In this guide · 7 sections
Short answer
Secure Score is a points total for recommended Microsoft 365 security settings. Don't chase 100%. Fix MFA for everyone, MFA for admins and blocking legacy authentication first first, then use the Current license score view to see what's realistic.
How Microsoft Secure Score is calculated
Microsoft's Secure Score documentation explains the mechanics. You find the score in the Microsoft Defender portal under Exposure management or Secure Score.
- You earn points for configuring recommended security features, doing security tasks, or addressing a recommendation with a non-Microsoft tool or alternate mitigation.
- Each recommended action is worth 10 points or less. Most are all-or-nothing; some give partial points, for example MFA on 50 of 100 users earns half the points.
- Recommendations cover Microsoft Entra ID, Exchange Online, SharePoint, Teams, Defender for Endpoint and Office, and some third-party apps.
- The score updates in real time, and syncs daily for achieved points. Microsoft notes that Entra recommendations refresh weekly and Teams recommendations monthly, as well as on configuration changes.
The percentage is your points divided by the maximum possible. Because the maximum includes recommendations for products you may not own, a well-run small tenant can still show a modest percentage.
Why small business tenants score low
Microsoft says it shows the full set of possible recommendations for a product "regardless of license edition, subscription, or plan". A Business Basic or Standard tenant therefore sees recommendations that need Entra ID P1 or P2, Defender for Office 365 Plan 2 or Defender for Cloud Apps, and can't earn those points.
| Score view | What it shows | Use it for |
|---|---|---|
| Secure Score | Points achieved out of every possible point | The headline number |
| Current license score | The score achievable with your current Microsoft licences | A realistic target for your plan |
| Achievable score | What you can reach with your licences and current risk acceptance | Your actual goal |
| Planned score | Projected score once planned actions are done | Tracking a project |
Turn on these views under the score breakdown, as described in Microsoft's recommended actions page. For a 10-person office on Business Standard, the achievable score is the number that matters.
What to fix first in a small tenant
Points aren't equal in real-world value. These actions block the attacks that hit small businesses most: stolen passwords, phishing and old sign-in protocols.
Turn on MFA for every user
If you don't use Conditional Access, turn on Microsoft Entra security defaults. Microsoft says this gives full points for "Ensure all users can complete multifactor authentication" (9 points), "Require MFA for administrative roles" (10 points) and "Enable policy to block legacy authentication" (7 points).
Reduce the number of Global Administrators
Two to four is plenty for a small business. Give daily admin work a lesser role.
Protect email
Turn on the recommended anti-phishing, Safe Links and Safe Attachments policies if your licence includes them, and set up DMARC for your domain.
Control external sharing and app consent
Limit anonymous sharing links in SharePoint and OneDrive, and stop users consenting to unknown apps.
Turn on audit logging
So you can investigate if an account is compromised.
Then work down the list
Sort recommended actions by score impact and pick the ones that fit how your business works.
If you have Business Premium, Conditional Access replaces security defaults with finer control; see our Conditional Access guide. Our Microsoft 365 security checklist covers the wider set-up.
Accepting risk and third-party mitigations
Not every recommendation fits a small business. Microsoft's own documentation says security should be balanced with usability. Each action can be given a status: to address, planned, risk accepted, resolved through third party, resolved through alternate mitigation, or completed.
Reasonable to mark
- Resolved through third party: you use another email filter or endpoint protection that covers it
- Resolved through alternate mitigation: security defaults cover risk policies Microsoft recommends
- Risk accepted: a setting that would break a business process, with a written reason
- Planned: you've scheduled it and want the planned score view
Don't hide these
- MFA gaps for any user, especially admins
- Legacy authentication left on for convenience
- Too many Global Administrators
- Anonymous sharing links with no expiry
Tracking Secure Score monthly
A score that drops is often more useful than a score that's high. A sudden fall can mean someone turned off a policy, added an admin or enabled a risky setting.
Monthly Secure Score check
Fold this into a wider monthly review; our monthly cyber hygiene checklist lists the other checks worth doing at the same time.
Do it yourself or get help?
Turning on security defaults and trimming admin accounts are DIY-friendly and earn the most important points. Help is worth it when you have Business Premium and want Conditional Access instead, when recommendations touch email flow or sharing that staff rely on, or when you need a defensible record of what you accepted and why.
Our Microsoft 365 / Google Security Lockdown (S$590) works through the recommended actions that fit your licence and business, documents risk acceptances, and leaves you with a report you can show insurers or customers.
Frequently asked questions
There's no universal good number, because the maximum includes recommendations for products you may not license. Turn on the Current license score and Achievable score views and aim to get close to your achievable score. More important than the percentage is that MFA, admin protection and legacy authentication blocking are complete.
Microsoft shows every recommendation for a product regardless of licence, so a Business Basic tenant sees actions that need Entra ID P1 or P2, Defender add-ons or Purview features it doesn't have. Those points can't be earned. Use the Current license score view to see what is achievable with your plan.
Yes. Microsoft says enabling security defaults gives full points for three recommended actions: ensuring all users can complete MFA (9 points), requiring MFA for administrative roles (10 points) and blocking legacy authentication (7 points). It also recommends marking related risk policy actions as resolved through alternative mitigation.
You can mark them as risk accepted, but record why. Microsoft notes that not every recommendation fits every environment. Accept risk for items that would break a genuine business process, and review those decisions periodically. Don't accept risk on MFA, admin account protection or legacy authentication.
Microsoft says the score updates in real time and syncs daily for achieved points. Some recommendation states refresh on configuration changes and on a schedule: weekly for Microsoft Entra recommendations and monthly for Teams. Checking once a month is enough for most small businesses.