Microsoft 365 Secure Score: which actions an SME should take first

What Secure Score is and is not

Secure Score counts improvement actions Microsoft sees in your tenant: whether MFA is on, whether legacy authentication is still allowed, whether shared mailboxes and guest access are tighter, whether device and application controls are missing. Each open action has an estimated score contribution. That helps you see where you still gain — it does not automatically mean “do everything now” or “your company is unsafe because you are not at 100%”.

It is also not an audit certificate. A high score with a weak leaver process or shared passwords on info@ remains risky. Conversely: a mid-range score with MFA, clean admins and a joiner/leaver checklist is often healthier than chasing points that do not apply to your SME. See also turning on MFA in Microsoft 365 and admin accounts.

Why an SME should prioritise — not maximise

Three practical reasons. Focus: without a filter you drown in dozens of recommendations, some of which assume enterprise licences or scenarios you do not have. Identity first: most SME incidents start with accounts, not exotic Defender modules — so MFA, legacy authentication and inactive accounts belong at the top. Governance: the director wants “what do we do this quarter?”, not “we are at 62”. Secure Score is useful when you tie a quarterly choice to it.

Licences and product names in the score depend on what you actually buy (Microsoft 365 Business, optional Defender components). Floor ICT checks per action whether it fits your tenant and licences before we flip switches — no generic “everything green” promise.

Which actions you usually take first

In many small and medium-sized enterprises (SMEs) this order is sensible — adapt to your situation:

• enforce multifactor authentication for users (and think separately about admins);
• turn off legacy authentication (basic authentication) where it is still open — see legacy authentication;
• limit admin roles, separate admin accounts, keep break-glass deliberate;
• clean up or bound inactive accounts and guest accounts;
• turn on self-service password reset only when MFA and method policy are ready;
• set SharePoint and OneDrive external sharing deliberately — not “anyone may share everything”;
• only then: device compliance, app restrictions and deeper Defender recommendations that match your package.

Skip or defer actions that break a real work process (old multifunctionals, a supplier link) — but write the exception down, with an owner and an end date.

What you should decide in writing

Keep it short enough to decide this quarter:

• who may view Secure Score (usually the IT partner plus one internal owner — not the whole organisation);
• which top actions will happen this quarter (at most a handful);
• which recommendations you deliberately defer or reject, with a reason;
• that “score up” is not a key performance indicator without those choices;
• a link to joiner and leaver and to periodic account review;
• how you document exceptions (legacy devices, partners) and revisit them.

Write those points on one page. That is your Secure Score agreement; the tenant follows that text.

What Floor ICT configures — and what you decide

In the Microsoft 365 tenant we typically: inventory Secure Score and related improvement actions; prepare identity actions (MFA, legacy authentication, admins, guests, inactive accounts) and implement them after approval; make exceptions as narrow as possible technically; and give a short readout of “what is still open and why”. We filter recommendations that do not fit your licences or way of working.

You still decide: which risks you accept this quarter; whether an action may go live despite impact on an old device; and whether you want deeper device or Defender actions. Technical toggles without those choices raise the score and frustrate users; policy without execution does not help either.