Microsoft Secure Score: Why a Good Number Doesn’t Always Mean Good Security
A high Secure Score feels reassuring. It’s a single number, it goes up when you do the right things, and Microsoft presents it right there in the admin centre as a clear measure of how well protected your tenant is. For a lot of organisations, it has quietly become the main answer to the question “how secure are we?”
The reality is more complicated than a percentage suggests. Secure Score is a useful signal, but a respectable number can sit comfortably alongside real, unaddressed risk, and the score itself can be nudged upwards by low-effort changes that do very little to reduce the chances of an actual incident.
It also has no visibility into a good deal of what determines whether an organisation gets breached, including how quickly leavers lose access and how well staff spot a convincing phishing email. None of that shows up on the dashboard.
Which means the number on its own is not the thing worth acting on. What matters is knowing which recommendations genuinely apply to how your business operates, which ones you have consciously decided to live without, and who is responsible for looking at the new ones that appear each month.
Get that straight and the score stops being a figure to be optimised and becomes what it was designed to be: a prompt for a sensible conversation about where the real gaps are.
Quick summary
Secure Score is a genuinely useful tool, but treating the number as the goal rather than the starting point causes more problems than it solves.
Secure Score is best used as a prompt for a proper conversation about risk, not as a report card to be optimised for its own sake.
What Microsoft Secure Score actually measures
Secure Score is Microsoft’s built-in measurement of your organisation’s security posture across Microsoft 365. It looks at your current configuration, compares it against Microsoft’s recommended best practices, and awards points for each recommendation you’ve acted on.
Recommendations cover a wide range of areas: identity settings such as MFA and Conditional Access, device configuration, data protection policies, and more, depending on which Microsoft products your organisation is licensed for. Each action is worth a set number of points, some awarded in full only once fully completed, others awarded proportionally for partial progress.
On its own, that’s a genuinely useful way to see where obvious gaps exist. The trouble starts when the score becomes the focus rather than the underlying security it’s meant to represent.
Why the number can be misleading
A few things about how Secure Score works mean the headline figure doesn’t always tell the full story.
Not every recommendation applies to every business. Some suggested actions genuinely won’t fit how your organisation operates, and Microsoft’s own guidance allows for accepting the risk on those rather than implementing them regardless. A lower score from deliberately accepted risk is a different situation entirely from a lower score from genuine neglect, but the dashboard doesn’t distinguish between the two.
The score can improve without meaningfully reducing risk. Some actions are worth significant points for relatively low effort, which creates an incentive to chase easy wins rather than tackle the changes that would actually matter most for your specific risk profile.
It only reflects what Microsoft can see. Secure Score covers Microsoft 365 configuration. It has limited visibility into third-party tools, custom processes, or wider operational practices that also affect your real security posture, such as how quickly leavers are offboarded or how well staff are trained to spot phishing attempts.
Recommendations sit there whether or not anyone acts on them. Nothing about the dashboard forces action. A tenant can have dozens of outstanding, genuinely important recommendations sitting untouched for months, with nobody formally responsible for reviewing and actioning them.
What proper use of Secure Score looks like
Getting real value from Secure Score comes down to treating it as an input to a decision process, not the decision itself.
- Review recommendations against actual risk, not just point value. A high-point recommendation that doesn’t suit your business isn’t automatically worth implementing, and a low-point one that closes a genuine gap might be worth prioritising ahead of it.
- Assign clear ownership. Someone needs to be responsible for reviewing new recommendations as they appear and deciding whether to act, accept the risk, or investigate further, rather than leaving the dashboard to accumulate unread suggestions.
- Compare trend over time, not just the current figure. A score that’s been flat for six months while new recommendations keep appearing tells a very different story to one that’s steadily improving as genuine gaps get closed.
- Use it alongside other signals. Secure Score works best read together with tools like Microsoft Purview and Defender for Cloud Apps, rather than treated as a complete picture on its own.
Common mistakes and pro tips
- Treating an “accepted risk” status as a permanent decision rather than something worth revisiting as the business changes
- Chasing quick point gains without checking whether the underlying recommendation actually matters for your organisation
- Nobody being formally responsible for reviewing new recommendations as they appear
- Assuming a good score means a leaver process, device management, and staff awareness are all equally well handled, when Secure Score has limited visibility into any of them
A quarterly review of outstanding recommendations, with someone genuinely accountable for acting on the ones that matter, closes most of the gap between “good score” and “good security.”
The bottom line on Microsoft Secure Score
Secure Score is a solid starting point for understanding your Microsoft 365 security posture, but it was never designed to be the finish line. The number can look reassuring while genuine gaps remain, and it can also look worse than reality reflects when deliberate, sensible decisions have been made to accept certain risks. What matters is the judgement applied around the score, not the score in isolation.
Our Microsoft 365 Support service includes regular review of your Secure Score recommendations as part of ongoing tenant management, so genuine gaps get closed, and low-value point-chasing doesn’t distract from what actually matters. If you’d like a clearer picture of where your organisation currently stands, our free Microsoft 365 risk and cost health check is a good place to start.
STRAIGHT ANSWERS
Frequently asked questions
The questions people actually ask us about Secure Score, answered without the sales pitch.
What is a good Microsoft Secure Score?
There is no universal target, because the right score depends on which recommendations genuinely apply to your organisation and which risks have been deliberately accepted. A meaningful comparison is against your own trend over time and against similar organisations, rather than chasing a fixed number.
Why has my Secure Score gone down when nothing changed?
Almost always because Microsoft added new recommended actions, which raises the total points available and lowers your percentage even though your earned points have not moved. Check the History tab to confirm what changed before treating it as a problem.
Does a 100% Secure Score mean an organisation is fully secure?
No. Secure Score only measures what Microsoft can see within your Microsoft 365 configuration. It does not account for third-party tools, operational processes such as offboarding, or staff awareness, all of which materially affect real-world security.
How often should Secure Score be reviewed?
A quarterly review is a reasonable baseline for most organisations, alongside checking in whenever new recommendations appear following a Microsoft 365 change or a new licence being added.
Can accepting risk on a recommendation lower my score permanently?
Yes, accepted risk items do not contribute points, but that is not automatically a problem. Some recommendations genuinely do not suit every organisation, and accepting the risk deliberately is different from ignoring a recommendation that should have been actioned.
Does Secure Score cover email security and Defender for Cloud Apps?
Yes, where those products are licensed and configured, recommendations related to them feed into your overall score. This is also why the score can look different depending on which Microsoft security products your organisation has in place.
KEEP READING
Related posts
Ransomware recovery in Microsoft 365: what you can actually get back
How to run a phishing simulation in Microsoft 365 without teaching your staff the wrong lesson
