What is Microsoft Secure Score and should MSPs be using it?

Summary

Microsoft Secure Score is a numerical measure of how closely a Microsoft 365 tenant's security configuration matches Microsoft's recommended settings, found in the Microsoft Defender portal at security.microsoft.com. It scores identity, device, app and data protection, and only shows recommendations for products the tenant is licensed for. For MSPs, it works as a benchmarking and sales tool, not a replacement for a security stack. Most SMB tenants can realistically target 70-80%, and Inforcer helps MSPs stop the underlying configuration, and the score, from drifting between reviews.

Versioned specifics

• Secure Score sits inside the Microsoft Defender portal at security.microsoft.com/securescore, not as a standalone product. Source: Microsoft Learn.
• Each recommended action is worth 10 points or less; most are scored as complete or not complete, with a smaller number scored as a percentage of users or devices covered. Source: Microsoft Learn.
• Recommendations only display for products the tenant is licensed for; once licensed, Microsoft shows the full set of possible recommendations for that product regardless of the specific plan or edition held. Source: Microsoft Learn.
• Microsoft 365 Business Premium includes Microsoft Entra ID P1 and Microsoft Defender for Business as standard, the components behind most of Secure Score's higher-value recommendations.
• The Business plan family (Basic, Standard, Premium) is capped at a combined 300 seats per tenant. Source: Microsoft Learn, Business Premium FAQ.
• This article treats a score in the region of 70 to 80% as a realistic, achievable target for most SMB tenants, not 100%.

Scope and Limitation Statement

Inforcer lets MSPs define a baseline policy across Intune, Entra ID, Defender, Purview, Teams, Exchange Online, SharePoint and OneDrive, push it across every client tenant, and get alerted the moment a tenant drifts from that baseline, with PSA integrations that can turn a drift alert into a ticket automatically. It does not calculate or display a Microsoft Secure Score itself, does not replace Microsoft licensing, and is not an EDR or 24/7 SOC. It manages and monitors the configuration Secure Score measures.

Microsoft Secure Score Explained

First introduced as Office 365 Secure Score - before evolving to offer a broader security overview - Microsoft Secure Score is the tech giant’s built-in security ranking tool.

Found in the Microsoft Defender Portal, Secure Score provides an at-a-glance grading of an organisation’s security posture with a straightforward numerical scoring system.

Taking into account such parameters as your tenants’ password protection, data encryption, authentication and device security, Secure Score allows businesses to benchmark their Microsoft security setup, compare their protections against wider industry standards, and analyse the risk of any policy changes.

Why Microsoft Secure Score Matters

So far, so simple. Yet Secure Score has been improved and updated several times since first being introduced. Now, with Microsoft leaning heavily into its Intune, Entra, and Defender cybersecurity solutions, Secure Score’s place in the Microsoft security stack is much more important.

It has since incorporated scores for both the Windows operating systems and its Microsoft 365 tenants. It regularly evolves its support for Intune, MFA and Endpoint Protection, allowing users to view separate security breakdowns for their data, device, and account protections.

Microsoft has long hoped that MSPs would eventually favour a single solution for their security – and now, that hope seems to be paying off. As the industry seeks to simplify its solutions and capitalise on their existing Microsoft framework, their support for 365 Business Premium features has escalated; and with that, so has Secure Score’s relevance.

The Benefits of Microsoft Secure Score

Secure Score is developed on four key pillars:

• Discoverability – putting opportunities for improvement front and centre.
• Visibility – Providing current, historical and projected outcomes for identities, devices, applications and data security.
• Guidance – Suggesting best practices based on company KPIs, company policies, and global security standards.
• Control – Allowing users to amend, fix and update their Microsoft security settings quickly and efficiently.

This design philosophy is apparent the moment you land on its home page. Already, we have breakdowns of where your policies are improving – or detracting – from your Secure Score, a list of recommended actions, and a catalogue of upcoming, current, and previous actions to review or address.

Secure Score’s major selling point is this succinctness - but let’s not overlook how it supports every component of your Microsoft security stack too.

Microsoft Secure Score and the 365 Business Premium Stack

As well as an overall grading of your tenants’ security posture, Microsoft Secure Score provides more granular overviews for devices, apps, and identities, helping users identify their most vulnerable assets. In doing so, users can not only plug the gaps in their security structure, they create an environment in which their policies work holistically.

Because Secure Score is designed specifically for the Microsoft environment, policy changes do more than plug security gaps; they reinforce and reinvigorate the entirety of your stack.

For users that have invested in Microsoft 365 Business Premium – arguably the standard package for the security conscious business – this is transformative. Using disparate, third-party apps, means managing multiple different interfaces and managing compatibility manually. 365 Business Premium, conversely, provides the full security package and, with Secure Score, makes it visible, accessible and automated.

In short, Secure Score:

• Proactively searches for vulnerabilities, highlighting risk vectors before they are compromised
• Provides a bedrock for your security setup, aligning you to the best possible security structure for your Microsoft tenant
• Leverages the full value of your 365 Business Premium Package by providing total visibility and control of its protections
• Delivers measurable results on your security, benefitting your security efforts and providing transparent performance indicators for customers

Why Invest in Secure Score?

It Matches the Industry Trajectory

Increasingly, MSPs are leaning into Secure Score both as a management tool and a customer-facing performance metric. It’s not hard to see why: the industry is moving away from the reselling of multiple third-party securities, and is now favouring service-led, valued added solutions. There are also the cyber insurance benefits: many cyber insurance firms are requesting client’s Secure Score as part of the application process.

In Microsoft 365 Business Premium, MSPs have a single, highly configurable Microsoft stack for these value-added solutions; and with Secure Score, MSPs have both a security management tool, and a KPI, that both they and their customers can rely on.

It Harmonises the Microsoft Stack

Secure Score is, first and foremost, a Microsoft product – it makes little sense to leverage its benefits if you don’t intend to make the most of the Microsoft environment.

Still, few MSPs that push the Microsoft 365 Business Premium license actually make the most of its security functions, and in doing so deny themselves a suite of all-encompassing protections.

Secure Score is your window into these functions and, by embracing the benefits of Intune, Defender, and Entra, provides a single pane of glass into their security productization.

It Softens Upselling

When a customer identifies a new security need, they rarely want to spend money on another third-party solution: it’s one more cost to manage, and another vendor to rely on.

However, with Microsoft Secure Score, any security needs can be resolved using your customer’s existing Microsoft environment; and if they can’t, Secure Score provides more than enough benefits to justify that 365 Business Premium upgrade.

It Nurtures Customer Trust

With Secure Score, MSPs and their customers benefit from a clear and accessible KPI. While it’s not always necessary or advisable to aim for 100% Secure Score – an intricacy we’ll cover in a later blog – a Secure Score of 70-80% is realistic, achievable, and always measurable, providing guidance for MSPs and reassurance for their customers.

How Can Microsoft Secure Score Improve Managed Services?

With the industry moving away from disparate third-party solutions and embracing more flexible methods of service delivery, more and more MSPs are becoming dependent on Secure Score. It’s an industry change that Microsoft are more than aware of, working extensively with cyber-insurance providers to shape Secure Score to their assessment standards.

Crucially, Secure Score’s level of policy control also means MSPs can create their own tiered service offerings. Now, security can be priced proportionately to customers’ needs and, where needed, upgraded and amended from a single security interface.

Make the Most of Your Microsoft Stack with inforcer

Providing fast policy management, deployment, and backup, inforcer helps MSPs deploy policies at speed, in bulk, and fine-tuned to their customers’ needs.

To see how inforcer empowers your policy management, book a free demo with a local advisor today.