Configuration score

Applies to:


Secure score is now part of Threat & Vulnerability Management as Configuration score. The secure score page will be available for a few weeks.

The Microsoft Defender Advanced Threat Protection Configuration score gives you visibility and control over the security posture of your organization based on security best practices. High configuration score means your endpoints are more resilient from cybersecurity threat attacks.

Your configuration score widget shows the collective security configuration state of your machines across the following categories:

  • Application
  • Operating system
  • Network
  • Accounts
  • Security controls

How it works


Configuration score currently supports configurations set via Group Policy. Due to the current partial Intune support, configurations which might have been set through Intune might show up as misconfigured. Contact your IT Administrator to verify the actual configuration status in case your organization is using Intune for secure configuration management.

The data in the configuration score widget is the product of meticulous and ongoing vulnerability discovery process aggregated with configuration discovery assessments that continuously:

  • Compare collected configurations to the collected benchmarks to discover misconfigured assets
  • Map configurations to vulnerabilities that can be remediated or partially remediated (risk reduction) by remediating the misconfiguration
  • Collect and maintain best practice configuration benchmarks (vendors, security feeds, internal research teams)
  • Collect and monitor changes of security control configuration state from all assets

From the widget, you'd be able to see which security aspect requires attention. You can click the configuration score categories and it will take you to the Security recommendations page to see more details and understand the context of the issue. From there, you can act on them based on security benchmarks.

Improve your configuration score

The goal is to remediate the issues in the security recommendations list to improve your configuration score. You can filter the view based on:

  • Related componentAccounts, Application, Network, OS, or Security controls
  • Remediation typeConfiguration change or Software update

See how you can improve your security configuration, for details.


To boost your vulnerability assessment detection rates, download the following mandatory security updates and deploy them in your network:

To download the security updates:

  1. Go to Microsoft Update Catalog.
  2. Key-in the security update KB number that you need to download, then click Search.