How to Read Your Microsoft Secure Score Dashboard (Australian SMB Guide)

Your Microsoft Secure Score tells you, in a single percentage, how much of Microsoft's recommended security configuration you have implemented — and every point you have not yet earned is a gap that an attacker could exploit.

For Australian small and medium businesses (SMBs), the dashboard can feel overwhelming at first. There are dozens of improvement actions, multiple comparison views, and metrics that shift daily. This guide walks you through every section of the Secure Score dashboard in the order you should read it, so you finish with a prioritised action list rather than a number you do not know what to do with.

Before diving in, if you want an expert set of eyes on your full Microsoft 365 posture, our Free Microsoft 365 Health Check covers Secure Score alongside identity, data, and device configuration in a single session.

Where to find Microsoft Secure Score

Microsoft Secure Score lives in the Microsoft Defender portal, not the Microsoft 365 admin centre.

1. Sign in at security.microsoft.com with a Global Administrator, Security Administrator, or Security Reader account.
2. In the left navigation, select Secure Score under the Exposure management section.
3. You land on the Overview tab.

If you cannot see Secure Score, your account does not have sufficient permissions, or your tenant is not yet provisioned with Microsoft Defender for Office 365. A Global Administrator can grant you the Security Reader role in Microsoft Entra ID.

Step 1 — Understand what your score actually measures

The overview tab shows three numbers:

• Your score — the points you have earned divided by the maximum points available in your tenant, expressed as a percentage.
• Points achieved — the raw numerator (for example, 342 points).
• Maximum score — the raw denominator (for example, 718 points available).

The maximum score is specific to your tenant. It is calculated from the Microsoft 365 licences you hold and the products you have deployed. A tenant with Microsoft 365 Business Basic has fewer improvement actions — and therefore a lower maximum — than a tenant with Microsoft 365 Business Premium and Microsoft Defender for Endpoint. This is intentional: you are only scored on capabilities you can actually use.

Key insight: A Business Basic tenant with a 72 percent score is not necessarily more secure than a Business Premium tenant with a 58 percent score. Context matters. For a fuller explanation of how the score is calculated and what it means for Australian organisations, read our pillar guide to Microsoft Secure Score.

Step 2 — Read the score breakdown by category

Below the headline numbers, the overview tab breaks your score into categories:

Most Australian SMBs score lowest in Identity and Devices — these are also where the highest-impact controls live. Prioritise these categories before moving to Apps and Data.

Step 3 — Work through the Recommended Actions tab

Select the Recommended Actions tab. This is your working list. Each row shows:

• Action name — a plain-language description of the setting to change.
• Points — how many Secure Score points this action is worth.
• Score impact — the percentage point increase you would see if you completed this action.
• Status — Not started, Partially completed, Completed, Risk accepted, Resolved through third party, or Planned.
• Implementation — a tag indicating whether the action is completed via Microsoft settings, Intune, or requires a third-party tool.
• User impact — Low, Medium, or High. This tells you how much end-user disruption to expect.

How to prioritise improvement actions

Use these filters to cut the list down to manageable size:

1. Filter by Category: Identity — these actions protect every user account in your organisation.
2. Sort by Score impact descending — highest-value actions rise to the top.
3. Look for User impact: Low — these are configuration changes that users will not notice.

Start with high-score-impact actions that have low user impact. You can harden your tenant significantly without touching the end-user experience at all.

Step 4 — Read an individual improvement action before acting

Never implement an action without clicking through to its detail page first. Each action page contains:

• What is this? — A plain-language explanation of the control and why it matters.
• How does this action work? — The technical mechanism (for example, this action enables an Entra ID Conditional Access policy).
• How to implement — Step-by-step configuration instructions with direct links to the relevant admin portal.
• Dependencies — Licences or other settings that must be in place first.
• Evidence collected — What signals Microsoft uses to calculate whether the action is complete.
• Related regulations — Compliance frameworks the action supports (GDPR appears most often, but the principles apply equally to the Australian Privacy Act 1988).

Read the "Evidence collected" section carefully. Some actions require the setting to be applied to 100 percent of users before awarding full points. Others award partial points based on coverage percentage. If you have exemptions — such as break-glass accounts excluded from MFA — understand how those exemptions affect your score before implementing.

Step 5 — Use the Comparison tab to calibrate your targets

Select the Comparison tab. Microsoft shows two comparisons:

• Similar organisations — Organisations with a similar number of licences, industry vertical, and region. This is the most useful benchmark for Australian SMBs.
• Global average — The average Secure Score across all Microsoft 365 tenants worldwide.

Use the similar-organisations line to set a 90-day target. If your current score is 38 percent and similar organisations average 52 percent, a realistic first target is 50 percent. Aim to reach similar-organisation average within the first quarter, then push toward the top quartile in subsequent quarters.

Step 6 — Understand what Secure Score does not cover

Secure Score measures Microsoft configuration settings. It does not measure:

• Whether your staff can recognise a phishing email (security awareness training)
• Whether your backups are tested and restorable
• Whether your suppliers and managed service providers have appropriate security controls
• Whether you have an incident response plan
• Physical security of devices and premises

This is why Australian SMBs should use Secure Score as a starting point, not an endpoint. A high Secure Score combined with undertrained staff and untested backups is still a significant risk. For a holistic view of your Microsoft 365 environment, start with a Microsoft 365 Health Check that covers both technical controls and operational readiness.

Step 7 — Track progress over time using History

Select the History tab. This shows a time-series chart of your Secure Score alongside a log of which actions moved your score up or down and when.

Use the History tab to:

• Confirm that remediation actions took effect — If you enabled MFA for all users yesterday, the score should reflect this within 24 to 48 hours.
• Investigate unexpected score drops — A score decline means a control was removed or a new action became available. The log shows you exactly which action changed.
• Demonstrate progress to leadership — Export the history data to share with your board or cyber insurance provider as evidence of ongoing security improvement.

A practical 30-minute review routine

Once you have completed your initial review, keep the dashboard working for you with a monthly 30-minute routine:

1. Open the Overview tab and note your current score.
2. Check the History tab for any score changes since last month and investigate drops.
3. Switch to Recommended Actions, filter to Status: Not started, sort by Score impact descending.
4. Select three to five actions to implement this month based on effort and user impact.
5. Assign each action to a team member with a due date (outside the Secure Score dashboard — use your project tracking tool).
6. Return at month end to confirm actions are reflected in the score.

Consistency matters more than speed. A steady 2 to 3 percentage point improvement each month compounds into a significantly hardened environment within a year.

Mapping Secure Score improvements to the ACSC Essential Eight

Several high-value Secure Score actions map directly to ACSC Essential Eight controls. When you prioritise these, you earn Secure Score points and advance your Essential Eight maturity simultaneously:

If your organisation is working toward Essential Eight Maturity Level 2, use this mapping to sequence your Secure Score actions in the order that also advances your Essential Eight posture.

Common mistakes Australian SMBs make when reading Secure Score

Chasing 100 percent. The highest scores require enterprise features that may not be appropriate for an SMB. A score in the 70 to 80 percent range for a Business Premium tenant reflects a genuinely hardened environment.

Implementing actions without testing. Blocking legacy authentication will break older printers, scanners, and applications that use basic auth. Test in a pilot group before applying tenant-wide.

Ignoring the user impact rating. Actions rated High user impact require a change management plan — communicate to staff before enabling, not after.

Treating Secure Score as a compliance certificate. Secure Score is a posture indicator, not an audit outcome. Regulators and cyber insurers will want to see the underlying evidence, not just the score.

Next steps

Reading the dashboard is the first step. Acting on what it tells you is where the security improvement happens. If you would like expert guidance on interpreting your specific score, prioritising the right actions for your industry and risk profile, and confirming your configuration is correct, book a Microsoft 365 Health Check with our team.

For a deeper understanding of what the score means and how it fits into a broader Microsoft 365 security strategy, our pillar guide to Microsoft Secure Score for Australian SMBs covers the strategic context in full.