Secure Score & Top Improvement Actions

The question it answers: Where does the tenant stand on Microsoft Secure Score, how did it move, and which controls give the most points for the least effort?

Where the tenant stands on Microsoft Secure Score, how it moved over the last 90 days, and which controls give the most points for the least effort. Controls marked as risk accepted or handled by a third party are kept but not counted as open.

Note

Secure Score is recalculated once a day, so changes made today show up tomorrow. Points reflect Microsoft’s weighting, not your organisation’s risk.

At a glance

Where in the app	Tenant › Secure Score & Actions
Workload	Security
Kind	Table · dashboard tile
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	No extra licence needed.
Report id (API and MCP)	tenant.security.secure-score

Columns

Column	Key	Type
Action	Title	Link
Status	Status	Status
Points open	PointsOpen	Text
Scored / max	Points	Text
Cost	ImplementationCost	Text
User impact	UserImpact	Text
Category	Category	Text
Service	Service	Text

Filters

Filter	Key (API)	On when the page opens
Only open actions	open	Yes

What it needs

Licence: No extra licence needed.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
SecurityEvents.Read.All	Microsoft Graph	Read your organization’s security events

Data sources it reads

• GET /v1.0/security/secureScores
• GET /v1.0/security/secureScoreControlProfiles

Through the API and MCP

GET /ir-api/v1/reports/tenant.security.secure-score?size=100
GET /ir-api/v1/reports/tenant.security.secure-score?filter=open

An AI assistant reads it with the MCP tool get_report and the id tenant.security.secure-score. The client needs the Read grant for Security. See Using the API.