Microsoft Secure Score vs Essential Eight
Microsoft Secure Score and the Australian Signals Directorate Essential Eight are both used to measure cyber security posture. They are not the same thing, they do not measure the same controls, and improving one does not guarantee compliance with the other. This comparison explains what each measures, where they overlap and how to use both effectively.
What is Microsoft Secure Score?
Microsoft Secure Score is a measurement of your Microsoft 365 and Azure security configuration relative to Microsoft's own recommended controls. It is calculated continuously and displayed in the Microsoft Defender portal. The score is expressed as a number (for example, 312 out of a possible 450), and Microsoft provides a list of recommended actions that would increase the score if implemented.
Secure Score is entirely focused on the Microsoft cloud. It measures whether specific configurations are in place - MFA enforcement, Safe Links policies, Conditional Access, Defender settings - and weights each control by its estimated security impact. It does not assess your on-premises infrastructure, network security, endpoint patching or application control.
Improving your Secure Score is a useful proxy for improving Microsoft 365 security configuration. It is not a compliance framework and Microsoft does not position it as one.
What is the Essential Eight?
The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate (ACSC) as the baseline for protecting organisations against cyber threats. It defines three maturity levels for each strategy, from ML1 (basic implementation) to ML3 (robust, verified controls).
The eight strategies are: patch applications, patch operating systems, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, multi-factor authentication, regular backups, and application control.
The Essential Eight applies across all systems - not just the Microsoft cloud. Application control, OS patching and user application hardening have requirements that extend to endpoints, servers and network devices. Several strategies have no direct Microsoft 365 equivalent at all.
For Australian organisations that supply services to government, or operate in regulated sectors such as financial services or critical infrastructure, Essential Eight compliance at a specific maturity level is increasingly a contractual or regulatory requirement.
Side-by-side comparison
| Factor | Microsoft Secure Score | Essential Eight |
|---|---|---|
| Defined by | Microsoft | Australian Signals Directorate (ACSC) |
| Scope | Microsoft 365 and Azure only | All systems and platforms |
| Format | Numeric score, continuously updated | Maturity levels 0-3 per strategy |
| Purpose | Measure M365 config vs Microsoft recommendations | Minimum baseline for cyber resilience |
| Australian government recognition | Not a recognised compliance standard | Referenced in ISM and sector frameworks |
| Mandatory | No - advisory only | Required for some government contractors |
| Covers application control | No | Yes - one of the eight strategies |
| Covers OS patching | Partially via Intune | Yes - dedicated strategy |
| Covers identity and MFA | Yes - detailed M365 controls | Yes - MFA is one of the eight strategies |
Where they overlap
Three of the Essential Eight strategies have significant Microsoft 365 coverage and will improve your Secure Score if implemented:
- Multi-factor authentication (Essential Eight strategy): implementing MFA via Conditional Access improves Secure Score significantly. ML2 requires MFA for all users; ML3 requires phishing-resistant MFA. Conditional Access with Microsoft Authenticator satisfies ML2.
- Restrict administrative privileges: minimising Global Admin accounts, enabling PIM, and reviewing service account permissions improves both Secure Score and Essential Eight ML1/ML2 for this strategy.
- Patch applications (partial): Intune can enforce application update policies for managed devices, which contributes to Essential Eight application patching requirements - but does not cover all applications on all devices.
Where they differ
- Application control (Essential Eight): one of the most impactful Essential Eight strategies. Prevents unapproved applications from executing. Microsoft 365 Secure Score has no equivalent control - this requires endpoint management tools (Intune, AppLocker, Windows Defender Application Control).
- OS patching (Essential Eight): ML2 requires patches applied within 48 hours for internet-facing systems, two weeks for others. Secure Score does not measure OS patch currency directly.
- User application hardening (Essential Eight): covers browser security settings, disabling Office macros from internet sources, and blocking untrusted web content. Secure Score measures some macro settings, but not the full Essential Eight scope.
- Regular backups (Essential Eight): Microsoft 365 does not provide traditional backup. Third-party backup tools are required for Essential Eight backup compliance. Secure Score does not measure backup at all.
- Secure Score measurement is continuous - it reflects current configuration at any moment. Essential Eight assessments are point-in-time and require a formal assessment process to verify each strategy at a maturity level.
Which should your organisation prioritise?
For most Australian businesses that do not have a formal Essential Eight compliance requirement, improving Secure Score is the more practical starting point. It provides specific, actionable improvements in the Microsoft tools your organisation already uses, with a measurable outcome.
If your organisation supplies services to government or is subject to a sector framework that references Essential Eight, you will need to assess against each strategy explicitly - not just improve Secure Score. Engage a provider that has assessed against Essential Eight requirements and can provide evidence of maturity level for each strategy.
For organisations that do not yet have a formal compliance requirement, implementing the Microsoft security baseline (MFA, Conditional Access, Defender, Intune) significantly overlaps with Essential Eight ML1 requirements and positions you well for a formal Essential Eight assessment if that requirement arrives later.
Improving your Secure Score is a good proxy for Essential Eight ML1 MFA and admin privilege controls, but it is not a substitute for a formal Essential Eight assessment. If Essential Eight compliance is a contract or regulatory requirement, scope the work explicitly against the ACSC assessment guide.
Accuracy
Last reviewed: 9 October 2026 · Microsoft product capabilities, licensing and configuration options change regularly. Verify current details at learn.microsoft.com.
Next step
Microsoft 365 Security Baseline Implementation
The Cloud Security Baseline implements the foundational Microsoft security controls that satisfy Essential Eight ML1 MFA and admin privilege requirements. Fixed price from $4,500.
Learn more