Microsoft Secure Score: your score and what you can improve
The Microsoft Secure Score is Microsoft's rating for the security of your Microsoft 365 tenant. AlertControl shows your current score and the maximum, and with one click the improvements that earn the most points. For each improvement you see what it solves, what it means for users and where you set it up.
Updated 30 October 2026
How does the Secure Score work?
Microsoft awards points for security measures in your tenant, such as MFA, blocking legacy sign-in methods and settings in Exchange and SharePoint. The more measures you have taken, the higher the score. The score helps you decide what to do first; it is no guarantee that your tenant is secure.
What does AlertControl show?
Your current score and the maximum are at the top of the dashboard. Click it for the improvements: only measures that still earn points, sorted by the biggest gain. For each one you see the category, the service, the current and maximum points, the impact on users, the effort to implement it, the threats it protects against and Microsoft's explanation. A link takes you to the right place in Microsoft's portal.
What do you need?
The Secure Score is available in every Microsoft 365 tenant; no extra licence is needed. Which improvements Microsoft shows does depend on the services and licences you have.
Frequently asked questions
There is no fixed threshold. Microsoft also shows a comparison with similar organisations in the Defender portal. More important than the number is that you tackle the improvements with the biggest gain and the least impact first.
Microsoft regularly adds measures or adjusts the points. Then the maximum or your score changes without anything being changed in your tenant.
No, AlertControl only has read access. Each improvement has a link to the place where you set it up yourself, and the optional AI advice helps you decide what comes first.
See for yourself what is happening in your Microsoft 365?
Try AlertControl free for 30 days. You sign in with your Microsoft account and grant read-only consent once.