Forum Discussion
What are the prerequisites to see Microsoft Secure Score?
My teammate says that even Basic or Standard M365 license provides Secure Score. Which is kind of right as you can see a basic score when opening a tenant in Lighthouse. But if you try to go to Defender console and then Exposure menu and press on Secure Score, it won't load with just Standard/Basic licenses assigned to users. I have tried to find a definitive list, but i can't. Copilot said you need at least Premium Business or E3/E5 or Defender P1. Which seems to make sense. But i need a confirmation. And also why do i see some score on tenant's page in Lighthouse?
It started loading again after a few weeks. According to MS support they found an issue on the backend and it was fixed (apparently many customers reported the issue). So, Copilot was wrong (again) and Secure Score will show even if you only have Basic or Standard M365 licenses.
10 Replies
It started loading again after a few weeks. According to MS support they found an issue on the backend and it was fixed (apparently many customers reported the issue). So, Copilot was wrong (again) and Secure Score will show even if you only have Basic or Standard M365 licenses.
Secure Score appears in several places, but the prerequisites differ depending on where you’re viewing it.
- Microsoft 365 Secure Score (M365 portal / Lighthouse)
This version of Secure Score is calculated from your tenant configuration and does not require Defender for Endpoint licenses.
That’s why you can still see a baseline Secure Score in Lighthouse even if users only have Basic/Standard licenses. - Defender Secure Score (Defender portal → Exposure → Secure Score)
This view requires Defender workload data (device risk, threat exposure, recommendations).
To load this page, you need at least:
- Microsoft Defender for Endpoint P1/P2, or
- Microsoft 365 Business Premium, or
- Microsoft 365 E3/E5 (which include the Defender components)
Without those licenses, the Defender portal cannot calculate exposure-based metrics, so the Secure Score page won’t load.
Why the mismatch?
Lighthouse displays the M365 configuration score, while the Defender portal requires security telemetry from Defender workloads.
So it’s normal to see a score in Lighthouse even when the Defender Secure Score UI isn’t available.Hope that clarifies the difference — both are called Secure Score, but they’re based on completely different data sources and licensing requirements.
- Microsoft 365 Secure Score (M365 portal / Lighthouse)
We also experience same issue with GUI Secure Score. No matter gdap user or internal ga same result "Loading stuck" or "Error 400 after long time"
API returns results so it's not permissions issue.
Also happens only with Basic/Standard licensed tenants so far.
Can you provide a link to any documentation that states the licensing requirements?
AladinH in comments provided this https://learn.microsoft.com/en-us/security-exposure-management/integration-licensing
Which explains why some of the recommendations might not show up in full score if you only have Standard or Basic licenses or Exchange. But it used to show something on Secure Score page for tenants with just Standard licenses. And it still loads such data in Graph. But UI page is struggling for at least a few weeks (maybe longer, but it was first time when i tried to get a report for such tenant).
Marking as not resolved again. Today i have used graph explorer to query one client's secure score data and it returned a massive json with all the points and data. It is only the UI that is acting up. Sometimes after being stuck in loading state for a long time it throws error code 400. We have opened a case with MS support.
Basic and Standard plans only show a very limited Secure Score, which is why you can see a summary in Lighthouse. To view the full Secure Score in the Defender portal, you need higher licenses such as Business Premium, E3/E5, or Defender P1/P2. That’s why Lighthouse shows a score but Defender won’t load it.
Hi wroot,
You can see a basic Secure Score even with Basic or Standard Microsoft 365 licenses, which is why Lighthouse shows a score for your tenant, but to access the full Secure Score experience in the Defender portal under Exposure (with all recommendations across identity, apps, and devices) you need higher-tier licenses such as Microsoft 365 Business Premium, E3/E5, or Defender plans like Defender for Office 365 P1/P2. Microsoft provides the baseline score for all tenants, but the advanced Secure Score features and full actionable recommendations are gated behind these premium licenses.
https://learn.microsoft.com/en-us/security-exposure-management/integration-licensingI have a follow-up question. Today a member of our M365 team said that for clients with Standard license they were still able to go to Exposure > Secure score page and get some recommendations ar least. But for a week or so this page is not loading for such tenants. Has Microsoft changed how this page works recently? The problem is that it is stuck in loading state, doesn't show a message that you are not eligible, so it looks more like a bug.
Thanks for the explanation
