Microsoft Secure Score provides South African businesses with a quantified measurement of their security posture—and for most organisations, the results are sobering. According to Gartner, 92% of cloud security incidents stem from misconfigurations rather than sophisticated attacks. With the average data breach costing South African organisations R53.1 million according to IBM, and the financial sector facing costs of R70.2 million, getting your configuration right isn't optional—it's essential.
Many South African SMBs invest in Microsoft 365 licences that include powerful security features, yet leave them disabled or misconfigured. Microsoft Secure Score exposes these gaps and provides actionable recommendations to close them. If you're paying for security capabilities you're not using, you're leaving money on the table and your business exposed.
What Is Microsoft Secure Score?
Microsoft Secure Score is a security analytics tool built into the Microsoft 365 Defender portal. It analyses your organisation's configuration across multiple security domains and provides:
- A numerical score representing your current security posture
- Comparison against similar organisations
- Specific recommendations for improvement
- Point values showing impact of each action
- Progress tracking over time
Think of it as a credit score for your security configuration. The higher your score, the better protected your organisation—and increasingly, cyber insurers and auditors are asking about it.
Accessing Your Secure Score
- Navigate to security.microsoft.com
- Sign in with administrator credentials
- Select Secure Score from the left navigation
- Review your current score and recommendations
No additional licensing is required—Microsoft Secure Score is included with Microsoft 365 Business Basic and above.
The Five Pillars of Microsoft Secure Score
Your Microsoft Secure Score is calculated across five security domains. Understanding each helps you prioritise improvements:
1. Identity (Highest Impact)
Identity controls typically offer the most points and greatest risk reduction. This pillar measures:
| Control Area | What It Assesses |
|---|---|
| Multi-factor authentication | MFA coverage across all users |
| Conditional Access | Risk-based access policies |
| Password policies | Complexity, expiration, banned passwords |
| Privileged Identity Management | Just-in-time admin access |
| Legacy authentication | Blocking insecure protocols |
| Self-service password reset | Secure password recovery |
With 26% of South African ransomware attacks using compromised credentials, identity controls deliver the highest security return. Identity access management forms the foundation of your security posture.
2. Data
Data protection controls safeguard sensitive information:
| Control Area | What It Assesses |
|---|---|
| Sensitivity labels | Classification of confidential data |
| Data Loss Prevention (DLP) | Policies preventing data exfiltration |
| Information barriers | Controlling communication between groups |
| Retention policies | Data lifecycle management |
| Customer Key | Encryption key management |
For POPIA compliance, data controls demonstrate appropriate safeguards for personal information.
3. Devices
Device security ensures endpoints meet minimum standards:
| Control Area | What It Assesses |
|---|---|
| Microsoft Defender for Endpoint | Endpoint protection deployment |
| Device compliance policies | Minimum security requirements |
| Attack Surface Reduction | Rules blocking common attack techniques |
| BitLocker encryption | Disk encryption enforcement |
| Windows Hello | Passwordless authentication |
| Firmware protection | Secure boot and TPM |
Unmanaged devices represent significant risk. Microsoft Secure Score highlights gaps in endpoint protection.
4. Apps
Application security controls protect cloud services:
| Control Area | What It Assesses |
|---|---|
| OAuth app permissions | Third-party app access review |
| Cloud App Security | Shadow IT discovery and control |
| Safe Attachments | Malware scanning for files |
| Safe Links | URL protection in emails and documents |
| Anti-phishing policies | Impersonation protection |
| App governance | Monitoring app behaviour |
With 84% of South African organisations targeted by phishing, application-level protections are essential.
5. Infrastructure
Infrastructure controls secure Azure and on-premises resources:
| Control Area | What It Assesses |
|---|---|
| Azure Security Center | Cloud resource protection |
| Network security groups | Traffic filtering rules |
| Just-in-time VM access | Reducing attack surface |
| Azure AD Connect | Hybrid identity security |
| Security defaults | Baseline protection settings |
For organisations with Azure resources, infrastructure controls prevent cloud misconfigurations—the cause of 92% of cloud incidents.
Understanding Your Score
Microsoft Secure Score ranges from 0% to 100%, though achieving 100% is neither practical nor necessary for most organisations.
Score Benchmarks
| Score Range | Assessment | Action Required |
|---|---|---|
| 0-30% | Poor | Immediate attention needed |
| 30-45% | Below average | Significant gaps exist |
| 45-60% | Average | Room for improvement |
| 60-75% | Good | Solid foundation |
| 75%+ | Excellent | Maintain and fine-tune |
Typical starting scores: Most organisations score between 30% and 45% when first assessed. Don't be discouraged by a low initial score—it simply reveals improvement opportunities.
Industry comparison: Microsoft provides benchmarks against similar-sized organisations in your industry. Use this to gauge where you stand relative to peers.
Why 100% Isn't the Goal
Not every recommendation suits every organisation. Some controls:
- Require premium licensing you may not have
- Conflict with business requirements
- Provide minimal benefit for your environment
- Create operational friction disproportionate to risk reduction
Aim for a score that reflects appropriate security for your risk profile. A 65% score with controls that match your threats beats an 80% score achieved by enabling irrelevant features.
High-Impact Actions to Improve Your Score
These Microsoft Secure Score recommendations deliver the greatest security improvement for South African SMBs:
1. Enable MFA for All Users (Critical)
Impact: Highest point value | Effort: Medium | Risk Reduction: Massive
Accounts without MFA are 99% more likely to be compromised. This single control blocks most credential-based attacks.
Implementation steps:
- Navigate to Microsoft Entra admin center
- Enable Security Defaults (simplest) or create Conditional Access policies (more control)
- Communicate to users before enforcement
- Provide registration guidance and support
- Monitor registration completion
- Enforce after grace period
For South African businesses: With 84% targeted by phishing and 26% of ransomware using stolen credentials, MFA is non-negotiable.
2. Block Legacy Authentication (Critical)
Impact: High | Effort: Low | Risk Reduction: High
Legacy protocols (POP, IMAP, SMTP AUTH, older Office versions) don't support MFA, making them prime targets for credential attacks.
Implementation steps:
- Review sign-in logs for legacy authentication usage
- Identify and migrate applications using legacy protocols
- Communicate changes to affected users
- Create Conditional Access policy blocking legacy authentication
- Monitor for issues and adjust
Warning: Blocking legacy auth may break older applications or devices. Audit before enforcing.
3. Implement Conditional Access Policies (High Value)
Impact: High | Effort: Medium | Risk Reduction: High
Conditional Access enforces requirements based on risk signals:
| Condition | Possible Response |
|---|---|
| Sign-in from unfamiliar location | Require MFA |
| Unmanaged device | Block or limit access |
| High-risk sign-in detected | Block and alert |
| Accessing sensitive apps | Require compliant device |
| After-hours access | Additional verification |
Recommended starter policies:
- Require MFA for all users
- Require MFA for administrators (always)
- Block legacy authentication
- Require compliant devices for sensitive data
- Block high-risk sign-ins
4. Enable Microsoft Defender for Office 365 Features
Impact: Medium-High | Effort: Low | Risk Reduction: Medium-High
If your licence includes Defender for Office 365, enable these protections:
| Feature | Protection Provided |
|---|---|
| Safe Attachments | Scans email attachments in sandbox |
| Safe Links | Checks URLs at click time |
| Anti-phishing policies | Detects impersonation attempts |
| Safe Documents | Scans documents before editing |
Configuration:
- Navigate to security.microsoft.com
- Select Email & collaboration > Policies & rules
- Configure preset security policies (Standard or Strict)
- Enable Safe Attachments for SharePoint, OneDrive, Teams
5. Configure Device Compliance Policies
Impact: Medium | Effort: Medium | Risk Reduction: Medium
Ensure devices meet minimum security standards before accessing corporate data:
Recommended compliance requirements:
- Require device encryption (BitLocker)
- Require minimum OS version
- Require antivirus and real-time protection
- Require firewall enabled
- Block jailbroken/rooted devices
- Require device PIN/password
Combine with Conditional Access to block non-compliant devices from accessing sensitive resources.
6. Enable Attack Surface Reduction Rules
Impact: Medium | Effort: Low | Risk Reduction: Medium
ASR rules block common attack techniques at the endpoint:
| Rule | Protection |
|---|---|
| Block Office apps from creating child processes | Prevents macro malware |
| Block Office apps from injecting code | Stops process injection |
| Block executable content from email | Prevents malware delivery |
| Block JavaScript/VBScript launching executables | Stops script-based attacks |
| Block credential stealing from LSASS | Protects credentials |
| Block untrusted USB processes | Prevents USB-based attacks |
Deployment approach:
- Enable rules in Audit mode first
- Monitor for false positives over 2-4 weeks
- Address any legitimate applications flagged
- Move to Block mode
7. Implement Privileged Identity Management (PIM)
Impact: Medium | Effort: Medium | Risk Reduction: High
PIM provides just-in-time administrative access rather than standing privileges:
- Administrators request elevation when needed
- Approval workflow for sensitive roles
- Time-limited access (e.g., 4 hours)
- Full audit trail of privileged actions
- Alerts on suspicious elevation patterns
Benefit: If admin credentials are compromised, attackers gain nothing—the account has no standing privileges to exploit.
Note: Requires Azure AD Premium P2 or Microsoft 365 E5 licensing.
Creating a Secure Score Improvement Plan
Systematically improving your Microsoft Secure Score requires a structured approach:
Phase 1: Quick Wins (Week 1-2)
Focus on high-impact, low-effort actions:
| Action | Typical Points | Effort |
|---|---|---|
| Enable Security Defaults | 15-20 | Low |
| Configure password protection | 5-10 | Low |
| Enable audit logging | 5-10 | Low |
| Enable Safe Attachments | 5-10 | Low |
| Enable Safe Links | 5-10 | Low |
These actions can add 40-60 points with minimal disruption.
Phase 2: Foundation Building (Week 3-6)
Implement core controls requiring more planning:
| Action | Typical Points | Effort |
|---|---|---|
| Deploy MFA for all users | 30-50 | Medium |
| Configure Conditional Access | 20-30 | Medium |
| Block legacy authentication | 10-15 | Medium |
| Enable device compliance | 15-25 | Medium |
Phase 3: Advanced Hardening (Week 7-12)
Deploy more sophisticated controls:
| Action | Typical Points | Effort |
|---|---|---|
| Implement PIM | 15-20 | Medium |
| Deploy ASR rules | 10-20 | Medium |
| Configure DLP policies | 10-15 | High |
| Enable sensitivity labels | 10-15 | High |
| Implement app governance | 5-10 | Medium |
Phase 4: Ongoing Optimisation
- Review score weekly
- Address new recommendations as Microsoft adds them
- Re-evaluate declined recommendations quarterly
- Benchmark against industry peers
- Report progress to leadership
Microsoft Secure Score and Cyber Insurance
South African cyber insurance providers increasingly consider security posture when underwriting policies. Microsoft Secure Score provides objective evidence of your security controls.
How Insurers Use Secure Score
| Insurance Consideration | Secure Score Evidence |
|---|---|
| MFA implementation | Identity score, MFA coverage percentage |
| Email security | Defender for Office 365 configuration |
| Endpoint protection | Device compliance and Defender deployment |
| Access controls | Conditional Access policies |
| Data protection | DLP and sensitivity labels |
Benefits of Higher Scores
- Premium reductions: Demonstrated security may lower premiums
- Easier underwriting: Clear evidence simplifies applications
- Coverage availability: Some insurers require minimum security standards
- Claims support: Configuration evidence supports breach claims
With only 26% of South African commercial entities having cyber insurance according to Santam, demonstrating strong Microsoft Secure Score may help secure coverage others cannot obtain.
Microsoft Secure Score and POPIA Compliance
For South African organisations, Microsoft Secure Score improvements directly support POPIA compliance:
| POPIA Requirement | Secure Score Control |
|---|---|
| Security safeguards | Device compliance, encryption, access controls |
| Authorised access only | MFA, Conditional Access, least privilege |
| Audit trails | Unified audit logging, sign-in logs |
| Data protection | DLP policies, sensitivity labels |
| Breach notification readiness | Alert policies, detection capabilities |
The Information Regulator expects organisations to implement "appropriate, reasonable technical and organisational measures" to protect personal information. A documented Secure Score improvement programme demonstrates proactive security investment.
Compliance mapping: Microsoft provides specific mappings from Secure Score recommendations to regulatory frameworks. Access these through the Compliance Manager in the Microsoft 365 compliance portal.
Common Secure Score Mistakes to Avoid
These errors undermine Microsoft Secure Score improvement efforts:
| Mistake | Problem | Solution |
|---|---|---|
| Chasing points blindly | Enabling controls inappropriate for your environment | Evaluate each recommendation for business fit |
| Ignoring user impact | Deploying controls without communication | Plan change management and training |
| Skipping testing | Breaking applications with new policies | Test in pilot groups before broad deployment |
| One-time effort | Score degrades as new recommendations appear | Establish ongoing review cadence |
| Excluding executives | Leadership bypasses security controls | Apply policies consistently across all levels |
| Marking complete without implementing | Artificially inflating score | Only mark resolved when truly implemented |
| Ignoring Intune/device management | Losing significant points | Enrol devices in Intune for full scoring |
Score Improvement by Licence Level
Your maximum achievable Microsoft Secure Score depends on your Microsoft 365 licensing:
Microsoft 365 Business Basic/Standard
| Available Controls | Typical Max Score |
|---|---|
| Basic MFA (Security Defaults) | ✅ |
| Basic Conditional Access | Limited |
| Exchange Online Protection | ✅ |
| Basic device management | Limited |
| Realistic target | 45-55% |
Microsoft 365 Business Premium
| Available Controls | Typical Max Score |
|---|---|
| Full Conditional Access | ✅ |
| Defender for Office 365 Plan 1 | ✅ |
| Intune device management | ✅ |
| Azure AD Premium P1 | ✅ |
| Defender for Business | ✅ |
| Realistic target | 60-75% |
Microsoft 365 E3
| Available Controls | Typical Max Score |
|---|---|
| All Business Premium features | ✅ |
| Advanced compliance features | ✅ |
| Information protection | ✅ |
| Realistic target | 65-80% |
Microsoft 365 E5
| Available Controls | Typical Max Score |
|---|---|
| All E3 features | ✅ |
| Defender for Office 365 Plan 2 | ✅ |
| Azure AD Premium P2 (PIM) | ✅ |
| Defender for Endpoint Plan 2 | ✅ |
| Advanced analytics | ✅ |
| Realistic target | 75-90% |
Recommendation for SA SMBs: Microsoft 365 Business Premium offers the best security-to-cost ratio, providing Conditional Access, Intune, and Defender capabilities essential for meaningful score improvement.
Tracking and Reporting Secure Score
Document your Microsoft Secure Score journey for stakeholders and auditors:
Metrics to Track
| Metric | Frequency | Purpose |
|---|---|---|
| Overall score | Weekly | Progress tracking |
| Score by category | Monthly | Identify weak areas |
| Recommendations completed | Monthly | Activity tracking |
| Comparison to peers | Quarterly | Benchmarking |
| Score trend | Monthly | Momentum measurement |
Reporting to Leadership
Create monthly or quarterly reports including:
- Current score and trend
- Actions completed this period
- Planned actions for next period
- Comparison to industry benchmark
- Risk reduction achieved
- Blockers requiring executive support
Executive summary example:
"Our Microsoft Secure Score improved from 42% to 58% this quarter through MFA deployment and Conditional Access implementation. We now exceed the industry average of 47% for organisations our size. Planned Q2 actions include device compliance policies and DLP implementation, targeting 65%."
Integration with Security Operations
Link Microsoft Secure Score improvements to your broader security programme:
- Map recommendations to patch management priorities
- Connect identity improvements to IAM strategy
- Align device compliance with endpoint protection
- Feed findings into firewall configuration reviews
Beyond Secure Score: Comprehensive Security Posture
While Microsoft Secure Score is valuable, it measures only Microsoft cloud configuration. A complete security posture assessment includes:
| Area | Tool/Approach |
|---|---|
| Microsoft cloud configuration | Microsoft Secure Score |
| On-premises infrastructure | Vulnerability scanning, penetration testing |
| Network security | Firewall configuration reviews |
| Endpoint security | EDR deployment, compliance monitoring |
| Human factors | Security awareness training, phishing simulations |
| Third-party applications | Vendor security assessments |
| Physical security | Access controls, visitor management |
Microsoft Secure Score is one piece of the puzzle—an important piece, but not the complete picture.
The Cost of Misconfiguration
Improper configuration has real financial consequences for South African businesses:
| Risk | Potential Cost |
|---|---|
| Data breach (average SA) | R53.1 million |
| Financial sector breach | R70.2 million |
| Ransomware recovery | R23 million + R17 million ransom |
| POPIA penalty | Up to R10 million |
| Business interruption | Variable—potentially catastrophic |
| Reputational damage | Customer loss, brand impact |
Compare this to the cost of configuration improvement: time invested in Microsoft Secure Score recommendations typically requires no additional licensing spend for basic controls, only administrative effort.
Next Steps for Your Organisation
Improve your Microsoft Secure Score starting today:
- Check your current score — Login to security.microsoft.com and review your baseline
- Identify quick wins — Enable Security Defaults if MFA isn't deployed
- Plan MFA deployment — Your highest-impact action if not already complete
- Block legacy authentication — Close this common attack vector
- Create improvement roadmap — Prioritise recommendations by impact and effort
- Establish review cadence — Check score weekly, report monthly
Need help improving your Microsoft Secure Score? Contact RSAT.online for a security posture assessment tailored to South African businesses using Microsoft 365.
About RSAT.online
RSAT.online provides practical cybersecurity guidance for South African small and medium businesses. From Microsoft 365 security assessments to Secure Score improvement programmes, we help local organisations maximise the security value of their existing Microsoft investments.
