🎯 Security Course · Module 1 of 6
Microsoft 365 Defender Portal & Secure Score
SC-200 Exam Alignment
SC-200
Mitigate threats using Microsoft 365 Defender: Understand the unified Defender portal, navigate key workloads, interpret Microsoft Secure Score, identify improvement actions, and track posture changes over time.
- Know that the Microsoft 365 Defender portal (security.microsoft.com) is the single pane of glass for XDR across email, identity, endpoints, and cloud apps
- Understand that Microsoft Secure Score measures security posture — higher score = better posture, but score alone does not equal zero risk
- Know the four Secure Score categories: Identity, Devices, Apps, and Data
- Understand that improvement actions are weighted — some actions give more points than others
Exam Tip: SC-200 tests your ability to use the Defender portal for investigation and response, not just navigation. Focus on understanding which section handles each threat type — email threats in Email & collaboration → Explorer, endpoint alerts in Incidents & alerts, identity risk in Assets → Identities, and Secure Score for posture management.
The Microsoft 365 Defender portal is Microsoft’s unified extended detection and response (XDR) platform. It brings together signals from Defender for Office 365, Defender for Endpoint, Defender for Identity, Defender for Cloud Apps, and Microsoft Entra ID Protection — correlating them into a single incident queue and providing a unified hunting interface across all data sources.
🖥️ Microsoft 365 Defender Portal
The Defender portal lives at security.microsoft.com. It replaced the legacy Microsoft 365 Security & Compliance Center (protection.office.com) and the individual product portals, unifying them into a single XDR experience.
security.microsoft.com › Home
🏠 Home
🚨 Incidents & alerts
Incidents
Alerts
Advanced hunting
🛡️ Actions & submissions
📧 Email & collaboration
Explorer
Real-time detections
Attack simulation
🖥️ Assets
Devices
Identities
📊 Secure Score
📑 Reports
⚙️ Settings
🚨
3
Active incidents
🛡️
72%
Secure Score
⚠️
14
At-risk users
Recent incidents
🔴 Multi-stage BEC attack targeting FinanceHigh
🟡 Suspicious sign-in from anonymous IPMedium
🔵 Phishing email campaign — 47 recipientsInformational
Key Navigation Sections
| Section | What You Manage Here | Source Product |
|---|---|---|
| Incidents & alerts | Correlated multi-product incidents, individual alerts, Advanced Hunting (KQL), custom detection rules | All Defender products |
| Email & collaboration | Threat Explorer, Real-time Detections, submissions, review (quarantine), attack simulation training, email entity investigation | Defender for Office 365 |
| Assets → Devices | Device inventory, onboarded endpoints, device actions (isolate, run scan, collect investigation package) | Defender for Endpoint |
| Assets → Identities | Risky users, risky sign-ins, identity timeline, lateral movement paths | Defender for Identity + Entra ID Protection |
| Cloud apps | App governance, shadow IT discovery, app connectors, activity logs, anomaly detection policies | Defender for Cloud Apps |
| Secure Score | Posture score, improvement actions, score history, peer comparison, regression tracking | Cross-product posture engine |
| Threat intelligence | Threat analytics reports, Intel profiles, vulnerability intelligence | Microsoft Threat Intelligence |
| Reports | Email security reports, device reports, identity reports, app reports, security trend data | All Defender products |
📊 Microsoft Secure Score
Microsoft Secure Score is a measurement of your organisation’s security posture. The score is expressed as a number (e.g. 312 / 450) and as a percentage. Higher score = stronger configured security posture. The score does not guarantee zero breaches — it reflects configuration quality.
💡 How the Score is Calculated
Each improvement action has a point value. When you implement the action, those points are added to your score. The maximum score changes as new improvement actions are added by Microsoft. The score is recalculated continuously — implementing an action today adds points within 24–48 hours.
Score Categories
| Category | What It Covers | Example Actions |
|---|---|---|
| Identity | Entra ID user accounts, MFA, admin roles, sign-in policies, privileged identity | Enable MFA for all users, reduce global admins, enable SSPR, enable Entra ID Protection risk policies |
| Devices | Intune-enrolled devices, Windows security settings, Defender for Endpoint sensor coverage | Onboard devices to Defender for Endpoint, enable BitLocker, block Legacy Authentication |
| Apps | Microsoft 365 app security settings, Defender for Office 365 policies, app connector health | Enable Safe Links, enable Safe Attachments, enable DKIM for all domains, turn on preset security policies |
| Data | Data classification, sensitivity labels, DLP policies, information protection | Enable sensitivity labels, deploy DLP policy to Exchange and SharePoint, classify sensitive data |
⚡ Improvement Actions
Each improvement action has a status, point value, and implementation notes. Actions are grouped by category and ranked by impact.
| Status | Meaning |
|---|---|
| To address | Action not yet implemented — points available |
| Planned | You have noted this will be addressed — no points yet, but removes from urgent queue |
| Risk accepted | Organisation has decided not to implement — score impact acknowledged and accepted |
| Resolved through third party | A non-Microsoft product handles this control — gives partial credit |
| Completed | Action implemented — points awarded |
security.microsoft.com › Secure Score › Improvement actions
Secure Score: 312 / 450
72% · Better than 64% of similar organisations
138 pts available
Require MFA for all users — Identity
+16 ptsTo address
Enable Safe Attachments for Office apps — Apps
+10 ptsTo address
Enable DKIM for all custom domains — Apps
+8 ptsCompleted
📈 Score History & Comparison
The History tab in Secure Score shows your score trend over the past 90 days with event annotations — you can see exactly when a policy was enabled (score increase) or when a setting was disabled (regression). The Comparison view shows how your score compares to the industry average and similar-sized organisations.
⚠️ Score Regression Events
If Microsoft adds a new improvement action (expanding the maximum possible score), your percentage may drop even if you did nothing wrong. Similarly, if a previously completed action is found to be misconfigured or rolled back, the system will remove those points. Always review the History tab when a score drop appears unexpectedly.
PowerShell — Secure Score via Microsoft Graph
# Connect with security read scope Connect-MgGraph -Scopes 'SecurityEvents.Read.All' # Get the current Secure Score Get-MgSecuritySecureScore -Top 1 | Select-Object CurrentScore,MaxScore,PercentageScore,CreatedDateTime # List all improvement actions with max points Get-MgSecuritySecureScoreControlProfile | Select-Object DisplayName,MaxScore,ActionType | Sort-Object MaxScore -Descending # Export last 30 score snapshots for trend analysis Get-MgSecuritySecureScore -Top 30 | Select-Object CurrentScore,MaxScore,CreatedDateTime | Sort-Object CreatedDateTime
💡 Best Practices
- Review Secure Score improvement actions weekly — prioritise actions with the highest point value that can be implemented with minimal user impact first
- Use the “Risk accepted” status for actions that genuinely don’t apply to your environment — this keeps your queue clean and shows auditors you made a conscious decision, not an omission
- Share the Secure Score Comparison view with leadership to contextualise posture — showing you’re above the industry average is more meaningful than a raw number
- Set up email digest alerts (Settings → Secure Score → Notifications) to get weekly score summaries and regression alerts automatically
- When a score regression appears, check the History tab first before investigating — it often shows exactly which control change caused the drop
🎓 Interview Q&A
Q: A tenant’s Microsoft Secure Score dropped by 8 points overnight but no admin made any changes. What is the most likely explanation and how would you investigate?
Most likely cause: Microsoft added new improvement actions, expanding the maximum possible score and reducing the percentage — or a previously completed control was detected as misconfigured. To investigate: go to Secure Score → History and review the event log for the previous 24 hours. The History tab shows each point change annotated with the specific control that changed and whether it was a gain, loss, or Microsoft-initiated maximum score increase. If the regression is due to a genuine misconfiguration, investigate the flagged improvement action and remediate. If it’s a maximum score expansion, the percentage will naturally recover as you implement the new actions.
🎯 SC-200 Mock Test
Module 1 — Defender Portal & Secure Score
5 questions · Scenario-based · Pass mark: 70%
Q1 of 5
A security analyst needs to investigate a phishing email campaign that targeted 47 users in the tenant. Which section of the Microsoft 365 Defender portal should they use first?
AAssets → Devices — to check if any device was compromised during the campaign
BSecure Score — to see if the phishing campaign affected the organisation’s score
CEmail & collaboration → Explorer — to trace the phishing emails, identify recipients, and take remediation actions
DReports → Email security — to download a CSV of all phishing emails in the past 30 days
✅ C. Threat Explorer (Email & collaboration → Explorer) is the primary tool for investigating email threats. It lets you search by sender, recipient, subject, or URL; view the full delivery action and detection technology; identify all 47 recipients; and take bulk remediation actions (soft delete, hard delete, move to junk) directly from the portal.
Q2 of 5
An organisation’s Secure Score is 68%. The security team identifies an improvement action worth 16 points: “Require MFA for all users.” They implement MFA for all users. What should the team expect?
AThe score increases by 16 points immediately within seconds of enabling MFA
BThe score increases by 16 points within 24–48 hours as the system recalculates; the improvement action status moves to Completed
CThe score only increases if ALL users actually complete MFA registration within 7 days
DThe score does not change — Secure Score only measures existing breaches, not policy configuration
✅ B. Secure Score recalculates within 24–48 hours of a configuration change. Once the system detects MFA is required for all users, the improvement action status changes to Completed and 16 points are added. The score is based on policy configuration — requiring MFA earns the points whether or not every user has completed registration yet.
Q3 of 5
Where in the Microsoft 365 Defender portal would you configure anti-phishing policies for Exchange Online email?
AAssets → Identities → Anti-phishing configuration
BIncidents & alerts → Alert policies → Email phishing
CSecure Score → Apps → Anti-phishing improvement action
DSettings → Email & collaboration → Anti-phishing (under Policies & rules → Threat policies)
✅ D. Email protection policies (anti-phishing, anti-spam, anti-malware, Safe Links, Safe Attachments) are configured under Email & collaboration → Policies & rules → Threat policies in the Defender portal. This is the modern replacement for the old Security & Compliance Center protection settings.
Q4 of 5
A security improvement action for “Enable DKIM signing for all custom domains” is showing as “Risk accepted” in Secure Score. What does this mean?
AAn administrator consciously decided not to implement DKIM — the organisation accepted the security risk and the action is excluded from scoring
BDKIM configuration was attempted but failed — the system flagged it as a risk
CMicrosoft assessed DKIM as too risky to enable in this tenant and blocked it automatically
DDKIM is already enabled and the action is automatically resolved
✅ A. “Risk accepted” is a manual status set by an administrator when the organisation deliberately chooses not to implement an improvement action. The points for that action are not awarded, but the action is removed from the active remediation queue. This is the correct way to handle controls that are genuinely not applicable or where the organisation has accepted the associated risk.
Q5 of 5
Which four workloads feed data into the Microsoft 365 Defender unified incident queue?
AExchange Online, SharePoint Online, OneDrive for Business, and Teams
BMicrosoft Sentinel, Azure Defender, Azure Monitor, and Log Analytics
CDefender for Office 365, Defender for Endpoint, Defender for Identity, and Defender for Cloud Apps
DMicrosoft Intune, Entra ID, Microsoft Purview, and Power BI
✅ C. The four core Defender products that contribute signals to the unified Microsoft 365 Defender incident queue are: Defender for Office 365 (email & collaboration threats), Defender for Endpoint (device threats), Defender for Identity (on-premises AD and identity threats), and Defender for Cloud Apps (cloud application anomalies). These signals are correlated by the XDR engine into unified incidents.
🔒
Locked — This module will unlock automatically.