How to improve your Microsoft Secure Score

To improve your Microsoft Secure Score, open it in the Microsoft Defender portal, go to Recommended actions, and work through the identity actions first — MFA, blocking legacy authentication and limiting admin roles carry the most points in a typical small tenant and are the ones attackers actually exploit. Expect each fix to take a day or two to show up in the number.

Two things to know before you start. First, the maximum score includes recommendations for products you may not own, so most Business Basic and Business Standard tenants cannot reach 100% and should not try. Second, some action statuses award points without changing anything in the tenant. A high score built that way is a number, not a defence.

Where to find your Secure Score

1. Sign in to the Microsoft Defender portal at security.microsoft.com.
2. In the left navigation, go to Exposure management → Secure score. The direct link is https://security.microsoft.com/securescore.
3. Open the Recommended actions tab for the full list, with the points each action is worth and how many you have already earned.

You do not need Global Administrator to look. Global Reader and Security Reader can view the score; changing an action's status needs Security Administrator, Exchange Administrator or SharePoint Administrator. Give the person who reviews it the read-only role.

The list is ranked by the points still available weighed against implementation difficulty and user impact, so the top of the list is usually the right place to start — with the licence caveat below.

Why 100% is the wrong target

Microsoft shows the full set of recommendations for every product it scores, regardless of which edition you are licensed for. The score is meant to measure your absolute security posture, so actions that need Entra ID P1, Defender for Endpoint or Defender for Office 365 Plan 2 still count towards the maximum even if you cannot do them.

On Business Basic or Business Standard, that puts a ceiling well below 100%. On Business Premium, most of the high-value actions are reachable. Either way, the useful questions are:

• Which of the actions I can do are still open?
• Which open ones protect accounts, rather than tidy up a setting nobody would attack?

Points are also awarded proportionally. An action covering every user gives partial credit when half your users are covered, so a stuck percentage often means a handful of accounts — commonly admins or recently created users — are outside a policy everyone else is in.

What to fix first

For a small tenant, these give the most protection per hour and are scored on every plan that can implement them:

1. Require MFA, starting with every account that holds an admin role. On Basic or Standard, security defaults do this for free. See How to require MFA for all users.
2. Block legacy authentication, which otherwise lets a password alone bypass MFA. See How to block legacy authentication.
3. Reduce Global Administrators to between two and four, and use narrower roles — User Administrator, Exchange Administrator, Billing Administrator — for everyone else.
4. Turn off automatic external forwarding in the outbound anti-spam policy. See How to find email forwarding rules.

Leave the long tail of low-point configuration actions until these are done. They raise the number without changing much about how an attacker would get in.

The statuses that inflate the score

Every recommended action can be given a status from its flyout. Three of them matter:

• Risk accepted — you decided not to do it. No points are awarded. This is the honest choice for something that does not fit your business, and it keeps the decision on record.
• Resolved through third party and Resolved through alternate mitigation — you claim the risk is covered some other way, for example by a third-party email filter. These award the full points for the action, and Microsoft cannot check the claim.

That is the trap. A tenant with several actions marked "resolved through third party" can show a healthy score while the underlying setting is still off. If an outside IT provider reports your score to you, ask which actions carry those statuses and what the third-party control actually is. Use the Notes field on the action to record it, so the next person can tell.

Actions marked Completed are different: Microsoft sets that status itself from tenant data once all the points are earned, and you cannot change it.

What breaks, and how long changes take

Secure Score recommendations are written for security, not for your printer. Before acting on one, check what it changes for users:

• Blocking legacy authentication stops multifunction printers and scanners sending mail with SMTP AUTH, and older line-of-business apps. Find them in the sign-in logs first.
• Enforcing MFA prompts every user to register at next sign-in. Tell people before it happens, and create a break-glass account first if you are using Conditional Access.
• Restricting user consent to apps means users can no longer connect third-party apps to their mailbox or calendar on their own. Turn on the admin consent workflow at the same time, or the requests land on nobody.

Expect a delay. Microsoft says completed actions can take 24–48 hours to appear in the score, and some identity and Teams recommendations are only re-evaluated on a weekly or monthly cycle. Do not undo a change because the number did not move the same afternoon.

Reading the score with PowerShell

To track the score over time, or check several tenants without clicking through each portal, use the Microsoft Graph PowerShell SDK. It needs only the read permission SecurityEvents.Read.All:

Connect-MgGraph -Scopes "SecurityEvents.Read.All"

# Latest daily snapshot: current points against the maximum
Get-MgSecuritySecureScore -Top 1 |
  Select-Object CreatedDateTime, CurrentScore, MaxScore,
    @{n='Percent';e={[math]::Round($_.CurrentScore / $_.MaxScore * 100)}}

# Every scored action, biggest first, with Microsoft's own effort ratings
Get-MgSecuritySecureScoreControlProfile -All |
  Sort-Object MaxScore -Descending |
  Select-Object Title, MaxScore, UserImpact, ImplementationCost, Service

Both commands only read. Changing settings is still done in the admin centers, one action at a time, after you have checked what each one breaks.

Questions

Click paths verified October 2026. Microsoft renames things in the admin centers regularly; the underlying settings are stable even when the menus move.