Microsoft 365 security score
Your security score went up last month. Did your tenant get safer?
Microsoft Secure Score rates what you configured, and 1Security shows it exactly as the Defender portal reports it - guidance, peer averages and deep links included. Next to it sits a second score, measured from what actually happens: sensitive data actually reachable, agents without an accountable owner, accounts dormant for months, sign-ins outside every policy. Both halves land in one worklist ranked by the points still on the table, with ninety days of history to prove the trend.
- 2 scoresconfiguration as Microsoft rates it, reality as 1Security measures it
- 90 daysof daily history for both halves, with remediation actions counted alongside
- 5 minthe shortlist: the highest-value fixes if that is all the time you have
The problem
Configuration is one half of the truth. Activity is the other.
Ask for a Microsoft 365 security score today and you get a well-built answer about configuration: Secure Score checks which recommended settings are on, weights them by impact, and attaches remediation guidance written by the people who build the products. That number is genuinely useful, and 1Security shows it untouched, deep links and all.
What no configuration check can see is behavior. A Conditional Access policy earns its points the day it is switched on - whether real sign-ins actually pass through it is a different fact, and it changes with every hire, every guest and every new app. Data works the same way: a tenant can carry a strong score while payment-card files sit reachable by half the company.
So the board hears a number that answers "what did we configure" and takes it as "how secure are we". The distance between those two questions is where incidents start, and it never shows up in a number built from settings alone.
What you get
Both halves of the truth, on one page.
Every control - Microsoft's and 1Security's - lands in the same list, keeps its own evidence, and links to the place where it gets fixed.
Secure Score, verbatim
Microsoft Secure Score exactly as the Defender portal reports it: score, tier, rank, threat tags, Microsoft's own remediation text and a deep link to the setting. No re-scoring, no editorializing - the Microsoft half stays Microsoft's.
A second score, measured
The 1Security half is computed from observed facts: restricted data actually reachable, agents actually lacking an accountable owner, accounts actually dormant, sign-ins actually outside coverage. Every verdict carries its evidence, not a checkbox.
Two controls per fact, on purpose
Where both providers measure the same thing - device compliance, dormant accounts, label protection - they stay separate. A policy that is configured but not covering real sign-ins is precisely the insight one merged number would hide.
One worklist, ranked by points
Controls from both halves sort by the points still on the table, with the "if you only have 5 minutes" shortlist on top. Microsoft controls deep-link into the Defender portal; 1Security controls link to the exact screen where the finding is acted on.
Categories no configuration score carries
AI & agents, observed data exposure, monitoring & response: accountable owners, restricted types actually reachable, outbound sharing to consumer mailboxes, ingestion freshness, unhandled critical anomalies. Measured by 1Security, absent from any settings checklist.
Waivers, peers and history
A control that genuinely does not apply is waived with a note and leaves the possible total - the note stays on record, and the measured value itself is never editable. Microsoft's comparative averages place you against your size band and industry; ninety days of daily history show the trend.
How deep it goes
From one number to the next fix, without leaving the page.
Board preparation, worked end to end - the loop the screen was built for.
Open the screen on Monday and three figures sit side by side: Secure Score as the Defender portal reports it, the score 1Security measured from your tenant, and the combined headline. Under them, the comparison Microsoft publishes for all tenants, your size band and your industry - so "are we behind our peers" is read off the page, not estimated.
Then the worklist. A Microsoft control - block legacy authentication, say - carries Microsoft's own remediation text and a portal deep link. Right under it, a 1Security control carries its measured evidence: "14 of 92 agents have no accountable owner", one click from the agents screen where the owners get assigned. Both are ranked by the points they would return.
Fixing a 1Security control moves more than the score: each one cites the ISO 27001, NIS2 or EU AI Act articles its measurement satisfies, so the same fix advances the compliance picture. What does not apply is waived with a note that stays on record - the standing changes, the measurement never does.
In practice
Four steps to a defensible number.
The Microsoft half is optional and takes one consent to unlock.
- 01
Grant one optional permission
The 1Security half works from data the platform already collects. The Microsoft half needs a single read-only permission (SecurityEvents.Read.All), granted with one re-consent from the Integrations screen - no new app registration. Until then, the measured half stands alone.
- 02
Read the three figures
Secure Score verbatim, the measured score, and the combined headline - with Microsoft's peer averages for all tenants, your size band and your industry next to them.
- 03
Work the five-minute shortlist
The worklist ranks every control by points still on the table. Follow the deep link - into the Defender portal for Microsoft controls, into the exact 1Security screen for measured ones - and close the highest-value gap first.
- 04
Track it, and hand it over
Ninety days of daily history for both halves, with remediation actions counted alongside. The same score is served over the REST API and MCP, so the board pack and the quarterly review pull the number instead of screenshotting it.
The difference
What the measured half adds over Secure Score alone
The Microsoft half is kept exactly as Microsoft publishes it. Everything below is what the page adds around it.
- A second score computed from observed behavior, not configuration state
- The same fact scored twice on purpose - configured and observed, never merged
- One worklist across both providers, ranked by points still on the table
- The "if you only have 5 minutes" shortlist for the shortest security session
- AI & agents, observed data exposure and monitoring & response as scored categories
- Measured evidence on every 1Security control - counts, not checkboxes
- Compliance cross-references: each control names the ISO 27001, NIS2 and EU AI Act articles it moves
- Waive with a note, keep the record - and ninety days of daily history for both halves
- The score over REST and MCP: GET /security-score under the evidence:read scope
Setup and scope
One optional permission, standard licenses, kept honest.
The measured half requires no premium Microsoft licensing - it is computed from the data 1Security already collects read-only. The Microsoft half arrives with whatever Secure Score your tenant already has, unlocked by a single optional read-only permission. Nothing on the page is editable except a control's standing: active, or waived with a note that stays on record.
- 1 consentread-only SecurityEvents.Read.All unlocks the Microsoft half - no new app registration
- 3 categoriesof our own: AI & agents, observed data exposure, monitoring & response
- 90 daysof daily history for both halves, remediation actions counted alongside
Related
Where this fits
The score is the summary. The three pages below are where its points come from - and where they get fixed.
Compliance
The same measurements read from the framework side - eleven regulations evaluated from one requirement set.
See compliance →Remediation automation
Points on the table become staged actions with review windows and a recorded trail.
See remediation →Anomaly detection
Unhandled critical anomalies are one of the monitoring controls - this is where they come from.
See anomalies →
The 1Security platform
Security score is just the beginning
Security score is one screen of the 1Security platform for Microsoft 365. Locations, devices, apps, AI agents, logs, permissions, sensitive data, compliance, reports and actions run on the same read-only connection, on the licence you already have.
- Sensitivity labelsLabel coverage and gaps across sites and files, so the protection the client paid for is actually applied.
- Files, sites and the column browserBrowse the tenant like a file system: site, library, folder, file, with the permissions and sensitivity of each level beside it. A problem solved in itself.
- Users, groups and lifecycleDormant accounts, guests who never left, groups nested three deep, orphaned owners, admins without MFA. The review that is a spreadsheet everywhere else.
- External domainsEvery outside organization with a foothold in the tenant, its trust posture, its drift, and who it was invited by.
- Email and mailboxesWho can read whose mailbox, forwarding rules, threads with sensitive content, inbound and outbound exposure.
- LicencesWhat is assigned, what is unused, and which bundle an action or feature still needs, so the upgrade you sell is the one the client needs.
- Microsoft 365 Alerts ToolOne alert model across policies, activity and anomalies - with the evidence attached and the alert threshold in your hands.
- Microsoft 365 Monitoring ToolReal-time monitoring that catches a mass download while it is unfolding - across users, files, apps, AI agents and devices.
- Copilot Security ToolEvery AI agent's real blast radius - quantified before rollout, watched and constrained after.
- Shadow Device DetectionEvery device touching your data, reconstructed from real activity - including the machines that never enrolled anywhere.
- Impossible Travel DetectionLocations as identities, not IPs: country, city and network for every action, first-seen origins, travel timelines with verdicts - no E5, no P2.
- Conditional Access MonitoringDeclared Conditional Access compared against observed sign-ins: coverage verdicts, ungoverned traffic share, and the ranges your offices outgrew.
- Office 365 Access ManagementEffective access, resolved - who can reach what, through which grant, and one place to take it away.
- SharePoint Governance ToolEvery site ranked by exposure and abandonment - links, guests and Copilot access under control.
- Office 365 User ProvisioningLifecycle access from day one to offboarding - reach, dormant accounts and license reclaim in one flow.
- Microsoft 365 Audit ToolUp to three years of searchable activity history - every action tied to an actor, device and location.
- Microsoft 365 Inventory ToolEight live inventories on one permission graph - including the sites, devices and AI agents that were never registered anywhere.
- Office 365 ReportingAnswers, not exports - regulator-grade numbers, saved views and a read-only API for your SOC.
- Microsoft 365 File PermissionsWho has access to any file, and why - people, links, apps and AI agents on one map, with the fix in the same place.
- Sensitive Data DiscoveryWhere regulated data lives and everything that can reach it - two detection engines, no premium licence required.
- Office 365 Email MonitoringOutbound sensitive content, delegated-send abuse and whole-thread evidence that survives deletion.
- Purview Label CoverageWhat your sensitivity labels actually cover, and which of them protect anything at all.
- AI Agent InventoryEvery agent in the tenant with its real reach counted, its blueprint reviewed, and guardrails you can verify.
- AI Data RestrictionDeclare a data type off-limits to AI and every agent, app and user still reaching it becomes a live violation - recorded for the auditor.
- AI Spend TrackingInteractions, Copilot credits and Azure tokens in one ledger per agent - with the spend column next to what each agent can reach.
- Microsoft 365 User Access ReviewEvery identity with what it can reach, what it did, and whether it should still exist - including SharePoint-only guests that live outside the directory.
- Group Access AnalysisWhat membership in a group actually unlocks - nesting resolved, external members surfaced, blast radius counted.
- App and OAuth Consent GovernanceEvery app with a foothold in the tenant: how it got in, who let it in, and what it can actually read.
- Remediation AutomationFindings become fixes at tenant scale, counted before you enable them and staged behind a review window.
- Microsoft 365 Licence OptimizationThe seats you pay for and nobody uses - unassigned units, licences on guests, and dormant accounts still billing.
- Microsoft 365 Anomaly DetectionEvery policy, user, app and agent measured against its own baseline - with an alert line you move and see the answer to at once.
- Office 365 Sign-in LocationsEvery place your tenant is reached from, with your Conditional Access configuration laid over observed reality.
- Microsoft 365 Unified Audit LogWho did what, when, from where and on which device - retained up to three years on a standard licence.
- SharePoint Site InventoryEvery site, channel site and OneDrive in one list, ranked by external reach, abandonment and what Copilot can read.
- Microsoft 365 Activity AnalyticsThe extremes rather than the averages - a mass download inside the hour, and everything nobody has touched in a year.
- Microsoft 365 Trend TrackingAny number in the tenant followed over time, with the change and the deviation attached - and alerting on the same object.
- Microsoft 365 Compliance MonitoringReadiness for eleven regulations measured from live tenant data - with weekly snapshots and a dated evidence pack per framework.
- External Domain MonitoringEvery organisation your tenant exchanges data with, resolved to a real company - with drift flags and an enforceable verdict per domain.
- All featuresExplore everything
FAQ
Questions teams ask first
Is this just Secure Score with a different skin?
No - and the Microsoft half is deliberately not touched at all: same score, same tiers, same remediation text, same deep links you would see in the Defender portal. What the page adds is the second half: a score measured from observed activity, one worklist across both, and the compliance articles each control moves. The two halves answer different questions, which is why both are shown.
Do we need an E5 license for this?
No. The measured half runs on standard licensing, from data 1Security already collects. The Microsoft half shows whatever Secure Score your tenant already produces - it needs one optional read-only permission, not a license upgrade. Where an individual remediation does require a specific Microsoft SKU, the action itself says so upfront.
Can we exclude controls that do not apply to us?
Yes - waive the control with a note. It leaves the possible total entirely, the same semantics Microsoft uses for ignored controls, so the percentage stays meaningful for your actual environment. The note stays on record, and the measured value underneath is never editable: only the standing changes.
Does a higher score mean we are safe?
A score is a posture summary, not a guarantee - which is exactly why there are two of them here. The configured half can be strong while real sign-ins, reachable data or ungoverned agents say otherwise; the measured half exists to catch that. Treat the number as the trend line and the worklist as the point: the page always shows what to fix next.
How current is it, and can we export it?
The Microsoft half updates as the Defender portal publishes it; the measured half is refreshed continuously from scans and audit-log ingestion. Both keep ninety days of daily history. The score is also served programmatically - GET /security-score on the REST API and the get_security_score MCP tool, both read-only under the evidence:read scope.
Put both halves in front of the board.
Connect read-only, grant one optional permission, and open the next meeting with a number you can defend - plus the ranked list of what earns the next points.
Or keep reporting configuration as if it were reality.