A Microsoft 365 security baseline you can check
Microsoft Secure Score checks 60 to 70 settings in a typical small-business tenant. It gives you a number, and no finish line. A business owner looking at "41 settings still open" has no way to tell which ones matter this week and which can wait.
This release gives you the finish line. Over two releases, on 23 and 24 September, the Microsoft 365 page changed from a list of everything Microsoft checks into a diagnosis: what matters first, why, and how to get it fixed.
Your security baseline
Eight settings that close the most common ways a small business is broken into. Multifactor sign-in for administrators and staff, old sign-in methods blocked, no automatic email forwarding outside the business, no staff consent to apps, admins given only the access their job needs, a backup administrator account, and mailbox activity recorded.
The page tells you how many you have in place, for example "3 of 8 in place. 5 changes to reach the baseline." When all eight are in place, it says your Microsoft 365 meets the recommended IT security baseline.
We did not invent these settings. Every one is a required control in the US CISA Secure Cloud Business Applications (SCuBA) baseline for Microsoft 365, and every one is configured in the Australian Signals Directorate's Blueprint for Secure Cloud. Several also appear in the Essential Eight, UK Cyber Essentials and Microsoft's own Baseline Security Mode.
Each setting carries its sources, and "See how each setting maps" opens a chart of all eight against all five sources, with the exact section or policy for each and a link to read it yourself.
Getting it fixed
Every open setting now has three routes:
- An AI prompt you can paste into Copilot in the Microsoft 365 admin centre, ChatGPT or Claude. It names your organisation, asks about your licence first, and asks for admin centre steps before PowerShell.
- A link for your IT person, showing that one setting and nothing else from your report.
- Talk to BSO to help, if you would rather we handled it.
After you make a change, Microsoft takes 1 to 2 days to re-check it. The page now says so wherever you make a change, and shows when Microsoft last checked your tenant.
A simpler dashboard
The dashboard's Microsoft 365 card is now your baseline: where you stand, and the settings still to do. The full detail stays on the Microsoft 365 page. Across all your companies, each company card shows its own baseline, without the counts that used to sit above them.
Fresher results
A setting you fix now shows as in place on the first collection after Microsoft counts it. Before this release it could take up to a week longer. Each result also now records which Microsoft product it belongs to, such as SharePoint or Exchange.
What the baseline does not claim
Reaching the baseline is a starting point. It does not mean you meet any of these standards in full, and some of them ask for more than Microsoft measures, such as phishing-resistant sign-in for administrators. We say this on the page as well as here.
The results are Microsoft's, read from Microsoft Secure Score. We choose the eight that matter first, show you where each comes from, and help you close them. If you have questions about how the baseline was chosen, the FAQ answers the common ones, or email support@bizsecure.online.