Microsoft Secure Score gives every Microsoft 365 tenant a measurable security rating based on the controls configured in the environment. Most NZ SMBs have a Secure Score well below 50% — leaving significant security capability unused. Here's what the score measures and how to improve it.
Microsoft Secure Score is a numerical representation of your organisation's Microsoft 365 security posture — specifically, how many of Microsoft's recommended security configurations you have enabled relative to the total available. A score of 100% means every available security control is active. Most newly assessed NZ SMB tenants score between 30–50% — meaning a significant portion of available security capability is unused.
Access your Secure Score at security.microsoft.com → Secure Score. You'll see your current score, a breakdown by category, and a prioritised action list showing what to enable and what impact each action has on your score.
What the Score Measures
Secure Score covers six categories: Identity (MFA, Conditional Access, privileged access), Data (information protection, classification policies), Device (Intune enrollment, compliance policies, EDR), Apps (Safe Links, Safe Attachments, DMARC), Infrastructure (Azure security settings), and Network (network access policies). Each category has multiple specific actions — "Require MFA for all users" is one action; "Enable DKIM for all accepted domains" is another.
Quick Wins: High Impact, Low Effort
Several high-scoring actions require minimal configuration effort: enabling security defaults (if Conditional Access isn't yet configured), enabling DKIM for all domains, enforcing MFA for all admins, enabling Microsoft Defender for Office 365 Safe Links, blocking legacy authentication, and enabling unified audit logging. These actions collectively add 15–25 points to a typical SMB Secure Score and address some of the most commonly exploited configuration gaps.
Secure Score as a Management Tool
Secure Score is most valuable when tracked over time — used as a periodic benchmark that answers the question "is our Microsoft 365 environment getting more or less secure as we make changes?" Optimyze includes Secure Score trend as a standing item in monthly managed IT reporting for all Microsoft 365 clients, with commentary on any score changes and planned actions to improve it further.
For businesses that want to demonstrate security posture to clients, insurers, or regulators, Secure Score provides a third-party (Microsoft) assessment of configuration security that's more credible than self-reported security claims. A sustained Secure Score above 70% represents a well-configured Microsoft 365 environment and is documentable evidence of security controls in place.
Microsoft Secure Score is a free tool available in every Microsoft 365 tenant. If you haven't looked at yours, checking it this week will show you what your Microsoft 365 environment's security posture actually is — and probably a clearer path to improving it than any third-party assessment.
