How to check Secure Score in Microsoft Defender

Before you start

Use an account in a Microsoft Entra role that can read Secure Score: Security Reader and Global Reader are read only. The PowerShell example requests SecurityEvents.Read.All, which your organisation may need an administrator to consent to.

Microsoft keeps 1 score record a day, 90 days by default, and the examples read the latest. It lists every recommendation whatever your licences, so some actions may need a licence you do not hold. The examples read and export; they change nothing.

Option 1

Check Secure Score with PowerShell

Install the modules once, then connect, read the latest score and export the actions with points still to gain. The score holds what each action gives now; the control profile holds its title and the most it can give.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Security -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'SecurityEvents.Read.All' -NoWelcome
try {
    $score = Get-MgSecuritySecureScore -Top 1
    if (-not $score) {
        Write-Output 'Microsoft has not worked out a Secure Score for this tenant yet.'
    } else {
        $percent = 0
        if ($score.MaxScore -gt 0) {
            $percent = [math]::Round(100 * $score.CurrentScore / $score.MaxScore, 1)
        }
        $worked = $score.CreatedDateTime.ToUniversalTime().ToString('d MMM yyyy')
        Write-Output "Secure Score: $($score.CurrentScore) of $($score.MaxScore) ($percent%)"
        Write-Output "Worked out: $worked UTC"
        foreach ($average in $score.AverageComparativeScores) {
            Write-Output "Average, $($average.Basis): $($average.AverageScore)"
        }

        $profiles = @{}
        foreach ($item in Get-MgSecuritySecureScoreControlProfile -All) {
            $profiles[$item.Id] = $item
        }
        $actions = foreach ($control in $score.ControlScores) {
            $info = $profiles[$control.ControlName]
            if (-not $info -or $info.Deprecated) { continue }
            [pscustomobject]@{
                Control      = $info.Title
                ControlId    = $control.ControlName
                Category     = $control.ControlCategory
                Service      = $info.Service
                Points       = $control.Score
                MaxPoints    = $info.MaxScore
                PointsToGain = [math]::Max(0, $info.MaxScore - $control.Score)
                UserImpact   = $info.UserImpact
                Cost         = $info.ImplementationCost
            }
        }
        $toGain = @($actions | Where-Object { $_.PointsToGain -gt 0 } |
            Sort-Object @{ Expression = 'PointsToGain'; Descending = $true }, Control)
        if ($toGain.Count -eq 0) {
            Write-Output 'Every action has its full points.'
        } else {
            $csv = './secure-score-actions.csv'
            $toGain | Export-Csv -Path $csv -NoTypeInformation -Encoding utf8
            Write-Output "$($toGain.Count) actions have points to gain, listed in $csv."
        }
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The script prints the score and the averages Microsoft gives for comparison, then writes the actions with points still to gain, the biggest first. PointsToGain is what an action can give at most, less what it gives now. To list every action, take out Where-Object { $_.PointsToGain -gt 0 } |. To read the score over time, raise -Top: each record is 1 day.

Option 2

Check Secure Score in the Defender portal

1. Sign in to the Microsoft Defender portal for the correct tenant.
2. Open Microsoft Secure Score by going to security.microsoft.com/securescore.
3. On the Overview tab, read the Your secure score tile: a percentage, with the points achieved out of the total possible. The comparison bar chart shows organisations like yours.
4. Open the History tab for the score over time, or Metrics & trends for how it compares with similar organisations.
5. Open the Recommended actions tab, which lists each action with its status. The highest ranked have the most points left with the least difficulty, user impact and complexity.
6. Select an action to read its User impact and its Implementation steps, then close the flyout.

Leave the status, notes and tags alone: choosing a status such as Risk accepted, or adding a note or tag, saves it against that action in the tenant. This suits a look at 1 tenant you already have open. For the points to gain in a file you can sort and keep, use PowerShell or a report.

Common questions

Why does PowerShell say access is denied?

The sign-in needs consent for SecurityEvents.Read.All and an Entra role that can read Secure Score. A custom role made with Microsoft Defender Unified RBAC works in the portal but not through Microsoft Graph, which uses Entra roles.

Why has my score not moved after I fixed an action?

Microsoft says a change can take 24 to 48 hours to show. Some actions also give only part of their points: protecting 50 of 100 users with multifactor authentication earns 5 of 10. To list the accounts still missing it, see how to find users without MFA.

Can I reach 100%?

Not always, as some points need a licence you may not hold. In the portal, select Include beside the score to add the Current license score or Achievable score, which show what your licences allow.