Microsoft Secure Score is a free measurement of your organization’s security posture across Microsoft 365. It looks at your identity, device, email and data settings, compares them with Microsoft’s recommended controls, and gives you a percentage plus a list of improvement actions. A higher score means more recommended protections are in place.
This guide explains how Secure Score works, which actions raise it fastest, and how organizations in the UAE and Saudi Arabia can use it to plan security work and report progress.
What Is Microsoft Secure Score?
Secure Score is built into the Microsoft Defender portal. Each recommended control is worth a number of points. When you complete a control, fully or partly, you earn those points. Your score is the points achieved divided by the points available.
It covers four main categories:
- Identity: MFA, Conditional Access, admin roles and risky sign-ins in Microsoft Entra ID.
- Device: Defender for Endpoint and Intune settings such as attack surface reduction rules.
- Apps: Exchange Online, SharePoint, Teams and Defender for Office 365 policies.
- Data: Microsoft Purview controls such as sensitivity labels and DLP.
You can also compare your score with organizations of a similar size, which is useful when reporting to leadership.
How Secure Score Is Calculated
Every improvement action shows its maximum points, your current points, the licence it needs and the user impact. Some actions give partial credit. For example, MFA for admins scores based on the share of admins actually registered.
| Status | What it means | Effect on score |
|---|---|---|
| To address | Not started | No points |
| Planned | Accepted and scheduled | No points yet |
| Risk accepted | You chose not to implement | No points |
| Resolved through third party | Another product covers it | Points awarded |
| Resolved through alternate mitigation | A different control covers the risk | Points awarded |
| Completed | Detected as configured | Points awarded |
The 10 Actions That Usually Raise Secure Score Fastest
These actions combine high points with real risk reduction. Test each one with a pilot group before enforcing it.
- Require MFA for all users. See our guide on rolling out MFA without locking users out.
- Block legacy authentication with Conditional Access.
- Protect admin accounts with phishing-resistant MFA and fewer Global Admins.
- Turn on sign-in and user risk policies (needs Entra ID P2). Compare plans in Entra ID P1 vs P2.
- Enable Safe Links and Safe Attachments in Defender for Office 365.
- Publish SPF, DKIM and DMARC for every sending domain. Follow our SPF, DKIM and DMARC setup guide for Microsoft 365.
- Turn on audit logging and mailbox auditing.
- Enable attack surface reduction rules on Windows devices.
- Restrict user consent to apps so users cannot grant risky OAuth permissions.
- Limit external sharing in SharePoint and OneDrive to approved guests.
For a policy-by-policy approach to identity, read our Conditional Access best practices.
How to Improve Secure Score Step by Step
- Export the improvement actions and sort by points and user impact.
- Group them by owner: identity, email, devices and data.
- Pick quick wins with low user impact and high points.
- Pilot changes with IT staff, then a business group.
- Enforce in waves and document each change.
- Record exceptions as “Risk accepted” with a reason and review date.
- Report monthly on score, trend and remaining high-risk actions.
Secure Score by Licence: What You Can Reach
Some actions need specific licences. That is why two tenants with the same effort can have very different scores.
| Licence | What it unlocks | Typical gap |
|---|---|---|
| Microsoft 365 Business Standard / E1 | Basic MFA, audit, sharing controls | No Conditional Access or Defender for Office 365 |
| Business Premium / E3 | Conditional Access, Intune, Defender for Office 365 P1 (Business Premium) | No risk-based policies or full XDR |
| E5 / E5 Security | Risk policies, PIM, Defender XDR, advanced Purview | Mainly configuration and adoption work |
If you are weighing an upgrade, see Microsoft 365 E3 vs E5 and Defender for Business vs Defender for Endpoint.
Common Secure Score Mistakes
- Chasing points instead of risk. Some low-value actions are easy; some high-risk gaps are hard. Prioritise risk.
- Marking actions as third party without evidence. Auditors will ask for proof.
- Enforcing without a pilot. Blocking legacy authentication can break old scanners and apps.
- Ignoring score drops. A drop often means a setting was reversed or new users are unprotected.
- Treating Secure Score as the whole programme. It does not replace monitoring or incident response.
Secure Score for UAE and Saudi Organizations
Regulators and auditors in the region increasingly ask for evidence of strong identity, email and device controls. Secure Score reports are a simple way to show progress against frameworks such as ISO 27001, UAE Information Assurance standards and the Saudi NCA Essential Cybersecurity Controls.
Keep a monthly export, note accepted risks, and link each completed action to a control in your security framework. This turns Secure Score into audit evidence. Our Zero Trust roadmap for Microsoft 365 shows how these controls fit into a wider plan.
Raise Your Secure Score With M365 Enterprise Hub
Our engineers review your tenant, fix the highest-risk gaps first and document every change. Learn more about our Microsoft 365 security hardening services, identity and access hardening and Microsoft Defender XDR experts, or book a free Secure Score review.
Frequently Asked Questions
What is a good Microsoft Secure Score?
There is no universal pass mark. Many organizations aim for 70% or higher, but the right target depends on your licences and risk. Focus on the high-impact identity and email actions first rather than chasing 100%.
How often does Microsoft Secure Score update?
Secure Score usually refreshes once a day. After you change a setting, it can take up to 24 to 48 hours for the score and the improvement action status to update.
Does Microsoft Secure Score cost extra?
No. Secure Score is included with Microsoft 365 and Microsoft Defender. Some improvement actions need higher licences, such as Entra ID P1 or Defender for Office 365, to be completed.
Why did my Secure Score drop?
Scores drop when Microsoft adds new recommendations, when a setting is changed back, or when new users, devices or apps are added that are not yet covered by your policies.
Is a high Secure Score the same as being secure?
No. Secure Score measures configuration, not outcomes. A high score reduces risk, but you still need monitoring, incident response and user awareness.
Can I mark an action as resolved by another tool?
Yes. If a third-party product covers the control, you can set the action to “Resolved through third party” or “Resolved through alternate mitigation” and keep an audit note.
Who should own Secure Score in an organization?
Usually the security or IT operations lead. Review it monthly and report the trend to leadership alongside incidents and audit findings.