Microsoft Security Score: AZ-500 Exam Guide

What Is Microsoft Security Score?

Microsoft Security Score is a measurement of your security posture based on your configuration across Microsoft 365 services, Entra ID, and Defender products. It lives at security.microsoft.com under Secure Score.

Score = (achieved points / total possible points) x 100

Improvement Actions

Each improvement action has:

• Points: How much the action contributes to your score
• Category: Identity, Data, Device, Apps, Infrastructure
• Implementation status: To address / In progress / Risk accepted / Planned / Resolved through third party

Common high-value improvement actions the exam tests:

• Require MFA for all users (Identity: highest point value)
• Enable self-service password reset (Identity)
• Block legacy authentication (Identity)
• Enable audit log data (Data)
• Enable Microsoft Defender for Office 365 (Apps)

Score vs Real Security

Exam trap: Actions such as "Mark as Risk Accepted" or "Resolved through third party" improve your score without implementing controls. A score of 80% does not mean 80% security: it means 80% of Microsoft's recommended controls are reported as addressed.

Score Relationships

Exam tip: Defender for Cloud has its own Secure Score separate from Microsoft Security Score. These are different metrics. Microsoft Security Score covers M365/Entra; Defender for Cloud Secure Score covers Azure resources.