Microsoft Secure Score: Which Recommendations to Prioritize and Which to Ignore

These recommendations address the most commonly exploited attack vectors in Microsoft 365 environments. Implement them before anything else, regardless of their Secure Score point contribution.

Require MFA for all administrators (Entra ID): Account for the point value: varies, but this is the single highest-impact security control in the Microsoft ecosystem. Microsoft data shows 99.9 percent of compromised Microsoft accounts did not have MFA enabled. Implement MFA for every account with a privileged Entra ID role: Global Administrator, Privileged Role Administrator, Security Administrator, Exchange Administrator, SharePoint Administrator. Use Conditional Access policies, not per-user MFA (per-user MFA is legacy and harder to manage at scale). Require phishing-resistant MFA (FIDO2 hardware key or Microsoft Authenticator with number matching) for Global Administrators.

Enable Privileged Identity Management (PIM) for all privileged roles: PIM requires eligible users to activate their privileged role with justification and approval before it is assigned. This means a compromised Global Administrator account is not permanently in the Global Administrator role; the attacker must also complete the PIM activation workflow. Combined with MFA, PIM on privileged roles is the strongest identity control in the Entra ID toolkit.

Block legacy authentication protocols: Basic authentication (SMTP AUTH, IMAP, POP3, Exchange ActiveSync with basic credentials) does not support MFA and is the primary attack vector for password spray attacks. Block legacy authentication via Conditional Access policy: Clients Authentication Methods condition targeting Exchange ActiveSync and Other clients. Microsoft shows that 99 percent of password spray attacks use legacy authentication protocols.

Enable Entra ID Identity Protection: Identity Protection evaluates each sign-in for risk signals (leaked credentials, impossible travel, anonymous IP, malware-linked IP, Entra ID threat intelligence) and can block or require MFA step-up for risky sign-ins automatically. Enable user risk and sign-in risk policies. Set risky sign-in policy to require MFA (not block, which disrupts legitimate users). This automates a detection and response loop that would otherwise require analyst review of every sign-in risk alert.

These recommendations provide meaningful security improvement with manageable implementation complexity. Target within 30 to 60 days of completing Tier 1.

Enable Microsoft Defender for Office 365 Safe Links and Safe Attachments: Safe Links rewrites URLs in emails and documents and evaluates the link at click time against Microsoft's threat intelligence. Safe Attachments detonates email attachments in a sandbox before delivery. Both address phishing and malware delivery, the leading initial access vector for business email compromise and ransomware. In Defender for Office 365 Plan 2, enable these policies for all users in the default global policy and supplement with strict policies for executive and finance users.

Configure Conditional Access to block authentication from high-risk locations or non-compliant devices: Conditional Access policies can require compliant devices (Intune-enrolled and meeting compliance policy) or hybrid Entra ID joined devices for access to corporate resources. This prevents credential theft attacks from being operationalized from unmanaged attacker-controlled devices. Start with requiring compliant devices for access to sensitive data stores (SharePoint sites containing confidential data, Exchange Online for executive mailboxes).

Enable audit logging in Exchange Online and SharePoint: Audit logs are required for incident investigation, insider threat detection, and compliance. Exchange Online audit logging should capture mailbox access, message sending (from delegated accounts), and admin actions. SharePoint audit logging should capture file access, download, sharing, and permission changes. Audit logs are not enabled by default at all required levels in some licensing tiers; verify coverage.

Enable Microsoft Defender for Endpoint on all Windows devices: Defender for Endpoint is included with Microsoft 365 E5 or available as an add-on. It provides endpoint detection and response (EDR), attack surface reduction rules, and network protection. If you have the license, enabling Defender for Endpoint and onboarding all Windows devices to it provides more security improvement than any 10 lower-tier Secure Score recommendations.

These recommendations frequently appear near the top of organizations' Secure Score action lists because of high point values, but their marginal security improvement for most organizations is low. Do them if you have capacity after completing Tiers 1 and 2, not before.

Turn on mailbox auditing for all users (if already covered by unified audit log): If you have unified audit log enabled (covered by Tier 2), per-mailbox auditing provides marginal additional detail for most organizations. The Secure Score recommendation is often already met by unified audit log policies. Check before implementing separately.

Set outbound spam filter policies: Outbound spam filtering catches compromised accounts sending spam, which protects your email domain reputation. Important to implement, but it addresses a consequence of account compromise rather than preventing account compromise. It should not be higher priority than MFA or legacy auth blocking.

Do not allow users to grant consent to unmanaged applications: Disabling user consent for non-Microsoft applications prevents OAuth token theft from phishing attacks that trick users into consenting to a malicious app. This is a genuinely valuable control, but it requires building an app governance workflow to approve legitimate third-party app integrations that users previously consented to individually. The implementation effort is higher than the Secure Score point value suggests, and the user experience impact is significant without careful planning.

Enable DMARC, DKIM, and SPF: All three email authentication standards are important for protecting your domain from spoofing. However, they are often already implemented as part of basic email configuration. If not implemented, do them. If they are partially implemented (SPF and DKIM but not DMARC with enforcement), completing DMARC to p=quarantine or p=reject is the meaningful action.

The most valuable use of Secure Score is not chasing a specific number but tracking trend over time and comparing your score against your industry peer group. Secure Score provides both capabilities natively.

Trend tracking: Review Secure Score monthly. A declining score without a deliberate exception process indicates that security configurations are drifting toward less-secure states, which happens when admins make configuration changes without security review, when new Microsoft features are deployed with default-insecure settings, or when old policies are deprecated without replacement.

Peer comparison: The Secure Score dashboard shows your score relative to similar-sized organizations in the same industry sector (based on anonymized Microsoft data). A score significantly below peer median indicates you are missing controls that similar organizations have implemented, which is useful for board-level security program reporting.

Risk acceptance and exceptions: Not all Secure Score recommendations are appropriate for every organization. Legacy ERP systems may require specific authentication methods that conflict with Conditional Access policies. Block legacy authentication wholesale can break production applications that cannot be updated quickly. Use the 'Resolve through third party,' 'Alternate mitigation,' and 'Risk accepted' options in Secure Score to document exceptions rather than ignoring recommendations without record.

Secure Score is not a security audit outcome. A score of 100 percent does not mean the organization is secure. It means the organization has enabled the Microsoft controls that Secure Score measures. Critical controls outside the Microsoft ecosystem (network security, endpoint agents for non-Windows devices, backup integrity) are not reflected in the score.