What's Your Microsoft Secure Score? (And Why Your IT Provider Should Know It)

There's a number sitting in your Microsoft 365 account right now that tells you how well protected your business is. Most business owners have never seen it. Plenty of IT providers would prefer to keep it that way.

It's called Microsoft Secure Score, and if you use Microsoft 365, you already have one. The only question is whether anyone is looking at it.

What is Microsoft Secure Score?

Microsoft Secure Score is a percentage score built into Microsoft 365 that measures how closely your environment follows Microsoft's recommended security settings. It lives in the Microsoft Defender portal and it checks your actual settings, not your good intentions. Is multi-factor authentication enforced for everyone? Are old, insecure sign-in methods blocked? Are your laptops and phones managed and compliant? Each recommended action carries points, and your score is the percentage of available points you've earned.

It covers four areas: identity (who can sign in and how), devices (the laptops and phones touching your data), apps, and data itself. The score recalculates as your configuration changes, so it's a live reading rather than a one-off audit that gathers dust in a drawer.

One thing it isn't: a guarantee. A high score doesn't make you unhackable. But it does mean the doors that can be locked have been locked, and that's what most attacks actually test.

What counts as a good score?

Microsoft doesn't publish an official pass mark, but the patterns are well established. Most small business tenants that nobody has actively hardened sit somewhere in the 30 to 50 percent range. Above 70 percent generally means someone is managing the environment properly. Below 30 percent means the basics are missing and you're relying on luck.

Chasing 100 percent isn't the goal. Some recommendations won't apply to your business, and a few trade so much convenience for so little risk reduction that they're not worth it. What matters is that the high-impact items are done and the score trends upward over time. A score that hasn't moved in a year tells you nobody is working on it.

How do you improve your Microsoft Secure Score?

The Defender portal lists every recommended action ranked by impact, so you always know what to do next. The biggest point-earners are consistent across almost every business: enforce multi-factor authentication for all users, block legacy sign-in methods that can't support MFA, set up Conditional Access policies so only trusted devices reach company data, enrol devices in Intune with compliance rules, and apply Microsoft's security baselines to Windows.

Notice a pattern. Most of these need the tools in Business Premium, which is where the licence question below comes in. And a warning from experience: don't race to 100 percent by switching everything on at once. A setting that locks the whole office out on Monday morning costs you more trust than the points are worth. Prioritise by risk, test, then deploy.

Why your score can drop when your security improves

Here's a quirk that catches people out. Your score is graded against the products your subscription includes. Microsoft only marks you on the protections available to you, so a tenant on a basic plan is sitting a shorter exam.

We saw this first-hand with one of our clients. They were on Microsoft 365 Business Standard with a Secure Score above 60 percent, which looked respectable. We moved them to Business Premium and their score promptly fell off a cliff. Understandably, they asked what we'd done to their security.

The answer: nothing bad. Premium unlocked Intune, Conditional Access, Defender for Business and advanced email protection, and Secure Score immediately added all the recommended actions for those tools to the marking scheme. Same points earned, far more points available, lower percentage. Their real-world security hadn't dropped an inch. Their environment had simply moved from a short exam to the full paper, and now there was proper work to do. As we configured the new tools, the score climbed past where it started, except this time the number actually meant something.

The lesson: a Secure Score only makes sense alongside the plan behind it. 60 percent on Business Standard and 60 percent on Business Premium are not the same achievement. So before you compare your score to anything, check which plan you're on. The same applies when Microsoft adds new recommendations, which it does regularly. Everyone's percentage dips a little, then well-managed tenants climb back.

Why the score matters more than it looks

Secure Score turns "we take security seriously" from a slogan into something you can check. That has practical consequences beyond the obvious one of not getting breached. Cyber insurers increasingly want evidence of controls like MFA and device management before they'll offer sensible premiums. Larger customers and supply chain questionnaires ask the same questions. And if you're working towards Cyber Essentials, a healthy Secure Score means most of the technical groundwork is already in place.

How Secure Score holds your IT provider to account

Here's the part your current provider might not love. Secure Score is a scoreboard for them as much as for you.

Your IT provider controls most of the settings that make up the score. If it's low and staying low, that's not a Microsoft problem or a budget problem. It's a sign the environment isn't being actively managed. And because the score is a simple percentage with a history graph, you don't need to be technical to read it. Last quarter it was 52 percent. This quarter it's 61. Or this quarter it's still 52, and now you have a question to ask.

At Pebble IT we show every new client their Secure Score during onboarding. Warts and all. It's often the first time anyone has shown them the number, and occasionally it's a bracing moment. From then on it appears in every review meeting, so our clients can see exactly what's improved, what's next, and whether we're doing our job. We put the measuring stick in the client's hand deliberately. If we're not moving the number, they should be asking us why.

If your provider has never mentioned your Secure Score, it's worth asking for it. The answer, and how quickly it arrives, will tell you a lot.

How we manage it at Pebble IT

A score is only useful if someone acts on it, so here's what actually happens behind the number for our clients.

We review every client's security posture twice a week, with a live view of their Secure Score rather than a quarterly glance at a spreadsheet. When Microsoft releases a new recommendation or something in your environment shifts, we see it.

Improvements don't get pushed straight to your business. We test changes first, then roll them out safely, because a security setting that locks the whole office out on a Monday morning isn't a win for anyone. And for anything your team will actually notice, like a change to how MFA prompts work, you get advance notice so nobody is caught off guard. Changes behind the scenes are logged and reported too, so there are no mystery settings appearing in your tenant.

Then we lock it down and keep it locked down. Settings drift, staff change, Microsoft moves things around. Ongoing monitoring means the score you were shown at onboarding keeps improving instead of quietly eroding. In short, we have your backs.

Why we recommend Microsoft 365 Business Premium

You can view your Secure Score on almost any Microsoft 365 plan. Actually improving it is a different matter, because many of the highest-value actions need tools that only come with Microsoft 365 Business Premium or above.

Business Premium includes Intune for managing and securing devices, so a lost laptop is an inconvenience rather than a data breach. It includes Conditional Access, which lets you set rules like "only compliant company devices can open company email" instead of hoping for the best. It adds Defender for Business for endpoint protection and Defender for Office 365 for tougher phishing and malware defence in email.

Those four things cover most of the big point-earners in Secure Score, and more importantly, they cover the gaps attackers actually use. Business Standard is fine for the Office apps, but it leaves the security toolbox mostly empty. It's why Business Premium is our standard recommendation for clients, and it pairs nicely with the 24/7 monitoring and response included in our support plan.

How to find your Secure Score

If you have admin access to your Microsoft 365 tenant, sign in at security.microsoft.com and look for Secure Score under Exposure Management. You'll see your percentage, how it compares to similar organisations, and the full list of recommended actions ranked by impact.

If you don't have admin access, ask whoever does. If that's an IT provider and the number comes back low with no plan attached, you know where to find us.

Based in Hoddesdon, Pebble IT provides managed IT support and cyber security to businesses with 10 or more users across Hertfordshire, Essex and London.

Frequently asked questions

Is Microsoft Secure Score free? Yes. It's built into Microsoft 365 and visible in the Defender portal at no extra cost. Some of the recommended improvements need specific licences, such as Business Premium for Intune and Conditional Access, but the score itself costs nothing to see.

What Secure Score should my business aim for? There's no official target, but above 70 percent is a reasonable goal for a well-managed small business. More important than the number itself is the trend. It should be going up, and someone should be able to explain why.

Why did our Secure Score drop after upgrading to Business Premium? Because the score is measured against the tools your subscription includes. Upgrading unlocks Intune, Conditional Access and Defender, and Secure Score adds all their recommended actions to your total straight away. Your percentage falls until those tools are configured, then climbs higher than before. Nothing about your actual security got worse.

How often should I check my Secure Score? Quarterly at a minimum, and after any big change like a migration or a new app. Settings drift and Microsoft adds new recommendations regularly, so a score nobody looks at goes stale fast. Our clients don't need to remember, because we review their scores twice a week and the score appears in every review meeting.

Does a high Secure Score mean we can't be hacked? No. It means the recommended protections in your Microsoft environment are switched on, which removes the easy routes in. Ongoing monitoring, staff awareness and good backups still matter, which is why our support plan includes all three.

---

Want to know your Secure Score and what it actually says about your security? Give us a call on 01992 949300 or email hello@pebbleit.co.uk, and we'll check it with you, no strings attached.