Forum Discussion
Secure Score not scoring properly
We seem to be having some issues with our Secure Score lately. The score goes up and down and shows controls as not configured while they have been for a long time.
Example #1;
The "Turn on audit data recording" control setting is worth 15 points. We enabled it months ago. We scored points for it the entire time, since last Tuesday..Now its in the "Not completed" filter list again and we dropped in points. It shows up as "feature in place: false" scoring 0/15. If we follow the "Review" button, its all working fine and gathering data throughout the entire period.
Example #2;
The counts for MFA are not correct. We understand the difference between "required" and "registered" for MFA but still the numbers are incorrect.
The "Require MFA for all users" control shows "You have 53 of 83 user accounts that don't use MFA..".
The "Register all users for multi-factor authentication" control shows "You have 48 out of 83 users who don't have MFA registered.".
First off we can't match the 83 count of users..My Azure exports show 97 users..What filters apply to obtain that number of users? If we subtract shared-mailboxes it still doesn't add up. If we remove guest-users its way to high.
Secondly, we have a policy in place that requires MFA for all guest users. Given the number of our own users that we require MFA for plus that guest policy, the number of not listed as required MFA users should be way lower (around 30 at this stage).
We also have some features that are not scored properly that are most likely related to our Hybrid Exchange config, we don't really care about those but I think you should be able to detect the Hybrid config and apply filters for it.
EDIT:
Another example is the "Do not allow users to grant consent to unmanaged applications" control. We had this setting set to Enabled, so it always was allowed. We changed it to Not enabled so it would be more secure. As a reward we lost 10 points...
Could anyone provide insights in the above deviations?
- I second the issue on "Turn on audit data recording" not scoring
- Also, the TLS 1.0/1.1 report has not been updated since 10/30/2019, but I am getting points for being compliant. Not complaining. Will take the points whenever I can get them. Just saying.
+1 Currently helping Client with Secure Score Assessment, It looks bad that despite my changes, the score is dropping!
I understand why the score dropped (admin accounts not having MFA applied increased in number) but No improvement for:
Mailbox Auditing for all users
Activating IRM
Anything that involves "Review"
I know the new Secure Score is in preview, but i think this should still be working
Also having this problem. We had 15 points since I started my position here (About 9 months ago) but since around 2 weeks ago its said not scored and feature in place: False.
Running "Get-AdminAuditLogConfig" in powershell shows "AdminAuditLogEnabled: True" so it's definitely on. I tried toggling it off and on again to see if that forces secure score to re-calculate the score.
Reading this thread made me go and check our other scores and we also have scoring issues with TLS, MFA and configure expiry times for SharePoint links, all were scored and the score was removed despite the features being in place. we dropped from around 130 points to 90 points in about 2 weeks without anything in our environment changing and no settings getting changed in the admin portal.
So my Demo Tenant has finally updated some scores! a full 96? (might be longer) hours after I made the changes!
I would note that its not all the items I have updated, only a few, and its hard to recall Which changes I made on which days because I was expecting an update after 24 hours.
I will keep you updated if I see any items I know have changed not updating
The issue still persists. 0 solutions or explanations provided so far...
Scores controls change over time with no related reason. The Audit Log control changes once or twice a week without any changes.
Some other controls take 72 hours to update, others 12 hours. Neither of those delays is listed, should be 48 hours.
- Has there been any feedback on this? Our security score also apparently stopped updating MFA improvements. Some users who have MFA enabled and enforced still bring the score down because they "don't have MFA enabled".
As a matter of fact, we had some partial progress (shown in the recommendations) with MFA implementation, but 3 or 4 days ago it says no users have MFA enabled. Can anyone help on this?
