Identity Secure Score in Microsoft 365: What It Is and How to Use It

Strengthen your Entra ID setup with Identity Secure Score

In this post: What is Identity Secure Score? · Where to find it · Why it’s worth checking · How the score is actually calculated · Tracking the trend with PowerShell · Getting alerted when it drops · When would you actually use this? · Best practices and how to implement them · Sample walkthrough: enforce MFA for admins · Related reading

What is Identity Secure Score?

Identity Secure Score is the identity-focused slice of Microsoft Secure Score, found in the Microsoft 365 Defender portal. It scores how locked-down your Entra ID (Azure AD) setup is — MFA coverage, legacy authentication, admin role sprawl — and ranks what to fix first.

URL Reference:
https://security.microsoft.com/securescore

Where to find it

Go to https://security.microsoft.com/securescore
Open Secure Score from the left menu
Filter by “Identity” to see just the Entra ID recommendations

Why it’s worth checking

Each recommendation comes with an impact score and clear implementation steps, and shows whether it’s implemented, partially implemented, or not at all. It’s aimed at IT admins, security auditors, and compliance teams who need a prioritized, measurable list of identity risks — not just a vague “improve security” mandate.

How the score is actually calculated

Identity Secure Score isn’t a single opaque number — it’s a percentage: points earned across every identity-related improvement action, divided by the total points available for actions applicable to your tenant. “Applicable” matters here — an action tied to a feature you don’t have licensed (Identity Protection’s risk policies, for example, require Entra ID P2) doesn’t count against you the same way an unaddressed action you actually could fix does. Each action also shows one of three states — To address, Planned, or Resolved through third party — so you can mark something as handled by a non-Microsoft tool without it sitting in your “to fix” list forever. The portal also shows how your score compares to similar-sized organizations, which is useful context for whether a given gap is unusual or just where most tenants your size actually sit.

Tracking the trend with PowerShell

The portal shows the current score well, but a single snapshot doesn’t answer “is this actually improving” the way a trend does. Microsoft Graph keeps a daily history — 90 days by default — pullable via the Security PowerShell module:

Connect-MgGraph -Scopes "SecurityEvents.Read.All"

Get-MgSecuritySecureScore -Top 90 |
    Select-Object CreatedDateTime, CurrentScore, MaxScore,
        @{N='Percentage'; E={ [math]::Round(($_.CurrentScore / $_.MaxScore) * 100, 1) }} |
    Sort-Object CreatedDateTime |
    Export-Csv -Path "C:\Reports\SecureScoreTrend.csv" -NoTypeInformation

Each entry is the tenant’s whole Secure Score for that day (not filtered to just the identity slice this post focuses on), so this is the overall trend rather than an identity-only line — still useful for showing a security committee “here’s the trajectory since we started acting on these recommendations” instead of a single point-in-time screenshot. Schedule this to run daily or weekly and the CSV builds its own history even past whatever window Microsoft retains natively.

Getting alerted when it drops

A CSV trend file is only useful if someone actually opens it — the more actionable version is a flow that watches the same data and says something when it moves in the wrong direction. Graph’s underlying endpoint for the trend data above is GET /security/secureScores, which a scheduled Power Automate flow can call directly via an HTTP action against Graph, without needing PowerShell at all:

Trigger: Recurrence, daily.
Action: HTTP — GET https://graph.microsoft.com/v1.0/security/secureScores?$top=1, authenticated against an app registration with the SecurityEvents.Read.All permission.
Action: Parse JSON on the response, extracting currentScore and maxScore from the first item in the value array.
Condition: compare today’s percentage against yesterday’s (pulled from a SharePoint list or a small stored value from the previous run) — if it dropped by more than a threshold you set, branch to the notification step.
Action: post to a Teams channel or send an email to whoever owns identity security, flagging the drop and by how much.

A regression is usually more actionable to catch same-day than to notice weeks later scrolling through a CSV — someone disabled a Conditional Access policy, a license lapsed and took a covered control with it, or a new admin account got created without MFA enforced. Catching that the day it happens is a very different remediation conversation than catching it during a quarterly review.

Each recommendation comes with an impact score and clear implementation steps — ranked and actionable, not a vague \”improve security\” mandate.

When would you actually use this?

You just failed a security review and need a prioritized fix list you can hand to leadership, not another spreadsheet of vague advice.
You suspect MFA isn’t actually enforced everywhere, but checking policy by policy is tedious.
Legacy protocols like POP/IMAP might still be enabled somewhere without you knowing about it — the score flags this as a specific, scored item instead of a guess.
You’re being asked to move toward Zero Trust but don’t know where to start on the identity side — the recommendations map directly onto the identity pillar, ranked by impact.

Best practices and how to implement them

Best Practice	Why It Matters	How to Do It
Enable MFA for All Users	Protects against password spray & phishing	Use Conditional Access or Security Defaults
Limit Legacy Authentication	Old protocols like POP/IMAP bypass MFA	Disable in Entra ID & Exchange Admin
Review Role Assignments	Avoid privilege creep	Use PIM (Privileged Identity Management)
Configure Sign-In Risk Policies	Automate response to risky logins	Use Identity Protection
Enable User Risk Policies	Detects compromised identities	Blocks or requires password reset

Sample walkthrough: enforce MFA for admins

Go to Entra Admin Center > Conditional Access
Create a new policy named MFA for Admins
Target Directory Roles > select roles like Global Admin, SharePoint Admin, etc.
Under Grant, choose Require multi-factor authentication
Enable and monitor compliance

Watch your Identity Secure Score go up after this rolls out. Some controls — like Identity Protection’s risk-based policies — need an Entra ID P2 license, so check what’s covered before planning around a recommendation.

Multi-Factor Authentication (MFA): What You Need to Know — MFA coverage is one of the biggest single levers on this score.
Multi-Factor Authentication (MFA) Options for Microsoft — the Microsoft-specific setup steps for the MFA improvements this score is tracking.

Now that is one useful tip! For questions and clarifications, please write it as a comment below. Have a nice day!

Utilizing Identity Secure Score in M365 Admin Center