26 August 2026
5 High-Impact Ways to Improve Your Microsoft Secure Score This Month
Most organisations can make meaningful Secure Score gains quickly by focusing on a small number of high-impact identity and core controls.
Microsoft Secure Score can feel overwhelming when you first open the recommended actions list. There are often dozens of items, and not all of them deliver equal value.
The good news is that a relatively small number of controls consistently produce the biggest improvement in both score and real-world risk reduction.
Here are five high-impact actions most organisations should prioritise this month.
1. Enforce MFA for all users
This remains the single most effective control in the majority of Microsoft 365 environments. Prefer Conditional Access policies over per-user MFA settings so you retain flexibility and can later require stronger authentication methods.
2. Block legacy authentication
Legacy protocols (POP, IMAP, SMTP AUTH, etc.) bypass modern authentication and MFA. A Conditional Access policy that blocks legacy authentication closes one of the most commonly exploited entry points.
3. Reduce standing Global Administrator accounts
Many tenants still have more Global Admins than they need. Aim for two accounts (plus a break-glass account) and move day-to-day privileged work to less powerful roles or just-in-time elevation with Privileged Identity Management.
4. Require stronger authentication for privileged roles
Where licensing allows, require phishing-resistant MFA (Windows Hello for Business, FIDO2 security keys, or certificate-based authentication) for administrative accounts.
5. Restrict user consent to applications
Uncontrolled OAuth app consent is a frequent source of persistence for attackers. Enable the admin consent workflow and limit what users can approve themselves.
How to approach these changes
- Start with the Identity category in Secure Score.
- Filter recommended actions by “Have license? = Yes” so you only see what you can implement today.
- Implement changes in a controlled way and communicate with users where needed.
- Re-check Secure Score 24–48 hours after making changes (it can take time to reflect).
These five actions alone often produce a noticeable lift in Secure Score while meaningfully reducing the most common attack paths.
For a simple prioritised list you can work through, download our Microsoft Secure Score Quick-Start Checklist.