How do you track Microsoft Secure Score and catch a drop?
Checked October 28, 2026 by Accred Consulting
Accred Manage shows a connected tenant’s Secure Score as a percentage, its trend over up to 30 daily scores, and the actions worth the most points, each with its category and user impact. If the score falls by 5 percentage points or more across the trend, Manage raises a finding to find out why. Microsoft takes 24 to 48 hours to reflect a change in the score, so check the trend a day or two after you act.
Microsoft says Secure Score is not an absolute measure of how likely you are to be breached. It shows how much of Microsoft’s recommended configuration you have in place.
What Accred Manage shows
- The current score, as a percentage of the points available.
- The trend across up to 30 daily scores, with the change in points.
- Up to six actions worth the most points, each with its category, user impact, points left, and a link to open it in Microsoft where one is available.
- A finding when the score falls by 5 percentage points or more across the trend.
- An Open Secure Score link to the Microsoft Defender portal, where you make changes. Manage is read-only here.
Accred Assess also reads Secure Score as evidence for its AI governance readiness assessment.
Short how-to for acting on it
- Start with the actions worth the most points that have low user impact.
- Open each action in the Defender portal and read its implementation notes and license needs before you change anything.
- Test changes that affect sign-in on a pilot group first. For Conditional Access, report-only mode shows the effect before anything is enforced.
- Allow 24 to 48 hours, then check the trend in Manage.
- If Manage flags a drop, compare the score history in the Defender portal with recent configuration changes.
Which statuses earn points
| Status | Points | Notes |
|---|---|---|
| To address or Planned | None yet | Planned can feed a planned score view |
| Risk accepted | None | Recorded in history and can be undone at any time |
| Resolved through third party or alternate mitigation | Full points | Microsoft cannot see whether the work was done, so use it only when it is true |
| Completed | Full points | Confirmed from Microsoft data; you cannot change it |
Each action is worth 10 points or less, and some give partial points, for example for MFA on part of your users.
The full walk-through
For a step-by-step guide to raising Secure Score without outages, including triage by impact and documenting accepted risks, see Accred Consulting’s Secure Score guide.
Questions
When does Accred Manage flag a Secure Score drop?
When the score falls by 5 percentage points or more between the first and last daily scores in its trend. The finding links to Secure Score in the Microsoft Defender portal.
How long does Secure Score take to update?
After you complete an action, it can take 24 to 48 hours for the points to show in your score.
Does marking an action as risk accepted change my score?
No. Risk accepted earns no points. Resolved through third party and resolved through alternate mitigation earn the action’s full points, but Microsoft cannot verify them.
Sources
- Microsoft Secure Score · Microsoft Learn
- Assess your security posture through Microsoft Secure Score · Microsoft Learn
- Track your Microsoft Secure Score history and meet goals · Microsoft Learn
Create your organization, then turn on the apps you need.
Hub, Manage, and the Connect preview are free for your whole team, and Assess is free to start.