Guide
Microsoft Secure Score checklist
A practical checklist for lifting Microsoft Secure Score using controls you already own — without theatre.
Microsoft Secure Score is useful when it drives controls that are actually on, not a number you chase for its own sake. Use this checklist to pick the first moves that reduce real risk.
Print it, or download the PDF.
How to use it
Work top-down. Identity first, then email, then devices and data. Tick only what is enforced, not “planned”.
Have a named break-glass account before you tighten Conditional Access.
Identity
- MFA required for all users, including admins
- Legacy authentication blocked
- Number of standing Global Administrators kept small (and named)
- Privileged roles use just-in-time access (PIM) where licensed
- User consent for applications restricted
- Guest access is deliberate — not the tenant default
Email and collaboration
- Defender for Office 365 policies on (Safe Links / Safe Attachments where licensed)
- Anti-phishing policy covers all users, not only a pilot group
- External sharing in SharePoint and OneDrive is constrained
- Mailbox auditing and unified audit log are enabled
Devices and data
- Devices that access company data are enrolled or app-protected
- BitLocker / encryption required for Windows where Intune is in play
- Sensitive data has at least a basic Purview / DLP starting point if you handle it
Governance
- Secure Score is reviewed on a cadence, with an owner
- Changes are recorded (what was switched on, and why)
- The score is a by-product of the controls — not the target
When you want this turned into a ranked plan for your tenant, book a chat.