Secure Score gives you a numerical measure of your Microsoft 365 security posture and tells you exactly what to fix and why. Here's how to read it and what an MSP should be doing with it.
Key takeaways
- 1Identity — MFA status, admin account hygiene, Conditional Access policies
- 2Devices — Intune enrolment, device compliance, endpoint protection status
- 3Apps — SharePoint sharing settings, Teams guest access, app permissions
- 4Data — sensitivity labels, DLP policies, information protection configuration
Microsoft Secure Score is a measurement of your organisation's security posture, with a higher score indicating more security controls in place. It lives in the Microsoft Defender portal (security.microsoft.com) and provides a prioritised list of recommended actions with estimated impact scores.
How Secure Score is calculated
Secure Score evaluates your configuration across four categories:
- Identity — MFA status, admin account hygiene, Conditional Access policies
- Devices — Intune enrolment, device compliance, endpoint protection status
- Apps — SharePoint sharing settings, Teams guest access, app permissions
- Data — sensitivity labels, DLP policies, information protection configuration
Each recommended action has a point value based on the security impact of implementing it. The maximum score varies by tenant configuration.
What a new tenant typically looks like
An un-managed Business Premium tenant with default settings typically scores in the 30–45% range. Major missing controls: MFA not enforced, Conditional Access not configured, Intune not deployed, Defender not configured. Optimyze's target for managed clients is a score above 75%, with most reaching 80%+ within three months of the initial deployment.
How Optimyze uses Secure Score
At the start of every engagement, Optimyze captures the baseline Secure Score. Each monthly client report includes the current score and trend. Quarterly vCIO reviews examine the remaining improvement opportunities and decide which to prioritise. The Secure Score trend over time is one of the clearest demonstrations of the value an MSP provides to a client's Microsoft 365 investment.
