Security
What actually moved our Secure Score
The honest version of a hardening project. Which changes moved the number, which ones broke things, and what the checklists quietly leave out.
Everyone wants a higher Microsoft 365 Secure Score, and the advice is always the same shape: a checklist of thirty things to switch on. Ours reached 93.3%, and the checklist is the least interesting part of how it got there. The score is a scoreboard, not the game.
Secure Score rewards you for enabling controls. It does not ask whether you enabled them well, and it cannot tell you what will break when you flip the switch. A control turned on carelessly is often worse than one left off, because now something is broken and nobody connects it to the change. So the real work was never the toggles. It was the discovery around them, and the blast radius of each one.
The few things that actually moved it
Retiring legacy authentication. This is the single biggest lever and the one that screams loudest. Legacy protocols, basic auth, POP, IMAP, SMTP auth, old ActiveSync, all bypass modern controls, including MFA. They are the door attackers genuinely walk through. Turning them off closes it. But you cannot just flip the tenant switch, because underneath legacy auth is a graveyard of service accounts, a multifunction printer scanning to email, and one integration nobody documented. The value is in finding all of them first. The toggle is the last five minutes.
Conditional Access, rebuilt rather than bolted on. Most tenants accrete access rules until no one can say with confidence what applies to whom. Tearing that down and rebuilding from a small set of clear policies, require a compliant device or MFA, block legacy, act on sign-in risk, is more secure and, just as importantly, something the next person can actually reason about. The score likes it. So does the on-call engineer at 2am.
Phishing-resistant MFA and risk-based identity. Moving the tenant off SMS and simple approve-the-prompt toward phishing-resistant methods, and letting Identity Protection respond to risk instead of a human noticing it later. This is where the posture stops being a wall and starts being a system that reacts.
Defender, actually configured. Not merely licensed and left at defaults, which is where a surprising amount of the score quietly hides.
The score does not reward the cheapest risk reduction you own: the account you disabled the day its owner left. Do that work anyway.
The cost nobody puts in the checklist
Every one of these has a blast radius. Legacy auth off breaks the label printer in a branch you have never visited. Strict Conditional Access locks out an executive on a personal device at the worst possible moment. Risk policies trip on a legitimate trip abroad. Security that takes down the business does not get praised for being secure. It gets rolled back, and it gets trusted a little less the next time you ask.
So each change was staged, announced before it landed, and shipped with a way back. That is the unglamorous part the number never shows, and it is the entire reason the number held instead of bouncing.
What the number was really measuring
93.3% is not the achievement. It is the residue of treating every control as a change with consequences rather than a box to tick. Do that consistently, retire what is dangerous, rebuild what is tangled, communicate the blast radius, and keep a rollback in your pocket, and the score follows on its own. Chase the number directly and you get a brittle tenant that scores well until the first outage teaches everyone to stop trusting security.