How do we improve our Microsoft Secure Score without breaking things?

Key facts

• Secure Score lives in the Microsoft Defender portal and covers identity, devices, apps and data.
• Points measure configuration, not whether attacks are actually stopped.
• Identity recommendations such as MFA and blocking legacy authentication usually give the most risk reduction.
• Statuses like risk accepted or resolved through third party keep the score honest.
• Most outages come from enforcing a change without checking sign-in logs first.

Read the score the right way

Microsoft Secure Score compares your tenant settings to a list of recommended controls and awards points for each one in place. Each recommendation shows its point value, the license it needs, the user impact and the steps to implement it.

The score is useful for spotting gaps and showing progress. It is not a risk rating. Some high-point items matter less for your business, and some low-point items close a real hole. Treat the list as a backlog to prioritize, not a target to max out.

Triage before you change anything

Export the recommendations and sort them into groups. This takes a few hours and prevents most surprises.

Check dependencies first

The usual causes of breakage are predictable. Old multifunction printers and scanners that send mail with basic SMTP authentication. Line-of-business apps that sign in with a shared account. Mobile mail clients that use legacy protocols. Vendors with standing admin access. Users who rely on anonymous sharing links for customers.

Before enforcing, look at Entra sign-in logs filtered by client app and authentication requirement, the Exchange SMTP auth report, and SharePoint sharing reports. Fix or replace the dependent systems, or plan a narrow, documented exception.

Stage every change

Use the safest available rollout method for each control type.

• Conditional Access: create in report-only mode, review results for one to two weeks, then enable.
• Defender for Office 365: apply preset security policies to a pilot group before everyone.
• Intune: assign policies to a pilot device group, then expand in rings.
• Defender attack surface reduction rules: run in audit mode, review events, then block.
• Sharing changes: announce them, offer a request path for exceptions, then restrict.
• Keep a change log with date, owner, scope and rollback steps for each item.

Keep the score honest

If a control is handled by another product, such as a third-party email filter or endpoint tool, mark it as resolved through third party. If the business has decided not to implement a recommendation, mark it as risk accepted with the reason and a review date. This keeps the score meaningful and gives auditors a clear record.

Remember that Microsoft adds and changes recommendations over time, so the score can drop with no change on your side. Review it monthly, look at what moved, and add new items to the backlog.

What a realistic target looks like

There is no universal good score. A small business on Business Premium that has MFA enforced, legacy authentication blocked, email protections on and devices managed has removed most common attack paths, whatever the number says. Compare against similar organizations in the portal for context, but measure progress by the attack paths you have closed.

How Accred Consulting approaches it

Accred Consulting treats Secure Score as a backlog. Discovery reviews the recommendations alongside sign-in logs, mail flow and sharing data to find the dependencies that would break. The proposal sets a clear scope, fixed price and timeline for the changes that matter most. US-based specialists stage each control in report-only, audit or pilot mode, communicate user-facing changes and enforce with structured check-ins. Items handled elsewhere or accepted are documented with the right status. Handover includes the change log, documentation and knowledge transfer, with optional support retainers for ongoing review.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions