Microsoft Secure Score is a security analytics feature in the Microsoft Defender portal. It measures how closely your Microsoft 365 configuration aligns with Microsoft’s recommended security actions and gives you a prioritized list of improvements.

Secure Score includes recommendations across areas like:

• Identity
• Devices
• Applications
• Data

Each improvement action contributes points to the overall score. Microsoft also provides historical trends, implementation guidance, and details about the potential security benefit of each recommendation. You can access your Secure Score here.

Secure Score is useful for understanding your Microsoft security posture and tracking progress over time. But it’s a benchmark and recommendation system, not a complete security program and not a guarantee that your organization is secure.

Your score depends on the recommendations Microsoft makes available for your tenant, the products and capabilities you license, and the controls you’ve implemented. This means two organizations with different Microsoft licenses or environments can receive different recommendations and scores.

A higher score generally indicates that more Microsoft-recommended security actions are in place. It doesn’t mean your organization is completely secure, and it shouldn’t be treated as a universal pass-or-fail measurement. The most useful target is the set of improvements that meaningfully reduce risk for your environment.

A checklist of gaps isn't the hard part: Microsoft's own Secure Score can tell you where your MFA enforcement is thin or which accounts are over-privileged. The hard part is knowing which of those gaps attackers are actually exploiting right now, and closing them before someone gets in.

That's where the Huntress SOC comes in. We're not just scanning your tenant configuration in isolation, we're watching millions of identities across the Huntress platform, and we turn what we see attackers actually do into the controls that stop them. When our SOC spots a pattern of exploitation across the identities we monitor for example, a wave of attacks abusing legacy authentication, or a specific conditional access gap threat actors keep finding — that intelligence feeds directly into how Managed ISPM hardens your Microsoft 365 environment. It's not a static checklist. It's a living defense shaped by what's actually happening in the wild.

For Microsoft 365, that means finding and fixing the risks that matter most:

• Gaps in multi-factor authentication (MFA) enforcement
• Over-privileged administrator and user accounts
• Stale or dormant accounts
• Risky guest access
• Conditional Access policy gaps and exceptions
• Legacy authentication exposure
• Configuration drift after a policy or licensing change

What sets ISPM apart is turning identification into automated action: a simple, hands-off way to close these gaps and keep your posture hardened, backed by a SOC that's actively watching for the next thing attackers try.

We built Huntress Managed ISPM to turn identity posture management from a recurring to-do list into an ongoing security outcome. We define and maintain a threat-informed identity security framework, deploy the recommended controls, and continuously monitor for changes that weaken your environment.

Managed ISPM includes capabilities designed to make hardening safer and easier to maintain:

• Continuous posture assessment against Huntress-recommended controls
• Managed deployment of security policies and configurations
• Learning Mode and impact analysis for supported Conditional Access policy changes
• Continuous Enforcement for supported controls
• Automated remediation when a managed setting drifts
• Rollback support for managed security controls
• Escalation when a control repeatedly becomes noncompliant or can’t be remediated automatically

Our framework is informed by real-world attacker behavior and the identity attack paths observed by the Huntress Security Operations Center (SOC).

Microsoft Secure Score vs. Huntress ISPM

The Huntress ISPM Compliance Score and Microsoft Secure Score measure different things.

Microsoft Secure Score uses Microsoft’s scoring model across the recommendations available for your tenant. Our Compliance Score is calculated separately from the number of compliant Huntress-managed controls compared with the total number of available ISPM controls. We do import the Microsoft Secure Score so that you can track improvements as you deploy ISPM controls. Secure Score can be complex, whereas the simplicity of the Huntress Compliance Score provides a clear path of actions to improve overall security for the organization.

Because the control sets, scope, and calculation methods differ, the percentages shouldn’t be expected to match. This is because the two systems are measuring different views of your security posture. One built on hacker tradecraft and the other built on vendor recommendations.

For the most granular details about the Microsoft score, Microsoft’s Defender portal remains the primary source. For the operational status of controls managed through Huntress, use the ISPM dashboard and Control Alignment view.

See the Huntress ISPM FAQ for additional detail on score measurement and control compliance.

Use both, but give them different jobs.

Use Microsoft Secure Score to:

• Understand Microsoft’s recommended improvements for your tenant
• Prioritize actions across identity, devices, applications, and data
• Review score history and recommendation-level details
• Communicate progress using a Microsoft-native benchmark
• Investigate why your score changed after a licensing or configuration change

Use Managed ISPM to:

• Establish a consistent identity security baseline
• Identify high-risk Microsoft 365 misconfigurations
• Deploy security controls without making every change a manual project
• Understand potential user impact before enforcing supported Conditional Access policies
• Detect and automatically remediate configuration drift
• Keep managed controls aligned as users, policies, and environments change
• Track the operational status of the controls we’re responsible for maintaining

The Managed ISPM Fast Start Rollout Guide recommends using Huntress ISPM Control Alignment as the primary starting metric and Microsoft Secure Score as a secondary trend indicator.

Secure Score is valuable and it’s a well-understood metric for IT Teams, clients and insurance agencies, but it’s primarily a measurement and recommendation system. It can show you what Microsoft believes you should improve, but your team still needs to evaluate the change, implement it, monitor for unintended effects, and revisit it when the environment changes.

That operational work is where posture programs often stall. Policies gain exceptions, users and roles change, new tenants are added, and Microsoft updates its products and licensing. A score can tell you that posture declined; it doesn’t automatically ensure that the underlying control is restored.

Managed ISPM is designed to close that gap by combining a defined hardening framework with deployment, impact analysis, ongoing enforcement, and drift remediation.

No. ISPM complements Microsoft security capabilities and other identity tools. Microsoft Secure Score remains the source for Microsoft’s score and recommendations. Microsoft’s identity, endpoint, email, data, and threat protection capabilities still perform the security functions they were built for.

Managed ISPM adds an operational hardening layer: we help make sure the security settings that reduce identity attack paths are selected, deployed, and maintained. Managed ISPM also works alongside Managed Identity Threat Detection and Response (ITDR), which focuses on detecting and responding to active identity-based threats.

In simple terms, ISPM helps prevent identity attacks by closing gaps, while ITDR helps detect and respond when suspicious activity occurs.

Microsoft Secure Score is the measuring stick. ISPM is the ongoing hardening program that helps move your environment in the right direction and keep it there.

A practical workflow looks like this:

1. Take a note of your Microsoft Secure Score.
2. Use Huntress Managed ISPM to assess identity-specific gaps against our framework.
3. Enable Managed Deployments to automatically take care of the low-impact changes which can immediately start improving the tenant posture without bothering end users.
4. Prioritize controls based on risk, user impact, and business requirements.
5. Deploy supported controls through Managed ISPM.
6. Monitor Compliance Score and Microsoft Secure Score trends.
7. Monitor ISPM escalations and Secure Score changes as the environment evolves.

The goal isn’t to chase 100% on either metric. The goal is to reduce meaningful identity risk and maintain the controls that help keep attackers out.

Microsoft Secure Score gives you visibility into Microsoft’s recommended improvements. Huntress Managed ISPM helps turn identity security recommendations into a maintained posture by defining the controls, deploying them safely, and responding when settings drift.

See how Huntress Managed ISPM helps close Microsoft 365 identity gaps.