Microsoft Secure Score: The Free Tool That Tells Canadian SMBs Exactly What to Fix First

Most Canadian SMBs treat cybersecurity as a project: do the things on the list, check the box, move on. The problem is that security posture degrades continuously — new users get added without MFA, legacy authentication gets re-enabled during a troubleshooting session, someone grants an OAuth app broad permissions and forgets about it. What you secured six months ago may not be what you have today.

Microsoft Secure Score changes the approach. Instead of a static checklist, it is a continuously updated measurement of your Microsoft 365 and Azure security posture — a live number from 0 to 100 that moves every time something in your environment changes. More importantly, it tells you exactly what to fix and in what order to maximize the security return on your effort.

For Canadian SMBs operating on Microsoft 365 — the vast majority of the market — Secure Score is already available at no additional cost. The question is whether your organization is looking at it.

What Is Microsoft Secure Score?

Microsoft Secure Score is a security posture measurement built into the Microsoft Defender portal (security.microsoft.com). It evaluates your Microsoft 365 environment — including Entra ID, Exchange Online, Teams, SharePoint, OneDrive, and connected devices — against a library of recommended security controls and assigns a percentage score.

Each recommended control is worth a set number of points. When you implement the control, the points are added. When a control you have implemented lapses — for example, because a Conditional Access policy was modified — the points are removed. The score adjusts within 24 hours of any configuration change.

The score is broken into five categories:

• Identity — Entra ID configuration, MFA enforcement, Conditional Access policies, privileged role management
• Devices — endpoint protection enrollment, operating system patch status, Defender for Business configuration
• Apps — Exchange Online security settings, app consent governance, SharePoint permissions
• Data — information protection policies, sensitivity labels, data loss prevention
• Infrastructure — Azure resource configuration (for organizations using Azure)

For most Microsoft 365 Business Premium customers, identity and devices make up the largest share of available points and represent the most critical gaps.

Where Canadian SMBs Start

Industry data consistently shows that most SMBs arrive at their first Secure Score review with a score between 25% and 50%. Organizations that have never deliberately hardened their Microsoft 365 tenant — beyond the defaults set at account creation — typically land in the 30–40% range.

At that score level, the gaps are predictable: partial MFA enforcement, legacy authentication protocols still enabled, no Conditional Access policies, no privileged identity governance, and default sharing settings in SharePoint and OneDrive. Each of those gaps is exactly what threat actors are looking for.

The CIRA 2025 Cybersecurity Survey found that 42% of Canadian organizations reported a breach of customer or employee data in the past 12 months — up from 29% in 2022. Twenty-four percent were ransomware victims, and 74% of ransomware victims paid. The 2026 Verizon Data Breach Investigations Report found that 96% of ransomware victims were SMBs, and credential abuse appeared in the attack chain of 39% of all breaches.

When a breach does occur, the cost is substantial. IBM's 2025 Cost of a Data Breach Report for Canada puts the average Canadian breach cost at CA$6.98 million — with phishing-as-initial-vector breaches averaging CA$7.91 million, a 24% increase from 2024. What Secure Score measures directly addresses the identity and access gaps that drive those statistics.

Aligning Secure Score to the CCCS Baseline Controls

The Canadian Centre for Cyber Security's Baseline Cyber Security Controls for Small and Medium Organizations (ITSM.10.089) defines 13 control areas as the minimum recommended security standard for Canadian SMBs. The CCCS designed these controls on the 80/20 principle — achieving 80% of the security benefit from 20% of the effort.

The alignment between Secure Score improvement actions and the CCCS baseline is strong:

Improving your Secure Score is, in practice, a structured path toward CCCS baseline compliance. For Canadian SMBs preparing for the accountability obligations under PIPEDA — and for whatever federal privacy legislation eventually follows Bill C-27's death on the Order Paper in early 2025 — a documented, improving security posture supports the accountability framework the Office of the Privacy Commissioner of Canada expects organizations to maintain.

The Five Highest-Impact Improvements

Not all Secure Score actions are equal. These five consistently deliver the largest point gains and the most meaningful risk reduction for SMBs:

1. Enable MFA for all users via Conditional Access

This is the single highest-impact action in most tenants. Microsoft's research shows that MFA blocks over 99.9% of automated credential attacks — and 99.9% of compromised Microsoft accounts did not have MFA enabled. Enabling MFA through a Conditional Access policy (rather than legacy per-user MFA) adds the most points available in the Identity category and closes the most exploited gap in SMB tenants.

2. Block legacy authentication protocols

Legacy authentication — SMTP AUTH, POP3, IMAP, and older ActiveSync implementations — cannot be challenged by Conditional Access. An attacker with a stolen password can bypass MFA entirely by using a legacy-protocol client. Blocking legacy authentication via Conditional Access immediately follows enabling MFA in priority. These two actions together close the most common credential-based attack path in Microsoft 365 environments.

3. Require devices to be marked compliant

Adding a device compliance requirement to Conditional Access — so only Intune-managed and compliant devices can access Microsoft 365 — prevents access from unmanaged personal devices and from devices that have been compromised. Combined with MFA, this establishes the access control foundation the CCCS baseline recommends. Most Microsoft 365 Business Premium tenants already have the Intune licensing required; the gap is typically in the configuration.

4. Enable Entra ID Protection risk-based policies

Entra ID Protection (which requires Microsoft Entra ID P2 licensing) adds adaptive risk detection — identifying anomalous sign-ins, token theft indicators, leaked credentials, and impossible travel in real time. Configuring risk-based Conditional Access policies based on ID Protection signals adds meaningful points and provides the detection layer that blocks attacks that bypass static controls. As covered in our post on Entra ID Protection for Canadian SMBs, the October 1, 2026 deadline for migrating legacy risk policies makes this urgent for any organization that configured ID Protection policies before July 2025.

5. Reduce global administrator count

Most small tenants have more global administrator accounts than they need — often because it was easier to grant global admin than to determine which specific role was actually required. Each unnecessary global admin account is a high-value target: a compromised global admin has full control over your entire Microsoft 365 environment. Reducing the count to two or three break-glass accounts, and using Privileged Identity Management for just-in-time activation of legitimate admin tasks, directly improves the score and meaningfully reduces blast radius.

Reading the Score: Three Numbers to Track

The Secure Score dashboard exposes three metrics worth reviewing on a monthly cadence:

Your score vs. your industry. Secure Score compares your percentage against the anonymized average of similar organizations in the same industry. If you are significantly below your industry median, you are a less-hardened target than your direct competitors — and attackers scan for that.

Score over time. The trend line shows whether your posture is improving, static, or regressing. Regression — a score that drops between reviews — means controls are being removed or misconfigured faster than they are being added. That pattern requires investigation.

Improvement actions by category. Filtering actions by category (Identity, Devices, Apps, Data) lets you identify which area has the most unimplemented high-value actions. For most SMBs, Identity is where the largest gains remain.

Common Mistakes That Suppress the Score

Several patterns reliably keep Secure Score below where it should be:

Per-user MFA instead of Conditional Access. Legacy per-user MFA does not register as a Secure Score action because it is the older enforcement mechanism. Migrating to Conditional Access-based MFA is required for the points — and is the more robust implementation in any case.

Security Defaults enabled instead of Conditional Access. Microsoft 365's Security Defaults provide basic MFA enforcement and legacy auth blocking, but they are a starting point, not a finished posture. Organizations that grew beyond Security Defaults but did not implement equivalent Conditional Access policies often have configuration gaps that suppress the score without them realizing it.

Improvement actions marked "Risk Accepted" without documentation. Secure Score allows organizations to mark actions as Risk Accepted when a mitigating control exists outside the platform. This is legitimate for some actions. But tenants where dozens of actions are marked Risk Accepted without documented justification suggest the feature is being used to suppress the number rather than to reflect a genuine compensating control.

Turning the Score Into a Security Program

Secure Score is most valuable as a management tool when it is reviewed on a regular cadence rather than treated as a one-time number. A quarterly review cycle — assess the score, implement the highest-priority available actions, investigate any regression since the last review, and document what was completed — creates a continuous improvement record that serves both operational security and regulatory accountability.

IBM's 2025 report found that Canadian organizations extensively adopting security AI and automation reduced breach costs to CA$5.19 million, compared to CA$8.53 million for those not using these technologies — a CA$3.34 million difference. Managed security services that drive continuous posture improvement rather than point-in-time assessments are a direct path to that outcome.

For Canadian SMBs without dedicated security staff, the gap between "we have Microsoft 365" and "we have a hardened Microsoft 365 tenant with a continuously improving Secure Score" is significant. Closing that gap requires deliberate configuration, regular review, and someone accountable for acting on what the score surfaces.

Sources

• Canadian Centre for Cyber Security. *Baseline Cyber Security Controls for Small and Medium Organizations (ITSM.10.089).* cyber.gc.ca
• CIRA. *2025 Cybersecurity Survey.* cira.ca
• IBM. *Cost of a Data Breach Report 2025 — Canada.* canada.newsroom.ibm.com
• Verizon. *2026 Data Breach Investigations Report.* verizon.com
• Microsoft. *Microsoft Secure Score.* microsoft.com
• Microsoft. *Microsoft Secure Score — Microsoft Defender XDR.* learn.microsoft.com
• Microsoft. *Entra ID Protection risk-based access policies.* learn.microsoft.com

Cloud Forces assesses, hardens, and continuously manages Microsoft Secure Score for Canadian SMBs — including Conditional Access policy deployment, legacy authentication blocking, Entra ID Protection configuration, and quarterly posture reviews aligned to the CCCS Baseline Controls. Explore our Cybersecurity services or contact us to book a complimentary Secure Score review.