than is typical.
Most incidents in small and medium UK organisations start with a phished or guessed password, and the government’s Cyber Security Breaches Survey finds phishing to be by far the most common attack businesses report, year after year. The actions at the top of Secure Score are the ones that break that chain: MFA, blocking legacy sign-in, protecting administrators and filtering malicious mail. Automated campaigns go where the defences are weakest, and a tenant well below its peers is that place.
For the business, a low score is usually paid for in an incident: a director’s mailbox used to redirect a customer payment, a week of recovery after ransomware, or a cyber insurance claim disputed because basic controls such as MFA were missing. Insurers and larger customers increasingly ask for the score, or the controls behind it, in their questionnaires, and a figure below the peer average is hard to defend there.
Secure Score is not a standard in itself, but it is Microsoft’s own measure, and its actions line up with what the CIS Microsoft 365 Foundations Benchmark, CISA’s SCuBA baselines and Cyber Essentials ask for. ISO 27001 A.5.36 (compliance with policies, rules and standards for information security), NIST CSF 2.0 ID.IM-01 (improvements identified from evaluations) and the NCSC’s risk management guidance all expect this kind of measured, repeated review.
How to fix it
Where: Microsoft Defender portal → Secure Score
Before you start
- Open Secure Score, Recommended actions, sorted by score impact, and pick the identity actions first.
- Mark actions handled by a third-party tool as "Resolved through third party" so the score reflects reality.
Step by step
- Open Secure Score and note where the tenant stands. In the Microsoft Defender portal, go to Exposure management > Secure Score. On the Overview tab note the current percentage and how it compares with other organisations. On the History tab check whether the score has dropped recently: a sudden fall often means a new licence brought new actions, not that something was switched off.
- List the open actions by score impact. Select the Recommended actions tab, filter Status to To address and sort by Score impact, highest first. Use Export to save the list as a CSV to work through with the client. Group the actions by product (Microsoft Entra ID, Exchange Online, Defender for Office 365, Intune, SharePoint, Teams); many appear as findings of their own in this assessment with full steps.
- Work the identity actions first. Start with the identity actions, which carry the most points: MFA for all users and for administrators, blocking legacy authentication, the user-risk and sign-in-risk policies where the licence includes Entra ID P2, and no more than a handful of Global Administrators. Each is a Conditional Access policy or an Entra ID setting; follow the matching finding and take every Conditional Access policy through report-only before turning it on.
- Apply the protections that change nothing for users. Next take the actions users will not notice: the Defender for Office 365 preset security policies, Safe Attachments for SharePoint, OneDrive and Teams, mailbox auditing, DKIM signing, MailTips and the unified audit log. Each is a few minutes in the Microsoft Defender portal or Exchange Online PowerShell, and together they lift the score quickly.
- Record the actions you will not take. Open each action the client has decided against, or that another product already covers (a third-party email filter or endpoint product, for example), and select Edit status & action plan. Choose Resolved through third party or Resolved through alternate mitigation only where something else genuinely does the job, which awards the points; choose Risk accepted, with a reason and a review date, where nothing does, which awards none. Never mark an action resolved just to raise the number.
- Plan the actions that need a rollout. For the remaining actions that need users told or devices changed (phishing-resistant MFA, device compliance, sensitivity labels), set the status to Planned in the same panel and add a short action plan and an owner, so the plan is visible in the portal and in the export.
- Check the score after Microsoft recalculates it. Secure Score recalculates about once a day, so return after 24 to 48 hours. On the History tab confirm the score has risen, and on Recommended actions confirm the actions you changed show Completed. The check passes at 70% or more; below that it stays a warning while the score is at least 50% and not below the peer average, and a failure otherwise.
What users will notice
Depends on each action; most identity actions add MFA prompts or block legacy sign-ins.
How to confirm it worked
The Secure Score history shows the score rising after each change (it can take up to 48 hours).
Frameworks and controls
This check maps to controls in 10 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | A2.a Risk management process |
| DSPT | Standard 5: Process reviews |
| NIS2 | Art. 21(2)(f) Assessing the effectiveness of risk-management measures |
| Secure Score | Overall score |
| SOC 2 | CC4.1 Ongoing and separate evaluations of controls |
| NIST SP 800-171 | 3.12.1 Periodically assess the security controls |
| CMMC Level 2 | CA.L2-3.12.1 Security Control Assessment |
| ISO 27001:2022 | A.5.36 Compliance with policies, rules and standards for information security |
| NIST CSF 2.0 | ID.IM-01: Improvements are identified from evaluations |
| NCSC 10 Steps | Risk management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Microsoft Secure Score (Microsoft Learn)