Microsoft Secure Score: What a Good Score Is and Which Fixes to Do First

The short version: Microsoft does not publish a pass mark for Secure Score, so "good" means better than where you were, higher than similar organisations in your comparison chart, and with every high-point action either done or consciously accepted. Work the Recommended actions list from the top: identity first (MFA, administrator MFA, legacy authentication), then email protection, then the rest. Treat the score as a to-do list, not a verdict on whether you are safe.

This guide is for a Microsoft 365 administrator who has opened Secure Score, seen a percentage and a long list, and wants to know what to fix first. You will get a suggested fix order based on risk and effort, the menu path for each fix, and the places where the score misleads. Checked against Microsoft Learn on 28 October 2026. For how Secure Score compares with CIS and CISA baselines, read Secure Score vs CIS Benchmark vs ScubaGear; this article is only about raising the score.

What the score is

Secure Score is at security.microsoft.com/securescore in the Microsoft Defender portal. Your score is a percentage, shown with points achieved out of points available. Each recommended action is worth 10 points or less. Most are binary: do it and you get all the points. Some give partial points in proportion to coverage. Microsoft's own example is MFA worth 10 points where 50 of 100 users are protected, which scores 5 points.

Changes can take 24 to 48 hours to show. Recommended actions are grouped into Identity, Device, Apps and Data.

What is a good score

Microsoft's Learn pages do not name a target number. Use these three reference points instead:

• Comparison chart. The Overview tab has a bar chart comparing you with organisations of similar size. Metrics & trends > Comparison trend shows the same over time. Microsoft anonymises the data.
• Your own score zone. Metrics & trends > Your Secure Score zone lets you define what counts as good, okay and bad for your organisation.
• Achievable score. On the score tile, select Include to add Planned score, Current license score and Achievable score. The gap between your score and the achievable score is the realistic room you have with your current licences and accepted risks.

What to fix first

Microsoft ranks actions by points remaining, implementation difficulty, user impact and complexity. Re-sort your own Recommended actions tab by that ranking, because Microsoft computes it from your licences and configuration. The order below is the writer's judgement of risk and effort for a typical small or mid-sized tenant. It is not a verified points ranking: Microsoft documents point values only for the first three items, and only with security defaults on.

1. Require MFA for administrative roles

• Why first: the highest-value accounts, and a short list of people.
• Where: Microsoft Entra admin center > Entra ID > Conditional Access > Policies > New policy (Directory roles), or turn on security defaults.  Create it as Report-only first, then switch it On. The steps for CA002, CA003 and CA001 are in Conditional Access baseline policies.
• Effort: low. Register the admins first. Keep two emergency accounts out of the policy.
• Points: with security defaults on, Microsoft states this action is awarded 10 points.  A Conditional Access route is scored through Microsoft's own action definitions, so the numbers on your tenant can differ.

2. Require MFA for all users

• Where: Entra ID > Conditional Access > Policies, All users, grant Require authentication strength. Step-by-step in how to enable MFA in Microsoft 365.  Create it as Report-only first, then switch it On.
• Effort: medium. The work is user registration, not configuration.
• Points: Microsoft states nine points with security defaults on. Partial points count as users register.

3. Block legacy authentication

• Where: Entra ID > Conditional Access > Policies > New policy. Conditions > Client apps: Exchange ActiveSync clients and Other clients. Grant: Block access. Find users first in Entra ID > Monitoring & health > Sign-in logs, filtering on Client App.  Create it as Report-only first, then switch it On, because blocking legacy authentication can break old mail clients and scanners.
• Effort: low to medium, depending on old scanners and mail clients.
• Points: Microsoft states seven points with security defaults on.

4. Turn on the Standard preset security policy

• Where: Microsoft Defender portal > Email & collaboration > Policies & rules > Threat policies > Preset Security Policies (security.microsoft.com/presetSecurityPolicies). Switch on Standard protection and assign recipients.
• Effort: low. Microsoft says most settings in preset policies are not configurable, which is the point. Test with a pilot group, and note spam handling differs between Standard (Junk Email folder) and Strict (quarantine).
• Licence note: Safe Links and Safe Attachments need Defender for Office 365. Without it, the preset covers the built-in protections only.
• Points: varies. Read the value on your own Recommended actions tab.

5. Reduce Global Administrators

• Where: Entra ID > Roles & admins > All roles > Global Administrator.
• Effort: low. Microsoft recommends fewer than five Global Administrators, plus two cloud-only emergency access accounts. Use narrower roles for daily work.
• Points: varies. Read the value on your own Recommended actions tab.

6. Check that auditing is on

• Where: connect with Connect-ExchangeOnline, then run Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled in Exchange Online PowerShell. If it is False, run Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true, or use Microsoft Purview portal > Audit > Start recording user and admin activity.  Run it in Exchange Online PowerShell, because in Security & Compliance PowerShell the property always shows False. You need the Audit Logs role in Exchange Online.
• Effort: low, effective within about 60 minutes. Microsoft states auditing is not on by default for Business Basic, Business Standard and Business Premium, so check it.
• Points: varies. Read the value on your own Recommended actions tab.

7. Work down the rest by rank

Sort the Recommended actions tab by Rank, filter by product, and take actions that show a low user impact first. Anything that changes how people sign in or share files needs a pilot group and a note to staff.

Use statuses honestly

Each action can be set to To address, Planned, Risk accepted, Resolved through third party, Resolved through alternate mitigation, or Completed. Risk accepted earns no points. The two Resolved statuses earn the points, but Microsoft has no visibility into whether the control is really in place. Use them only when another product truly covers the control, and write a note saying which one.

What Secure Score cannot tell you

• It is not a measure of breach likelihood. Microsoft says it shows how much of the recommended control set you use. It is not a guarantee against a breach.
• It only covers listed products. Recommendations exist for Microsoft products and a short list of others. Other security tools are not scored unless you mark an action as covered.
• Not every action fits you. Microsoft notes that security must be balanced with usability.
• Marking actions as covered by a third party raises the score without changing anything. Two tenants with the same percentage can be very different.
• Device recommendations work differently. You cannot set a status in the Device category. You are sent to the Defender Vulnerability Management recommendation.

Common mistakes

1. Chasing the percentage. Fix by risk and effort, not by how many points a click earns.
2. Marking actions Resolved through third party without evidence. It inflates the score and hides gaps.
3. Enforcing a setting with no pilot. High-point actions such as blocking legacy authentication break scanners and old mail clients.
4. Expecting an instant change. Points take 24 to 48 hours to show. Do not re-do a fix because the score has not moved.
5. Forgetting to re-check. A later change or new users can reduce the score. Metrics & trends shows regressions.
6. Having no owner. Assign each action a person and a date in the Notes field.

How to check it worked

1. Open security.microsoft.com/securescore and note the score and points before you start.
2. Make one change at a time and write it in the action's Notes.
3. Wait 24 to 48 hours, then open the History tab and confirm the points appear against the action.
4. Open Metrics & trends > Regression trend monthly to see if any points were lost.
5. Re-run the comparison chart each quarter and record the result.

FAQ

What is a good Microsoft Secure score?

Microsoft does not set one number. Compare yourself with similar organisations in the comparison chart, define your own good, okay and bad zones, and compare against your Achievable score.

What is a Microsoft security score?

It is a percentage that shows how many of Microsoft's recommended security actions you have taken across identity, devices, apps and data. Higher means more recommended actions are in place.

Where do I log in to Microsoft Secure Score?

Go to security.microsoft.com/securescore and sign in. You need a role such as Security Reader for read-only access, or Security Administrator, Exchange Administrator or SharePoint Administrator for read and write. Microsoft Defender Unified RBAC can also grant access.

How do I compare my Secure Score with the industry average?

Use the comparison bar chart on the Overview tab, or Metrics & trends > Comparison trend. Microsoft compares you with organisations of similar seat count, using anonymised data.

What does the Microsoft Secure Score dashboard show?

The Secure Score page shows your score as a percentage with points achieved out of points available. From there you can add Planned, Current license and Achievable score views, open Recommended actions, and check the History and Metrics & trends tabs. Changes take 24 to 48 hours to show.

Next step

If you want someone to read your Secure Score and the settings behind it, rank the findings and fix them with you, see our Microsoft 365 security audit, plus the Conditional Access baseline policies and the Microsoft 365 security checklist.

If you would rather know the price of a full review before you start, what a Microsoft 365 security audit costs sets out the fixed prices by headcount.