Improve Microsoft Secure Score Without Chasing Points
Microsoft Secure Score is most useful when it becomes a prioritized exposure backlog. Many tenants have dozens of recommended actions across the Microsoft Defender portal, Microsoft Entra, Microsoft Intune, Exchange Online, SharePoint, and Microsoft Purview. The hard part is not finding work; it is deciding which changes reduce business risk first without breaking authentication, mail flow, sharing, or endpoint access.
Use Secure Score as a risk backlog, not an executive KPI
A higher Microsoft Secure Score does not automatically mean the tenant is safe. Some actions add points but do little to close the most likely attack path. Other high-value controls may require licensing, deployment readiness, or user change management before they can be enforced.
Run Secure Score as a remediation backlog. Rank each action by exploitability, blast radius, user impact, licensing dependency, and implementation effort. A small set of identity fixes can reduce more risk than a broad push into low-impact recommendations.
A practical first target is a defensible baseline: MFA enforced for administrators, legacy authentication and basic authentication exceptions removed where possible, audit logging validated, external sharing tightened, endpoint visibility established, and email impersonation controls tuned.
Step 1: Build a baseline before enforcing controls
Start with evidence. Export Secure Score recommendations, capture the current score, document Microsoft 365 licenses, and list enabled workloads. A tenant using Microsoft 365 Business Premium has a different path from one using Microsoft 365 E3, Microsoft 365 E5, standalone Microsoft Defender plans, or legacy add-ons.
Answer five questions before changing policy: who has privileged roles, which accounts are not protected by MFA, whether any legacy or basic authentication paths remain, which endpoints are unmanaged or stale, and where external users can access files.
Record exceptions up front. Review break-glass accounts, service accounts, scanner accounts, SMTP AUTH dependencies, multifunction devices, backup tools, and third-party apps. If you enforce first and discover dependencies later, the security project becomes an outage.
Step 2: Fix identity first
Identity usually delivers the fastest risk reduction. Start with privileged roles in Microsoft Entra ID. Require MFA for administrators, preferably phishing-resistant methods such as FIDO2 security keys, passkeys, or certificate-based authentication where licensing, devices, and operations support them. Remove standing Global Administrator assignments that are no longer required. Use least-privileged roles and separate admin accounts.
If Microsoft Entra ID P2 is available, use Privileged Identity Management for eligible role activation and approval. If it is not available, still reduce permanent privileged assignments and review them on a schedule.
Confirm that legacy authentication is blocked. Exchange Online has disabled Basic authentication for most protocols in most tenants, but you should still check sign-in logs, SMTP AUTH settings, app passwords, old clients, and Conditional Access gaps. Conditional Access requires Microsoft Entra ID P1. Use report-only mode before enforcement, then block legacy client authentication once dependencies are resolved.
Create two cloud-only emergency access accounts. Exclude them only from policies that could lock out the tenant, protect them with long random passwords stored securely, and alert on every sign-in attempt.
Step 3: Harden email and collaboration
After identity controls are stable, focus on the channels attackers use daily: Exchange Online, Teams, SharePoint, and OneDrive.
For email, validate SPF, DKIM, and DMARC. Start DMARC in monitoring mode if needed, but define a path to quarantine or reject after legitimate senders are identified. Include marketing platforms, ticketing systems, finance applications, and any service that sends mail as your domain.
Tune anti-phishing and impersonation protections in Microsoft Defender for Office 365 or Exchange Online Protection, depending on licensing. Protect executives, finance users, payroll, IT admins, and high-risk partner or vendor domains. Review mailbox forwarding rules, external forwarding settings, and transport rules that could hide or redirect mail.
For collaboration, review anonymous links, default link type, external sharing by site, guest access, unmanaged device access, and owner review. Do not disable all sharing without business input. A safer first move is to reduce default link permissions, require authenticated external users for sensitive sites, expire links, and review sites with broad external access.
Small-tenant specifics: Security Defaults, forwarding and partner access
Tenants without Conditional Access can start with Security Defaults, Microsoft's preconfigured baseline in Microsoft Entra ID: every user must register for MFA within 14 days, administrators are always challenged, users are challenged when sign-in conditions warrant it, legacy authentication protocols are blocked and privileged activities such as Azure portal access require MFA. It costs nothing extra and Microsoft enables it on new tenants. Microsoft 365 Business Premium includes Microsoft Entra ID P1, so Business Premium tenants should move to Conditional Access, which can require strong authentication by role, device compliance, location and application. Prefer Microsoft Authenticator with number matching, passkeys, FIDO2 keys or Windows Hello for Business; keep SMS and voice as fallbacks, not the standard.
Automatic external forwarding is the control most small tenants have never looked at. It is set in the outbound spam policy in the Microsoft Defender portal with three values: Automatic - System-controlled, On and Off. Set it to Off: mail that would have forwarded externally is returned to the sender with a non-delivery report, inbox rules and mailbox forwarding to external addresses stop working, and internal forwarding is untouched. Put the few mailboxes with a business reason in a custom outbound spam policy rather than leaving the default On.
Three more items that score poorly in small tenants: partner access, which should be granular delegated admin privileges (GDAP) with named roles and an expiry you can read under partner relationships in the Microsoft 365 admin center, not a standing Global Administrator; the Tenant Allow/Block List, where permanent allow entries for senders and domains should be rare and reviewed on a schedule; and Defender for Office 365 preset security policies, where the Standard preset is the starting point and Strict the target for the users attackers aim at.
Step 4: Bring endpoints into scope
Secure Score can improve while real device exposure remains high. Confirm which Windows, macOS, iOS, and Android devices access Microsoft 365, which are enrolled in Microsoft Intune, which are compliant, and which are stale.
Prioritize visibility before advanced hardening. Establish device inventory, enrollment coverage, compliance reporting, and endpoint telemetry through Microsoft Defender for Endpoint or Microsoft Defender for Business where licensed. Then phase in controls such as BitLocker or FileVault, local administrator reduction, endpoint detection and response, attack surface reduction rules, and automatic investigation and remediation where included.
Use deployment rings. Pilot with IT, expand to a cooperative business group, then deploy broadly. Attack surface reduction rules, stricter compliance policies, and application controls can affect macros, VPN clients, legacy applications, and line-of-business tools.
Step 5: Treat compliance settings as response controls
Microsoft Purview controls affect how well you can investigate and contain an incident. Audit, retention, eDiscovery, sensitivity labels, data loss prevention, and insider risk signals are not just paperwork.
Validate that Microsoft Purview audit logging is available and that retention meets investigation needs. Audit (Standard) is included with many Microsoft 365 subscriptions; Audit (Premium) and longer retention require appropriate licensing. Confirm mailbox auditing, administrator activity, sharing events, and file access events are searchable for the period your incident response process requires.
Start with targeted data controls. Protect the most sensitive SharePoint sites, apply retention where legal or regulatory requirements are clear, pilot sensitivity labels with users who handle sensitive data, and deploy focused DLP policies for obvious high-risk data such as payment card numbers, government identifiers, health data, or client confidential information. Broad labels or DLP rules without training create false positives and workarounds.
Step 6: Make Secure Score a monthly operating rhythm
Secure Score changes as Microsoft adds recommendations, scoring changes, admins create exceptions, projects add sharing paths, and new workloads come online.
Hold a monthly review with security, IT operations, and a business owner when policy changes affect users. Review score movement, new recommendations, failed controls, exceptions, incidents, and overdue work. Assign owners and due dates. Keep an exception register with risk owner, reason, compensating control, and review date.
Report more than the score. Track Secure Score, high-risk open items, and policy exceptions. The useful executive message is not only that the score improved; it is that administrator MFA is enforced, legacy authentication paths were removed, anonymous sharing was reduced, and active endpoints are reporting.
Frequently asked questions
Should we aim for a perfect Secure Score?
No. Some recommendations need licensing you do not have or would break a business process. Work the list by risk, document each exception with an owner and a review date, and report the controls closed rather than the number.
Do we need Microsoft Entra ID P1 for Conditional Access?
Yes. Conditional Access requires Entra ID P1, which Microsoft 365 Business Premium, E3 and E5 include. Business Basic and Standard tenants use Security Defaults or add Entra ID P1 at $7.00 per user per month (Microsoft list price, October 2026 price list, annual term).
How do we stop external auto-forwarding without breaking a legitimate workflow?
Set the default outbound spam policy's automatic forwarding to Off, create a custom outbound spam policy for the specific mailboxes that must forward, and review that list quarterly.
How often should Secure Score be reviewed?
Monthly, with security, IT operations and a business owner present when a change touches users. Microsoft adds and rescores recommendations through the year, so a score that is not reviewed drifts down on its own.
Sources
- Security defaults in Microsoft Entra ID — Microsoft Learn, checked 2026-10-11
- Control automatic external email forwarding in Microsoft 365 — Microsoft Learn, checked 2026-10-11
| Phase | Priority actions | Evidence to collect | Common tradeoff |
|---|---|---|---|
| Days 0-7: Baseline | Export Secure Score, map licenses, list privileged roles, review sign-in logs, identify MFA gaps, check legacy/basic authentication exposure, inventory external sharing | Secure Score export, Microsoft Entra role assignments, authentication methods registration report, sign-in log sample, Conditional Access policies, SharePoint sharing reports, exception list | Enforcing before discovery can break SMTP AUTH dependencies, scanners, backup tools, legacy clients, or third-party apps |
| Days 8-30: Identity | Enforce MFA for admins, reduce Global Administrator assignments, separate admin accounts, create emergency access accounts, block legacy authentication, disable or review stale accounts | Authentication methods report, privileged role review, Conditional Access report-only results, sign-in logs filtered for legacy clients, emergency access account test and alert | Conditional Access requires Microsoft Entra ID P1; Privileged Identity Management requires Microsoft Entra ID P2 |
| Days 31-60: Email and collaboration | Validate SPF/DKIM/DMARC, move DMARC toward quarantine or reject, tune anti-phishing and impersonation controls, review forwarding, reduce anonymous links, review guest access | DNS records, Defender or Exchange policy settings, message trace samples, mail forwarding report, SharePoint external sharing report, guest user review | DMARC enforcement and sharing restrictions need business coordination to avoid blocking legitimate senders or collaboration |
| Days 45-75: Endpoint | Confirm device inventory, enroll unmanaged corporate devices, deploy compliance policies, enable Defender telemetry, pilot attack surface reduction rules | Intune enrollment report, device compliance report, Defender device inventory, stale device report, ASR audit results | Strict compliance or ASR policies can disrupt BYOD, remote access, macros, VPN clients, and legacy applications |
| Days 60-90: Data and compliance | Validate audit search and retention, protect sensitive sites, apply targeted retention, pilot sensitivity labels, deploy focused DLP for high-risk data | Purview audit status, audit search samples, retention policy scope, sensitivity label usage, DLP alerts and false-positive review | Broad labeling or DLP without training creates bypass behavior and support noise |
| Monthly: Operate | Review score drift, new recommendations, failed controls, exceptions, incidents, and overdue actions | Monthly Secure Score snapshot, remediation backlog, exception register, incident summary, executive risk report | A score increase is less valuable if critical attack paths remain open |
Key takeaways
- Manage Microsoft Secure Score as a prioritized risk backlog, not a race to a perfect score.
- Identity controls usually reduce exposure fastest: administrator MFA, privileged role cleanup, Conditional Access, and legacy authentication blocking.
- Email, collaboration, endpoint, and Purview controls need staged rollout because enforcement can affect mail flow, sharing, devices, and business processes.
- Monthly ownership, exception tracking, and evidence collection keep Secure Score improvements from decaying.
- Small tenants: Security Defaults until Conditional Access is licensed, external auto-forwarding set to Off in the outbound spam policy, and partner access through GDAP with an expiry.
If you need a practical remediation plan, the Microsoft 365 Security Baseline and Secure Score Remediation service ($3,450 per project, quoted in writing before work begins) assesses the tenant, ranks the actions by risk and licensing, and implements the controls that reduce exposure first.
Questions this article didn’t answer?
Thirty minutes with Mike — our CEO, not a sales rep. Bring the hard version of the question.