Updated 8 October 2026: Microsoft is retiring Restricted SharePoint Search, so this post now points to Restricted Content Discovery and SharePoint Advanced Management instead.
Why Microsoft Secure Score is the fastest signal Australian SMBs have
For Australian small and mid-sized businesses, Microsoft Secure Score is the single most accessible signal of Microsoft 365 tenant health. According to Microsoft Learn, the score is the proportion of points achieved across Identity, Data, Device, and Apps recommendations — surfaced inside the Microsoft Defender portal under Exposure management. The ACSC Cyber Security Guidance for Microsoft 365 (Australian Cyber Security Centre — system hardening and administration guidance, accessed 16 June 2026) directs Australian organisations to use Secure Score as a starting point for tenant hardening. Microsoft's pre-deployment guidance for Microsoft 365 Copilot does not set a single Secure Score number, but it does call for the identity and data-protection controls that Secure Score rewards most heavily — so EDUC4TE recommends treating around 65 percent as a working target before broad rollout. For an Australian SMB without a dedicated security team, that is a defensible figure to set in a board paper.
1. What Secure Score is — and what it is not
- What it is: A weighted, percentage-based score of how many recommended Microsoft 365 controls your tenant has implemented, surfaced in real time inside the Microsoft Defender portal.
- What it is not: A compliance certification, a vulnerability scanner, or a substitute for the ASD Essential Eight Maturity Model.
- Australian context: The ACSC explicitly references Secure Score as an indicator in its Cyber Security Guidance for Microsoft 365, but it is not equivalent to Essential Eight maturity evidence.
How the score is calculated
According to Microsoft Learn (Microsoft Secure Score documentation, updated April 2026), each recommended action carries a fixed point value. Your score is the percentage of available points your tenant currently achieves. Microsoft retires and adds recommendations as the product surface evolves — which means your score can drop without you changing anything, simply because Microsoft introduced a new control.
This matters operationally: a drop in Secure Score is not always a regression. Always read the change history before raising an incident.
2. Where Australian SMB tenants typically land
EDUC4TE's practitioner experience across Australian SMB tenants in the 50 to 1,000 licenced-user band shows a consistent distribution at first review:
- Under 40 percent: Foundational identity and data controls are missing. MFA gaps, no Conditional Access, legacy authentication still permitted, no DLP or sensitivity labels. This tenant is not ready for Microsoft 365 Copilot under any scenario.
- 40 to 60 percent: MFA mostly deployed, Defender for Office 365 partly configured, sensitivity labels piloted but not enforced. Most Australian SMBs sit here at first measurement.
- 60 to 80 percent: Conditional Access baseline policies live, legacy auth blocked, labels and DLP rolled out, SharePoint Advanced Management oversharing reports run and high-risk sites remediated. EDUC4TE treats this as the Copilot-ready band — it is where the data-protection controls Microsoft lists as Copilot pre-deployment steps are typically in place.
- Above 80 percent: Privileged Identity Management active, sign-in risk policies enforced, auto-labelling across SharePoint and OneDrive, Purview retention tuned. This tenant has effectively completed Essential Eight Maturity Level 2 evidence for the Microsoft-owned controls.
The ASD Information Security Manual (Guidelines for System Hardening, November 2025 update) (Australian Signals Directorate — Information Security Manual, accessed 16 June 2026) describes the same continuum in framework language: identity hardening first, then data, then tenant configuration.
3. The Australian-specific Secure Score recommendations that pay off first
Not all Secure Score recommendations are equal weight for an Australian SMB. The following five almost always pay back the implementation effort within one sprint:
1. Require MFA for all users
- Why it matters: Essential Eight Control 7 baseline. Closes the most common breach vector in NDB notifications under the Privacy Act 1988.
- Microsoft Learn reference: Conditional Access policy templates (Microsoft Learn — Entra Conditional Access overview, accessed 16 June 2026) — "Require multifactor authentication for all users" (Microsoft Entra documentation, current May 2026).
- Effort: Under one hour for a tenant with under 250 users using the Conditional Access policy template.
2. Block legacy authentication
- Why it matters: Legacy protocols (POP, IMAP, SMTP AUTH, older Office clients) bypass MFA entirely. The ACSC and Microsoft both identify credential abuse over legacy authentication as a leading initial-access pattern against Australian organisations.
- Microsoft Learn reference: "Block legacy authentication" Conditional Access template.
- Effort: Plan in report-only mode for two weeks, then enforce.
3. Enable Defender for Office 365 preset security policies (Standard)
- Why it matters: Anti-phishing, anti-malware, safe links, and safe attachments configured to Microsoft-recommended baselines without manual policy authoring. Microsoft published Standard and Strict preset policies as the recommended starting point for SMBs (Microsoft Learn, preset security policies, current 2026).
- Effort: Under thirty minutes for tenant-wide Standard preset deployment.
4. Deploy sensitivity labels with a default
- Why it matters: Purview Content Explorer cannot show you what data lives where until labels are applied. ASD ISM Data Handling guidelines and the OAIC's Australian Privacy Principles guidance (Office of the Australian Information Commissioner — Australian Privacy Principles, accessed 16 June 2026) both call for organisations to know what personal and sensitive information they hold.
- Microsoft Learn reference: "Get started with sensitivity labels" (Purview documentation).
- Effort: Two to three days to author labels, then phased auto-labelling over four to six weeks.
5. Run SharePoint oversharing reports and apply Restricted Content Discovery where appropriate
- Why it matters: SharePoint Advanced Management data access governance reports show which sites are overshared (site permissions, sharing links, "Everyone except external users"). Restricted Content Discovery then keeps a high-risk site's content out of organisation-wide search and Copilot responses while its access is fixed, without changing permissions (Microsoft Learn — Restricted Content Discovery, accessed 8 October 2026). It is a temporary control, and excessive use reduces the completeness of Copilot answers.
- Effort: Under one hour to run the reports and apply the setting. The work is deciding which sites need it and fixing their access — that is the consulting engagement.
Restricted SharePoint Search, which this post originally recommended here, is retiring and new enablement has been blocked since 31 July 2026. The companion article Restricted SharePoint Search is retiring: what Australian tenants should do explains what tenants that already enabled it should do.
4. Mapping Secure Score to ACSC Essential Eight Maturity Level 2
A common SMB question: "If we hit our Secure Score target, are we Essential Eight compliant?" The honest answer is — partly, and only for the Microsoft-owned controls. The ACSC Essential Eight Maturity Model (Australian Cyber Security Centre — Essential Eight Maturity Model, accessed 16 June 2026) is a tenant-and-endpoint framework. Secure Score scores the tenant.
The overlap is real and useful:
| Essential Eight Control | Equivalent Secure Score recommendation |
|---|---|
| Multi-factor authentication (ML1–ML3) | "Require MFA for all users", "Require MFA for admins", Conditional Access risk-based MFA |
| Restrict administrative privileges (ML2) | "Use Privileged Identity Management", "Limit Global Administrator count" |
| Patch applications (ML1–ML2) | Defender Vulnerability Management — application patching insights |
| Patch operating systems (ML1–ML2) | Intune device compliance signals piped into Secure Score |
| Microsoft Office macro settings (ML1–ML3) | "Configure Microsoft Office macro settings" via Intune policies |
| Application control (ML2–ML3) | Limited Secure Score coverage — primarily endpoint, not tenant |
| User application hardening (ML1–ML3) | Defender for Office 365 safe links and safe attachments |
| Regular backups (ML1–ML3) | Not directly scored — handled via Microsoft 365 Backup separately |
For the controls Secure Score does not measure (application control, regular backups), Australian SMBs should look to the ACSC Essential Eight Assessment Guidance directly. EDUC4TE's Essential Eight Assessment covers that delta.
5. A quarterly Secure Score review playbook
The ACSC Cyber Security Guidance for Microsoft 365 directs organisations to review Microsoft 365 security posture at least quarterly. A repeatable Secure Score review is the cheapest way to satisfy that direction.
Step 1: Pull current score and trend (10 minutes)
In the Microsoft Defender portal, navigate to Exposure management → Secure Score. Capture:
- Current percentage
- 30-day trend (up or down)
- Top five recommended actions by point value
- Any "Status changed" entries in the change history (these are the false-regression catches)
Step 2: Filter for Identity recommendations first (15 minutes)
Sort recommendations by category. Identity changes always pay back first for SMBs.
# Quick check of MFA coverage via Microsoft Graph PowerShell
Connect-MgGraph -Scopes "AuditLog.Read.All","Reports.Read.All"
Get-MgReportAuthenticationMethodUserRegistrationDetail -All |
Where-Object { $_.IsMfaCapable -eq $false } |
Select-Object UserDisplayName, UserPrincipalName, IsMfaRegistered
This identifies licenced users without MFA registered — the most common Secure Score-blocking gap.
Step 3: Sort remaining recommendations by points-per-effort (15 minutes)
For each remaining recommendation, score it 1–3 on effort and 1–3 on points achievable. Take the top three points-per-effort actions into the sprint.
Step 4: Implement and document (variable)
Implement the chosen actions. Save before-and-after screenshots of Secure Score for your evidence pack — this is what ACSC Essential Eight ML2 audit reviewers ask for.
Step 5: Recompute and report (10 minutes)
Quarterly board-friendly summary:
- Score moved from X percent to Y percent
- Top control improvements made
- Top three residual risks ranked by Microsoft point value
- Decision required from leadership (typically: budget for the next set of actions)
6. Common Australian SMB pitfalls
- Pitfall: Treating Secure Score as a target instead of an indicator. The score is a signal, not the outcome. A tenant at 70 percent with no functioning incident response process is still exposed. Industry breach studies consistently show that breaches take many months to identify and contain — process maturity is what closes that gap, not Secure Score.
- Pitfall: Chasing high-value Microsoft recommendations that do not apply. Some recommendations require Microsoft 365 E5 licensing. Dismiss them in-product rather than letting them drag your achievable-points denominator.
- Pitfall: Ignoring change history. Score drops after a Microsoft retirement event will be misread as a tenant regression unless you check the change history.
- Pitfall: No documented Conditional Access exclusion register. Every Secure Score MFA gap eventually traces back to a service account or break-glass account excluded without governance.
- Pitfall: Applying Restricted Content Discovery without a plan to fix the underlying access. It is a temporary control — the permissions review and site access reviews still have to happen, and the setting should then be removed.
7. Before and after — a real Australian SMB pattern
Before a baseline Secure Score programme (typical 250-user Australian SMB tenant):
- Secure Score: 36 percent
- MFA coverage: 71 percent of licenced users
- Legacy authentication: permitted
- Conditional Access: not configured (Security Defaults only)
- Sensitivity labels: never deployed
- DLP: not configured
- SharePoint Advanced Management oversharing reports: not run
- Copilot for Microsoft 365: not safe to roll out
After one quarter of focused remediation:
- Secure Score: 68 percent (above the ~65 percent working target for Copilot rollout)
- MFA coverage: 99.4 percent (only documented break-glass exempt)
- Legacy authentication: blocked tenant-wide
- Conditional Access baseline policies: live (MFA for all, MFA for admins, block legacy auth, require compliant device for admin portals)
- Sensitivity labels: three labels published, default applied
- DLP: Australian PII (TFN, Medicare, credit card) policies in Test mode
- SharePoint Advanced Management oversharing reports: run, with Restricted Content Discovery on high-risk sites while access is fixed
- Copilot for Microsoft 365: cleared for pilot deployment to 50 users
Industry breach reporting consistently associates stronger identity hygiene — the controls Secure Score measures most heavily — with materially fewer identity-based compromises. That direction of travel is what an Australian SMB board paper needs to see.
8. Compliance alignment for Australian organisations
Privacy Act 1988, Australian Privacy Principle 11 (Security of personal information):
APP 11 requires organisations to take "reasonable steps" to protect personal information. The OAIC's published guidance treats up-to-date access controls, encryption, and incident response as core to that test. Documented Microsoft Secure Score remediation history is direct evidence of those reasonable steps.
Notifiable Data Breaches scheme:
Under the NDB scheme (Office of the Australian Information Commissioner — Notifiable Data Breaches scheme, accessed 16 June 2026), an organisation that suspects an eligible data breach must assess it within 30 days, and notify the OAIC and affected individuals as soon as practicable once it forms the view that an eligible breach has occurred. A tenant with poor identity hygiene increases both the likelihood of an eligible breach occurring and the likelihood it is detected too late to contain quickly.
ASD ISM:
The Guidelines for System Hardening (ISM, November 2025 update) require Microsoft Office macro settings to be hardened — directly measured by Secure Score. The Guidelines for Personnel Security require privileged access management — directly measured by Secure Score's PIM recommendation.
ACSC Essential Eight ML2:
Secure Score is the most efficient evidence-collection tool for the Microsoft-owned ML2 controls. Capture point-in-time screenshots quarterly as part of the evidence pack.
9. Where to start this week
If your tenant has never had a structured Secure Score review, the cheapest first move is to take the free EDUC4TE Microsoft 365 Health Check. It scores 15 questions across identity, data, and tenant configuration and maps the answers to specific Microsoft admin centre paths — five minutes, no licensing required.
For organisations that already know they have a gap and want a practitioner walkthrough of their actual tenant, the AI-Ready Microsoft 365 Health Check is a fixed-price two-to-three-week engagement that produces a Top-10 fix list and a Copilot-readiness roadmap. The companion how-to How to run a Microsoft 365 health check in 60 minutes walks you through the self-directed version.
Call to action
Microsoft Secure Score is the cheapest tenant-health metric an Australian SMB can act on. Read it monthly. Act on it quarterly. Tie every quarterly review to ACSC Essential Eight ML2 evidence. The work counts twice — once toward Copilot readiness, once toward Privacy Act "reasonable steps".
Next steps:
- Run the free Microsoft 365 Health Check for your tenant
- Read the companion guide How to run a Microsoft 365 health check in 60 minutes
- Read Restricted SharePoint Search is retiring: what Australian tenants should do before broad Copilot rollout
- Enrol in the Microsoft 365 Security Hardening Course
Sources referenced in this article: ACSC Cyber Security Guidance for Microsoft 365, ACSC Essential Eight Maturity Model, ASD Information Security Manual, OAIC Australian Privacy Principles guidance, Notifiable Data Breaches scheme (OAIC), Microsoft Entra Conditional Access policy templates, Microsoft Learn Restricted Content Discovery, Microsoft Learn (Microsoft Secure Score documentation), Microsoft Learn (preset security policies), Microsoft Learn (Get started with sensitivity labels / Purview).
