Microsoft Defender and Secure Score
reviewed, action by action.
We review how the Microsoft Defender products you are licensed for are set up, what your Secure Score actions really cover, and how alerts and incidents are handled, using exports and screenshots you share, and give you a written report ranked by what to fix first.
Who it is for
Organisations with Microsoft 365 plans that include Defender features and no one sure which are switched on, or that want to know whether a Secure Score number reflects real protection.
What we review
- Licence-to-feature map. which Defender products your licences include. Microsoft documents which plans include Defender for Office 365 Plan 1 or Plan 2, and the report notes what yours appear to include. Check current Microsoft documentation.
- Secure Score. the current score, which recommended actions are complete, partly complete or marked as accepted risk, and whether the reasons are recorded. Microsoft says Secure Score also shows recommendations for products you may not be licensed for, so the report separates those.
- Email protection. where you sit on Microsoft’s protection ladder (built-in features, Defender for Office 365 Plan 1 or Plan 2), Safe Links and Safe Attachments, and which users are covered by the Standard, Strict or built-in preset security policies versus custom policies.
- Email authentication and spoofing. how SPF, DKIM and DMARC line up with your senders, with a pointer to the separate email authentication review.
- Endpoint onboarding. which devices are onboarded to Defender for Endpoint, which operating systems it supports (Windows, macOS, Linux, Android and iOS), and servers and devices not onboarded.
- Attack surface reduction rules. which rules are enabled and in which mode. Microsoft recommends enabling its standard protection rules in block mode, and documents a plan, test, enable and monitor path for the others.
- Identity signals. whether Defender for Identity is deployed where licensed, since it monitors signals from on-premises Active Directory and Microsoft Entra ID.
- Alerts and incidents. how alerts (signals) and incidents (collections of related alerts) are triaged, who owns them, how old open incidents are, and who is notified.
- Vulnerability and exposure findings. where licensed, what Defender Vulnerability Management reports for onboarded devices and how findings are owned.
- Integration. how Defender for Endpoint, Intune and Conditional Access work together on device risk and compliance, where in use.
- Operating routine. who reviews Secure Score and incidents, how often, and how exceptions are approved.
What you get
A written report, delivered through the channel agreed in the quote. It contains:
- An executive summary in plain language
- A table of each Defender product: licensed, deployed, covered, gaps
- Secure Score actions grouped into fix, accept with a reason, or not applicable
- Findings with severity and the evidence behind each one
- A fix-first list, a 30/60/90-day plan, and a list of what was not checked
See the format in the fictional report sample (sample, fictional data).
What we need from you
- A named contact with authority over Microsoft 365 security
- Exports or screenshots named in the scope, such as Secure Score actions, preset policy assignments, the onboarded device list, ASR rule status and a recent alert and incident list
- Your licence summary
How it works
- Send an enquiry. Tell us the question. Keep credentials and customer data out of it.
- Agree the written scope. We propose scope, fee and timing in writing. Nothing starts until both sides accept it.
- We review what you choose to share. We read only the exports and screenshots in the agreed scope. We do not sign in to your tenant or the Defender portal.
- You get a written report. It says what was checked, what was not, and suggested next steps.
- Any change is approved separately. A report does not authorize changes; anything that changes needs its own written approval.
See what the report looks like: Read a fictional report sample (sample, fictional data). How we handle your information: Trust and data handling.
What we need from you. A named contact with authority, and a small set of evidence you choose to share through a channel we agree in writing first. Please do not send credentials, access tokens or customer exports through the enquiry form.
What we do not do. We do not sign in to the Defender portal, change policies, onboard devices, close incidents or investigate live alerts. This is not a managed detection and response service, and we give no security guarantee.
What needs separate approval. Any change to policies, ASR rules, onboarding or alerting, any incident response, and any follow-up check after changes.
Questions before an enquiry
Does a high Secure Score mean we are secure?
No. Microsoft describes it as a measure of posture based on recommended actions taken, and says not every recommendation suits every environment. The report looks at what each action really covers.
Will you monitor our alerts?
No. This is a one-off review. Monitoring and response need a separate agreement.
Do we need Defender for Office 365 Plan 2?
Microsoft documents what each plan includes and which subscriptions bundle them. The report states what you have and where a gap matters to you. Check current Microsoft documentation, as plans change.
Will you turn on the attack surface reduction rules?
No. We report their state and a safe order for enabling them. Enabling is your change to approve.
Does this replace a penetration test?
No. It reviews configuration evidence you share.
Free tools, reading and vendor documentation
- Email domain health score (free)
- Azure security defaults
- What is Identity Protection?
- Phishing-resistant MFA and fake sign-in pages
Microsoft documentation (opens in a new tab). Product behaviour and licensing change, so check current Microsoft documentation before acting:
Ready to start?
Tell us what you need. We reply to confirm fit and to propose scope, fee and timing in writing.