Security score
One number for your organization's security posture - Microsoft Secure Score side by side with what 1Security actually observes in your tenant, with the shortest path to improving both.
Security score
The Security score screen answers the question every board asks and every admin dreads: "How secure are we - in one number, and compared to whom?" It shows three figures side by side: Microsoft Secure Score exactly as the Defender portal reports it, the 1Security score measured from what actually happens in your tenant, and a combined headline.
What You Can Achieve
See both halves of the truth
Microsoft scores what you configured. 1Security scores what is actually happening - sensitive data actually reachable, agents actually ungoverned, accounts actually dormant. The gap between the two is where incidents live.
Make 5 minutes count
Every control shows the points still on the table. The 'If you only have 5 minutes' shortlist ranks them, so even the shortest security session starts with the highest-value fix.
Compare against organizations like yours
Microsoft's comparative averages - all tenants, your size band, your industry - come with the score. You see at a glance whether you are ahead of or behind your peers.
Prove the trend
Ninety days of daily history for both halves, plus the count of remediation actions applied - the improvement and the work behind it, on one card.
Two providers, one worklist
Every control - Microsoft's and 1Security's - lands in one list, sorted by the points you can still gain. Microsoft controls carry Microsoft's own remediation text, tier, rank, threat tags and a deep link into the Defender portal. 1Security controls carry the measured evidence behind the verdict ("14 of 92 agents have no accountable owner") and a link to the exact screen in 1Security where the finding is acted on.
Where both providers measure the same fact - device compliance, dormant accounts, label protection - they are deliberately kept as two controls. A policy that is configured but not covering real sign-ins is precisely the insight a single merged number would hide.
Categories Microsoft doesn't have
The 1Security half adds the categories Secure Score has no coverage for at all: AI & agents (accountable owners, captured instructions, reach into restricted data), observed data exposure (restricted types actually reachable, outbound sharing going to free consumer mailboxes) and monitoring & response (ingestion freshness, unhandled critical anomalies, untriaged Defender alerts).
Waiving a control
A control that genuinely does not apply - a device control in a cloud-only organization, say - can be waived with a note. Waived controls leave the possible total entirely, the same semantics Microsoft uses for "ignored" controls, and the note stays on record. The measured score itself is never editable: only its standing is.
Framework impact
1Security controls cite the compliance articles their measurement satisfies - fix a control and the screen shows which ISO 27001, NIS2 or EU AI Act articles move with it. The Compliance screen shows the same measurements from the framework side.
Getting the Microsoft half
The 1Security half works from the data you already share. The Microsoft half
needs one optional read-only permission (SecurityEvents.Read.All), granted
from the Integrations screen with a single
re-consent - no new app registration. Until it is granted, the screen simply
shows the 1Security half alone.
The score is also available programmatically: GET /security-score on the
REST API and the get_security_score
MCP tool, both under the evidence:read scope.
Compliance
See exactly which regulations you're ready for, which requirements are holding you back, and prove it with a dated evidence pack - without re-mapping the same control for every framework by hand.
Devices
See every device touching your data - including the ones Microsoft never told you about - and answer whether your information is being accessed from machines you don't control.