Microsoft put out its 2026 Digital Defense Report last week, and the line that stuck with me wasn't about AI at all. It was the reminder that people, identities and trusted access are still where attacks land.
Here's what most owners don't know: Microsoft already grades you on exactly that, and the report card is sitting in your tenant right now.
It's called Secure Score. Open the Defender portal and you get a number, a list of specific recommended actions, and a comparison against organizations like yours. Each action is worth 10 points or less, and some give partial credit — if half your staff has multifactor authentication turned on, you get half the points for it.
I've opened that page in tenants nobody had ever looked at. The gaps are usually the same three: MFA that got rolled out to some people and never finished, old sign-in methods still allowed, admin accounts with no extra protection on them.
One honest caveat. Microsoft says plainly that a high score is not a guarantee against a breach. It measures how many of the available controls you're actually using — nothing more.
But that's still the question your carrier asks at renewal, and "we never looked" is a rough answer. Thirty minutes in that dashboard is time well spent.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email