Every Microsoft 365 tenant has a Microsoft Secure Score. Most businesses have never looked at it.

Secure Score is a real-time measure of your Microsoft 365 security posture — a number that goes up when your security controls are properly configured and down when gaps exist. It is free, it updates continuously, and it tells you exactly which actions would have the most impact on your security if you took them.

For Irish and UK businesses navigating NIS2, GDPR compliance, cyber insurance renewals, and Copilot deployments, Secure Score is also one of the most useful pieces of compliance evidence available — if you know how to use it.

This post covers what Secure Score is, how it is calculated, what a realistic target looks like for an SME, which actions deliver the most impact, what it does not measure, and how to build it into a regular security review cadence.

35%
average Secure Score for Microsoft 365 SMEs before any deliberate configuration work
+40pts
typical score improvement achievable in 4–6 weeks with targeted configuration changes
Free
included in every Microsoft 365 plan — no additional licence required to access or use

What Microsoft Secure Score Is and How It Is Calculated

Microsoft Secure Score is a numerical representation of your organisation’s security posture across Microsoft 365, measured against a maximum score based on the products in your licence. You find it at security.microsoft.com under Secure Score in the left navigation.

The score is calculated by assessing your configuration against a set of improvement actions — specific security controls and settings that Microsoft recommends. Each action carries a point value proportional to its security impact. When the control is correctly configured, the points are awarded. When it is not, the points are withheld and the action appears in your improvement list.

The maximum possible score varies by tenant based on the Microsoft 365 products included in your licence. A business on Microsoft 365 Business Basic will have a lower maximum than one on Business Premium, because Business Premium includes more security products — and therefore more improvement actions — than Basic.

Secure Score does not measure absolute security. It measures your configuration completeness against Microsoft’s recommended security controls for your licence. A score of 75% means you have configured 75% of the recommended controls — not that you are 75% secure in any absolute sense.

What a Good Score Looks Like for an Irish SME

There is no universal target score, because the maximum varies by licence and organisation size. What matters is your score relative to your maximum — and how it compares to similar organisations.

0–30%
Critical
Basic controls missing. MFA likely not enforced. Significant exposure across the environment.
30–55%
Developing
Typical out-of-the-box Microsoft 365 setup. Common for businesses that have never reviewed their security configuration.
55–75%
Good
Most high-impact controls active. Defensible position for cyber insurance and NIS2 compliance purposes.
75%+
Excellent
Comprehensive configuration. Appropriate for regulated sectors, Copilot deployments, and high-security environments.

Microsoft publishes benchmark data showing that organisations in similar industries and of similar sizes typically achieve. Secure Score displays this comparison in the portal — allowing you to see not just your score but how it sits relative to peers. For most Irish SMEs that have never deliberately configured their Microsoft 365 security, an initial score between 30% and 45% is typical. A well-configured environment on the same licence usually sits above 65%.

The Highest-Impact Improvement Actions

Secure Score surfaces dozens of improvement actions, but they are not equal in value. Some carry ten points and take ten minutes to implement. Others carry two points and require significant planning. These are the actions that consistently deliver the highest point gains and the most meaningful security improvements for Irish SMEs.

Require MFA for all users
+30 to +50 pts typical

The single highest-impact action in almost every tenant. Enforcing MFA through Conditional Access — rather than relying on per-user MFA legacy settings — closes the most common initial attack vector across Microsoft 365 environments. Conditional Access MFA can be scoped by location, device compliance, and sign-in risk level. Microsoft’s own data consistently shows that MFA blocks over 99% of automated account compromise attacks.

Enable Microsoft Defender for Business on all devices
+20 to +35 pts typical

Many tenants on Microsoft 365 Business Premium have Defender for Business included in their licence but have never onboarded their devices to it. Onboarding is the step that activates EDR, automated investigation, and attack surface reduction rules — without it, Defender is providing basic antivirus only. Each device successfully onboarded increases the score, and the overall onboarding percentage is tracked separately.

Turn on Safe Links and Safe Attachments policies
+15 to +25 pts typical

Safe Links and Safe Attachments are included in Microsoft 365 Business Premium but disabled by default. Enabling both — and configuring them to cover email, Teams, and Office apps — activates the email threat protection layer that catches malicious links and dangerous attachments before they reach users. This is a configuration change that takes under 30 minutes and immediately improves both the score and the actual security posture.

Configure anti-phishing policies with impersonation protection
+10 to +20 pts typical

The default anti-phishing policy in Microsoft 365 provides basic protection. Configuring a custom policy with impersonation protection for key users (CEO, CFO, Operations Director) and domains, enabling spoof intelligence, and setting the phishing threshold to aggressive significantly improves detection rates for business email compromise attacks — the most financially damaging threat category for Irish SMEs.

Enable Microsoft Purview audit logging
+8 to +15 pts typical

Unified Audit Log in Microsoft Purview must be explicitly enabled for most tenants. Once active, it records all user and administrator activity across the Microsoft 365 environment. This is a prerequisite for incident investigation, compliance evidence, and NIS2 audit trail requirements. It takes one click to enable and costs nothing on Microsoft 365 Business Premium.

Remove legacy authentication protocols
+8 to +12 pts typical

Legacy authentication protocols — Basic Auth, IMAP, POP3, SMTP Auth — bypass MFA entirely. Any account using these protocols is vulnerable to password spray attacks even if MFA is otherwise enforced. Blocking legacy authentication through a Conditional Access policy is one of the most commonly overlooked security steps and one of the most consistently rewarded in Secure Score.

Want your Secure Score reviewed and improved?

Mata365 audits your current Microsoft 365 Secure Score, identifies the highest-impact actions for your specific licence and environment, and implements them — typically achieving a 20 to 40 point improvement within four weeks.

Explore M365 Security Services

What Secure Score Does Not Measure

Understanding the limitations of Secure Score is as important as understanding what it covers. Businesses that treat a high Secure Score as a proxy for comprehensive security will have gaps they are not aware of.

  • Network perimeter security — Secure Score measures Microsoft 365 configuration only. Firewalls, network segmentation, VPNs, on-premise infrastructure, and network monitoring are completely outside its scope.
  • Physical security — device theft, tailgating, physical access to servers, and clean desk policies are not measured. A stolen unlocked laptop is a significant incident regardless of the Secure Score.
  • Supply chain and third-party risk — the security posture of your suppliers, software vendors, and service providers does not appear in Secure Score. NIS2 supply chain requirements need a separate assessment process.
  • Human behaviour — staff clicking phishing links, weak password habits, and shadow IT are behavioural risks that configuration controls can mitigate but cannot eliminate. Secure Score awards points for deploying anti-phishing policies but cannot measure whether your team is actually security-aware.
  • Third-party applications — applications connected to Microsoft 365 via OAuth, third-party email security gateways, and non-Microsoft cloud services are not assessed. An over-permissioned third-party app is a risk Secure Score will not flag.
  • Business continuity — backup configurations, disaster recovery procedures, and recovery testing are outside Secure Score’s measurement scope entirely.

How to Use Secure Score as Compliance Evidence

One of the most underused aspects of Secure Score is its value as documented compliance evidence for GDPR, NIS2, cyber insurance, and client due diligence purposes.

Compliance Context How Secure Score Supports It
GDPR Article 32 Secure Score provides a documented record that appropriate technical measures are in place to protect personal data. The improvement action history shows what controls were implemented and when — useful evidence in a DPC investigation.
NIS2 Article 21 The Secure Score portal maps directly to several Article 21 technical requirements. A regularly reviewed and improving score, with a documented history of improvement actions taken, demonstrates active governance of cybersecurity risk management measures.
Cyber insurance renewal Most cyber insurance questionnaires ask whether MFA is enforced, whether endpoint protection is active, and whether email security controls are in place. Each of these maps to a Secure Score improvement action — and a score above 60% typically supports better premium outcomes and fewer exclusions.
Client due diligence Enterprise clients increasingly require security questionnaires from their suppliers. A documented Secure Score with a history of active management demonstrates a security posture that is measurable, improving, and governed — not just claimed.
ISO 27001 preparation Several ISO 27001 controls map directly to Secure Score improvement actions. While Secure Score alone is not sufficient for ISO 27001, it provides a structured baseline assessment and gap analysis that significantly reduces the effort of a formal audit preparation.

Building a Regular Review Cadence

Secure Score is only useful if someone is actually reviewing it. A single improvement sprint followed by months of inattention is not security management — it is a point-in-time snapshot that deteriorates as your environment changes and new threats emerge.

  • Weekly Check the score for unexpected drops — a significant decrease between reviews often indicates a new misconfiguration, a policy that has been disabled, or a new improvement action that has appeared because of a licence change.
  • Monthly Review the top five improvement actions with the highest point values that are not yet implemented. Assign ownership for each one and set a target completion date. Record the current score and the actions taken as part of an internal security governance log.
  • Quarterly Review the score trend against the same quarter in the previous year. Assess whether the score improvement is tracking against targets. Review the comparison benchmark to understand how the score sits relative to similar organisations. Use the quarterly review as the basis for a management security update — satisfying the NIS2 senior management governance requirement.
  • Annually Conduct a full security assessment that uses Secure Score as one input alongside a broader review of network security, supply chain risk, business continuity, and physical security — covering the areas Secure Score does not measure.

Where to Start

If you have never looked at your Microsoft Secure Score, the right starting point is simple: go to security.microsoft.com, navigate to Secure Score, and look at your current score and the top improvement actions listed. The portal itself is free, requires no setup, and will tell you immediately which controls are missing and how many points each one is worth.

If you have looked at it and found a score below 50%, the fastest path to improvement is to implement the six actions listed above — all of which can be completed without specialist development work and most of which are included in your existing licence.

Mata365’s Microsoft 365 security service covers a full Secure Score audit, prioritised improvement plan, configuration implementation, and a documented baseline for compliance purposes — for Irish and UK businesses that want their security posture measured, improved, and maintained.

Free Microsoft 365 Security Assessment

Mata365 reviews your Secure Score, identifies the highest-impact actions for your environment, and gives you a prioritised improvement plan — no commitment required.

Book Free Assessment Explore Security Services