Secure Score grades your settings. We show you the way in.
Secure Score measures how much of Microsoft's recommended configuration you have adopted. It cannot see outside your tenant, it does not cover Azure, and it ranks by points rather than by what an attacker would reach first. Every claim on this page is sourced.
The short answer
Secure Score is a configuration checklist with a score on top. It is free, it is from Microsoft, and it is worth opening today. But there are three things it structurally cannot tell you, and each of them is how small businesses actually get breached.
01 — Blind outside the tenant
Remote desktop open to the internet does not move a Secure Score.
Nor does an expired certificate, or a forgotten subdomain still answering on port 3389. None of these are tenant settings, so none of them are scored. Microsoft sells this separately as Defender External Attack Surface Management, billed per asset per day. Ours is free, and needs no access to your tenant at all.
02 — Microsoft 365 only
Your Azure storage account is not in the score.
Secure Score covers Microsoft 365 identities, apps and devices. Azure resources — public storage, over-permissive roles, exposed databases — live in Defender for Cloud, a different product in a different portal. Attackers do not respect that boundary, and neither do we: both are covered by one read-only connection.
03 — Points, not paths
A 10-point action and the way an attacker gets in are not the same thing.
Secure Score ranks by the points Microsoft assigns each recommendation. It does not know which three of your findings chain into a working route to a global admin. We rank by that — so the top of our list is the fix that closes the most paths, not the one worth the most points.
What matching this looks like
Three products. Three portals. Still no prioritised list.
To cover the same ground with Microsoft’s own tools you would run Secure Score for Microsoft 365, Defender for Cloud for Azure, and Defender EASM for internet-facing exposure — each in its own portal, each with its own permissions, and EASM billed per asset per day.
Then you would still be the one deciding which of the three lists to act on first, and which findings across them add up to a real way in. That last part is the job. It is the part we do.
Side by side
Where the two actually differ.
| Dimension | Microsoft Secure Score | Tenant Strike |
|---|---|---|
| What it tells you to do first | Recommended actions, ranked by the points Microsoft assigns each one | Findings ranked by what an attacker reaches first, and which single fix breaks a whole chain |
| Internet-facing exposure | Not covered. Microsoft sells this as Defender EASM, billed per asset per day | Included — and the external scan needs no access to your tenant at all |
| Azure resources | Not covered. That is Microsoft Defender for Cloud, a different product in a different portal | Included, through the built-in read-only Reader role |
| Portals to check | Three, to cover the same ground: Defender, Defender for Cloud, EASM | One |
| How a fix is described | The setting to change, written for someone who already knows why | What it means, what an attacker does with it, the exact portal path, and what breaks |
| Can you hand it to someone | It lives in the Defender portal, behind a Microsoft Entra role | An exportable report for a client, an insurer, or a board |
| Access it needs | A Microsoft Entra role — Security Reader or Global Reader to view | 19 read-only Graph scopes. No write scope exists in the app registration |
| Cost | Free with your Microsoft subscription | Paid, after a free trial |
To be clear about Secure Score: it is free, it comes from the vendor who knows these products best, and it benchmarks you against similar organisations, which we do not. Open it today, before you buy anything from anyone. Every claim we make about it here comes from Microsoft’s own documentation — including Microsoft’s own note that its recommendations “don’t cover all the attack surfaces associated with each product” and that the score “isn’t an absolute measurement of how likely your system or data could be breached”. If you think we have any of it wrong, tell us and we will fix it.
Common questions
Asked often enough to answer here.
- Is Microsoft Secure Score enough on its own?
- It depends who is reading it. If you have someone whose job is security and you only care about Microsoft 365 settings, it may well be. If you do not, it is a list of recommendations nobody actions — and it still cannot see your internet-facing exposure or your Azure resources.
- Does Microsoft Secure Score cover Azure?
- No. Secure Score in the Defender portal covers Microsoft 365 identities, apps and devices. Azure resource posture — storage, networking, databases, servers — sits in Microsoft Defender for Cloud, a separate product in a separate portal. Tenant Strike covers both from one read-only connection.
- Does Secure Score show what is exposed to the internet?
- No. It reads configuration inside your tenant, so open remote desktop, an expired certificate or a forgotten subdomain never appear in it. Microsoft sells that as Defender External Attack Surface Management, billed per asset per day. Our external scan is free and needs no tenant access.
- Why not just use the free Microsoft tools?
- You can, and you should open Secure Score today. Matching this product's scope means running three Microsoft products across three portals, one billed per asset per day, and doing the prioritising yourself. That is a reasonable trade if you have the time and the expertise. Most small teams have neither.
- Why is my Secure Score good when Tenant Strike found something critical?
- Because they measure different things. Secure Score counts how many recommended controls you have adopted. We weight findings by what an attacker could chain together. Microsoft is explicit that Secure Score "isn't an absolute measurement of how likely your system or data could be breached" — a high score and a live attack path can coexist.
- Should I turn Secure Score off?
- No. It is free, it comes from the vendor, and it benchmarks you against similar organisations — something we do not do. Keep it. The question is not which score to trust, but whether anything is watching the three things Secure Score structurally cannot see.
Find out in ten seconds
Your Secure Score can’t see this. Neither can you, yet.
The external scan reads what the internet already publishes about your domain — no signup, no tenant access, about ten seconds. If it comes back clean, you have lost nothing. The full 140+ checks need read-only consent and nothing more.