Microsoft Secure Score & Exposure Score

by Geert | December 17, 2025, updated November 2026

In this article we dive into two important Microsoft security metrics: Microsoft Secure Score and Microsoft Exposure Score.

We explain what they are exactly, why they exist and how they have evolved over the years. We also discuss how new rules and recommendations come about and why Microsoft does not implement these recommendations automatically.

On top of that we give practical examples and use cases of organisations that improved their Secure Score or Exposure Score.

Finally we present a table with the key differences between Secure Score and Exposure Score: think of purpose, measurement method, impact on security and typical recommendations.

What is Microsoft Secure Score?

Microsoft Secure Score is a built-in tool in Microsoft 365 that measures your security level. You get a score from 0-100%: the higher, the better your security settings match Microsoft's recommendations.

You find this score in the Secure Score dashboard in the Microsoft 365 Defender portal.

How does it work?

Microsoft Secure Score checks configurations and activities in various services (for example Entra ID, Exchange Online, OneDrive, Azure Defender, and so on) and compares them with security best practices.

For every recommended action (for example "Turn on multifactor authentication" or "Block legacy authentication") you can earn points. If you fully implement a recommendation, you get the full points; if you do it partially (for example MFA for 50% of the users), you get partial points.

All these points add up to your Secure Score, which is often also shown as a percentage of a maximum achievable score.

Example: Microsoft Learn

To avoid making someone's Secure Score public, we took an example from the Microsoft Learn page. (Don't know Microsoft Learn yet? If you work in IT: you can find literally everything there! 😉)

In the example you see the score is 47.23% (529.14 out of 1121 points).

This is a typical score that many organisations have and sits just above the average of 30-45%. We often see this in environments that are still "out of the box", so without extra policies. New customers usually start with a score like that, after which we work to push it as high as possible.

A good target is 80%. That is achievable in almost every environment. Of course we would rather aim even higher, but that brings risks of its own: the stricter the security, the harder for hackers, but sometimes also for users. And productivity must not suffer under security.

Security does not always have to add complexity. Think of passwordless sign-ins or Single Sign-On (SSO). Are those new to you? Feel free to contact us, or read more about it in one of our upcoming articles.

What do you see in the screenshot?

The top recommended actions are always neatly ordered by impact. That way you quickly identify the "quick wins" to push your score up.

Top recommended actions:

• Turn on Firewall on macOS
• Require MFA for administrative roles
• Enable PUA protection in Microsoft Defender
• Block risky process creations and API calls

What stands out?

• Identity and Apps score reasonably well.
• Devices still have a lot of room for improvement. Of the top improvement actions, 7 of the 8 are aimed at Devices, which explains the low score.
• You also do not see Data in this screenshot. That probably means it is a somewhat older one, from before DLP (Data Loss Prevention) was included in Secure Score, a recent addition by Microsoft.

Limitations

A high Secure Score is no guarantee that you are fully secure, but it does indicate that you have the recommended basic measures in order. It is a handy benchmark and motivator, although you must be careful: not every recommendation makes sense for every organisation (we come back to this later).

Still, Secure Score is one of the fastest ways to identify room for improvement and close the simpler gaps.

What it looks like in a real environment

Theory is one thing, but what does such a dashboard actually contain? We recently reviewed the complete list of recommended actions of an SME tenant: well over two hundred lines, each with its own point weight. The heaviest actions are worth about 0.8% of your total score, the lightest 0.08%. And the distribution says a lot: roughly two thirds of all actions are about devices, the rest about email and apps, identity and data.

Four things stand out in such a list, and they immediately tell you how to read the dashboard:

• Points come per action, not per project. Every line shows what it is worth and how much of it you achieved, down to behind the decimal point: 8.02 out of 9, or simply 0 out of 9. MFA for half of your users really earns half of the points. Nothing is all-or-nothing.
• The heaviest rules are easy to bundle. A series of Attack Surface Reduction rules, such as "Office applications must not start child processes" or "Block the theft of credentials from lsass.exe", is each worth about 0.75%. Rolling out such a cluster properly in one go moves your score a few percentage points at once.
• The score can also drop. About one in six actions was marked "Regressed": settings that once stood correctly, such as realtime protection or BitLocker, slipped back because a device drops out or a policy disappears. Secure Score is not a diploma you earn once, but a muscle you keep training. That is why we track the score monthly in every management plan.
• Not every recommendation is feasible for you. A handful of actions requires a higher licence or newer hardware, think of virtualization-based security or TPM 2.0; those sit in the list with "Have license? No". One more reason not to blindly chase 100%, but to pick the actions that fit your environment.

Curious how your tenant is doing? You find the dashboard in the Microsoft 365 Defender portal. Want the complete picture with scores, recommendations and a priority plan: check out our Microsoft 365 Security Audit.

What is Microsoft Exposure Score?

Microsoft Exposure Score is a relatively new(er) concept that mainly appears in the context of Microsoft Defender Vulnerability Management and the broader Security Exposure Management. Where Secure Score is about implementing preventive measures, Exposure Score looks at remaining exposure to risks and vulnerabilities. Simply put, it answers the question: "How vulnerable is my organisation to cyberattacks right now?".

In the Microsoft 365 Defender portal the Exposure Score is visible as part of Vulnerability Management or the new Exposure Management dashboard.

Important: with Exposure Score a lower score actually means less vulnerability ("better"), and a higher score means more exposure ("worse"). So it is the reverse of what we intuitively think of with a "score". Microsoft classifies:

• 0-29 = Low Exposure
• 30-69 = Medium
• 70-100 = High Exposure.

An organisation therefore aims for an Exposure Score that is as low as possible.

How is Exposure Score calculated?

Contrary to Secure Score (points per setting), the Exposure Score is calculated dynamically based on actual risk factors in your environment. Microsoft Defender inventories, among other things, all known vulnerabilities (e.g. missing patches or software with known risks) on devices, misconfigurations that pose security risks, and even things like active threats. According to Microsoft's explanation, the exposure score of a device (and cumulatively for the organisation) is influenced by factors such as:

• Number and severity of vulnerabilities on the device (e.g. high CVEs weigh more heavily).
• Known exploits or active attacks: if there is publicly available exploit code for a vulnerability, or if there are security alerts that point to abuse, that increases the exposure.
• Likelihood of compromise given the current security level of the system (for example, an unpatched domain controller is a more likely target than an isolated kiosk PC).
• Criticality of the asset: the value of the device or system to the organisation (e.g. a server with sensitive data weighs more heavily than a test laptop).

All these factors together form the Exposure Score. A sudden spike in the Exposure Score graph means new exposures or risks have been added in a short time, a signal for the security team to dig into what is going on. For example, suppose a new critical Windows vulnerability is released and your devices are vulnerable to it, then your Exposure Score will shoot up towards "High" until you take action (patching). As soon as you remove the vulnerability with updates or mitigations, the Exposure Score goes down again, reflecting that you are less vulnerable.

Why is it useful?

Exposure Score gives security teams insight into where they are most vulnerable so they can prioritise their efforts. In a time when tens of thousands of new vulnerabilities are discovered every year, a prioritised approach helps enormously. Exposure Score and the accompanying insights let you focus on the weak spots that pose the greatest risk to your organisation. This fits a modern, continuous approach to vulnerability management: not blindly trying to solve all the "red", but tackling the biggest exposures first for maximum risk reduction.

A CISO can also use the Exposure Score to easily communicate to management how the overall risk profile is doing: for example "We are currently at 25 (Low), our goal is to get below 20 by rolling out critical patches this month." The Exposure Score is therefore a KPI for risk exposure that is easy to understand outside IT.

How are new rules determined and when are they added?

Microsoft keeps both scores continuously up to date to respond to the newest threats, technologies and best practices. For Secure Score this means new recommendations (also called improvement actions) are regularly added or adjusted. Microsoft has dedicated teams (including security product teams and researchers) who look at recent security incidents and research and analyse which extra measure could help a customer prevent such an incident. Concretely: virtually every month Microsoft publishes changes to Secure Score. For example, in January 2024 a series of new recommendations was added, including "Require phishing-resistant MFA for administrators" (using FIDO2 or certificate-based auth for admins) and "Use a custom banned passwords list" in Entra ID.

These came out of the development of stricter MFA and password policy options. In February 2024, for example, a specific recommendation followed to adapt insecure AD CS certificate enrolment pages (ESC8) in Defender for Identity, directly inspired by attack techniques on Active Directory Certificate Services that had become public knowledge.

This illustrates that Microsoft adds new rules as soon as new risks become known or new features become available that can improve security. The additions are often bundled and announced through the "What's new in Secure Score" updates on Microsoft Learn. Although that page apparently has not been updated for almost two years. Why, Microsoft?

With Exposure Score the "rules" approach is somewhat different. Exposure Score leans on security intelligence and detections: every time a new vulnerability or threat appears, that information (CVEs, exploits and the like) is included in the system by Microsoft Threat Intelligence. If your systems are vulnerable to it, your Exposure Score will react to it. In other words, the "rules" here are the collected vulnerabilities and risks, and that list grows with every Patch Tuesday and every new CVE report. Where with Secure Score Microsoft manually decides "we are now going to recommend this best practice", with Exposure Score it is a more automated consequence of threat intelligence: new CVE with critical severity? Then it counts until you patch.

Microsoft is also open to customer feedback: in the Secure Score dashboard you can for example indicate if you find a particular recommendation not useful or have suggestions. In Exposure Management too you can choose "Suggest new metrics to the product team". All of this influences how the tools evolve.

Microsoft says:

"Security should be balanced with usability, and not every recommendation can work for your environment."

Why does Microsoft not implement the recommendations automatically?

Many admins wonder about this: if Secure Score knows what needs to happen, why does Microsoft not simply turn those settings on itself in my tenant? There are a few important reasons and considerations for this:

• "One size fits not all": not every recommendation is suitable or practical for every environment. Microsoft publishes generic best practices, but organisations differ enormously. What is a no-brainer for one organisation (e.g. requiring MFA for all users) can cause serious business continuity problems for another (legacy applications that cannot handle MFA, users in areas without reliable phone coverage, etc.). Microsoft therefore emphasises: "Security should be balanced with usability, and not every recommendation can work for your environment."
• Disruption and dependencies: many security settings can be disruptive if imposed abruptly. Suppose Microsoft decided on its own "from tomorrow all shared mailboxes are strictly blocked unless...", that could mean email downtime for some companies. In practice such changes must be planned, communicated and tested. The Secure Score recommendations are meant as a starting point for an admin to do that planning: you know your environment best and can assess what impact a setting has and whether preconditions need to be arranged first.
• Your own control and risk acceptance: Microsoft deliberately gives organisations control over which risks they want to mitigate and which they consciously accept. In Secure Score you can for example indicate "we accept this risk" or "resolved with an alternative" for a specific recommendation. That removes it from the score calculation. This mechanism exists because some recommendations may not be relevant in your situation, or you solve it another way. If Microsoft enforced everything automatically, there would be no room for such a case-by-case trade-off.
• Responsibility and liability: if Microsoft changes a setting automatically and something goes wrong (e.g. loss of data access or applications going down), who is responsible? In the cloud shared-responsibility model tenant configuration lies with the customer. Microsoft wants to give you guidance and tools, but ultimately the customer must make the decision. That way the customer keeps control and responsibility. Microsoft therefore offers the information (score, impact, and even comparisons with peers) to underpin that decision properly, instead of enforcing the decision.

In practice Microsoft thus acknowledges that not all recommendations must be implemented blindly. They exist to let you make conscious choices and to help you not overlook anything. Better still, Microsoft itself says: some recommendations may not be relevant for your company; the goal is mainly to improve on the points that matter to you. A Secure Score of 100% is not sacred if that means you have switched on all sorts of things that hinder your operations. It is about finding the right measures that fit your risk profile.

Conclusion

Use them wisely: not as absolute numbers to chase without context, but as tools to lead the security conversation in your organisation and to prioritise actions. When you do that, Secure Score and Exposure Score help you lift your security step by step to a higher level and demonstrably reduce risk.

Feel free to contact us or your IT partner if you want to discuss how your specific SME can take steps here.

PS: If you read this far...
...then you are ready for a clear plan. Start here with your Microsoft 365 Security Audit.