What Is Microsoft Secure Score?
A clear, practical explanation of Microsoft Secure Score — how it works, what improvement actions are, what a good score looks like, and how it fits into your wider Microsoft 365 security.
Microsoft Secure Score is a measurement of your organization’s security posture within Microsoft 365. It awards points for recommended security configurations you’ve put in place, shows the result as a percentage of the points achievable for your licenses, and gives you a prioritized list of improvement actions to raise it.
How Secure Score works
Secure Score is built from a catalogue of improvement actions — specific, recommended configurations across identity, devices, apps and data. Each action carries a point value. Your score is the points you’ve achieved against the total achievable for the products you’re licensed for, expressed as a percentage. As you adopt an action, fully or partially, your achieved points rise. Microsoft updates the catalogue as new controls and threats emerge, so the achievable total isn’t static.
What improvement actions look like
Actions are concrete rather than abstract. Typical examples include requiring multi-factor authentication for administrators, ensuring all users are registered for MFA, limiting the number of Global Administrators, and enabling specific protection policies. Each action in the portal shows its point value, the user impact, and the implementation steps — and many can be marked as resolved through a third party or accepted as a risk where they don’t fit your environment.
What counts as a good score
It’s tempting to chase a percentage, but the achievable total depends entirely on your licensing, and not every action suits every organization. A healthier way to read Secure Score is directional: are you improving over time, and have you closed the highest-impact identity and data-protection actions? Two tenants with identical percentages can have very different real-world exposure depending on which actions they’ve completed.
How organizations use it
Most IT teams use Secure Score as a running baseline: a place to see recommended actions in priority order, track progress across the quarter, and demonstrate improvement to leadership. It’s particularly good at answering “what should we do next?” for Microsoft’s own recommended controls.
Its place in Microsoft 365 security
Secure Score is one of the best starting points for hardening a Microsoft 365 tenant, and nothing here is a criticism of it. It is, by design, focused on Microsoft’s security recommendations. A complete view of tenant health also asks questions Secure Score isn’t primarily built to answer — is your domain’s email authentication in place, which third-party apps hold high-risk permissions, and are you paying for licenses nobody uses?
M365 Health Score ingests your actual Microsoft Secure Score and combines it with checks for identity hygiene, email authentication, app-consent exposure and license efficiency — a broader tenant-health read that complements Secure Score rather than replacing it.
Microsoft Secure Score FAQ
What is Microsoft Secure Score?
Microsoft Secure Score is a measurement of an organization’s security posture within Microsoft 365 and related services. It assigns points for recommended security configurations you’ve adopted, expresses the result as a percentage of the points available for your licenses, and lists prioritized improvement actions.
How is Microsoft Secure Score calculated?
Each improvement action is worth a number of points. Your score is the points you’ve achieved against the total points achievable for the products you’re licensed for, shown as a percentage. Adopting a recommended action — fully or partially — raises the achieved points.
What is a good Microsoft Secure Score?
There’s no single “good” number: the achievable total depends on your licenses, and some actions won’t suit every organization. A more useful goal than a target percentage is steady improvement over time and closing the highest-impact identity and data-protection actions first.
Is Microsoft Secure Score enough on its own?
Secure Score is an excellent security-posture baseline, but it’s security-focused by design. A broader tenant health view also considers email authentication, third-party app consent and license efficiency. That’s the gap M365 Health Score is built to complement — not replace — Secure Score.
Where do I find Microsoft Secure Score?
Secure Score lives in the Microsoft Defender portal (security.microsoft.com), under Secure Score. You need an appropriate security or global reader/administrator role to view it.
Already using Secure Score? See what a broader check adds
M365 Health Score reads your Secure Score and adds identity, email, app-consent and license checks — free and read-only.