A few weeks ago I watched someone forward a Copilot-drafted email to a client without really reading it. The tone was off. A figure was wrong. The client picked it up before they did. Nobody was being lazy — they were being efficient, in the exact way we’ve all been trained to be efficient. Get the task done. Move to the next one. That small moment has stuck with me, because I think it points at something much bigger that’s quietly reshaping how small businesses need to think about the people they hire, and the behaviours they reward.

For most of my working life, businesses hired people to do things. Send the email. Build the report. Process the invoice. Update the spreadsheet. Speed and responsiveness were the metrics that mattered most. If you could turn incoming requests into completed work quickly and reliably, you were valuable. That model held up because doing the thing was the hard part, and doing it well took real skill, attention and time.

The work that used to be hard isn’t hard anymore

Copilot has quietly upended a lot of that. Drop into Outlook and you can have a draft reply in seconds. Open Word with a half-formed idea and Copilot will hand you a structured first pass before your coffee has cooled. Excel will summarise a sheet, flag the anomalies, and suggest a formula it thinks you wanted. Teams will catch you up on the meeting you missed and tell you what was decided and who owns what. Every one of those tasks used to be where someone earned their keep. Now they’re table stakes.

What’s left isn’t the doing. It’s the deciding. Was that actually the right answer? Does the draft fit the specific client we’re dealing with, or the average client Copilot has imagined? Is the figure it pulled from SharePoint the current number, or one from two restructures ago that nobody got around to archiving? Should we even send this email, or is there a phone call hiding behind it?

We’ve been training people out of asking

Here’s the part I find uncomfortable. A lot of small businesses have spent years quietly training their people out of pausing. We rewarded responsiveness over reflection. Inbox zero over inbox thoughtful. Closing tickets over questioning whether the ticket made sense in the first place. Over time, some genuinely good people got very fast at moving work between systems without really engaging with any of it.

That worked when the slow, expensive part of the job was producing the output. It doesn’t work now. The slow part is the human bit — the read, the sense-check, the quiet moment of “this doesn’t sit right with me” that keeps a business out of trouble with a client, a regulator, or its own future self.

The maths has flipped

When output was expensive, mistakes were rare almost by accident. There was friction in the system, and friction gave people time to second-guess themselves. A bad proposal took half a day to write, so it usually got read twice before it left the building. A bad proposal now takes ninety seconds, and so do the next ten after it.

The businesses that come out of this next stretch in good shape won’t be the ones with the fastest Copilot adopters. They’ll be the ones that have quietly shifted what they recognise and reward — from doing the thing, to noticing when the thing isn’t right. That’s a hiring conversation, a performance review conversation, and most of all a culture conversation. And in most of the small businesses I see day to day, it’s well overdue.

If you want to purchase Copilot Credits for use with Cowork you’’ll need access to https://admin.microsoft.com. Then you’ll need to navigate to Copilot | Cost Management | Configuration. You’ll then need to select Buy prepaid credits.  Then you need to select a Subscription, then How many credits you want from the table that displays.

Upon selection, you’ll be shown the price and then you can pay via the Checkout.

If you look closely you’ll also see this.

So, billing is measured in CCCUs. 1 x CCCU = 100 credits. CCCU means Copilot Credit Commit Unit.

Given that this PAYG style billing is applied against an existing Azure subscription, if you go into the Azure portal and locate Reservations you find another location where you can pay:

Again, here, we have Copilot Credit Pre-Purchase Plans measured in CCCUs.

At the lowest prepaid tier you get 5% discount and at the pre-paid top tier you get a 20% discount, with remaining tiers in between these two. Any overage returns to be being billed with no discount at the base rate.

If you now look at how usage is reported, you see it is reported in Copilot Credits, not CCCUs. So CCCUs appear to be a billing construct only.

Thus, if we focus on just the Copilot Credits (not CCCUs) we get the Microsoft quoted US$0.01 per Copilot Credit. Thus, the above consumption cost becomes 1,574 x US$0.01 = US$15.74 in real money.

Thus, to enable Copilot Cowork going forward you will need:

– M365 License (e.g. M365 Business Premium)

– M365 Copilot license (to enable premium Copilot capabilities like Cowork)

– An Azure subscription for Copilot Cowork to be billed against

– Cowork consumption and billing is tenant wide, not per user

That will bill Copilot Cowork at a PAYG rate of $0.01 per Copilot Credit. A simple average would be to assume each Cowork interaction will consume around 400 credits. That is, around US$4 every time ANY user uses Cowork. This is because Cowork interactions vary on how many credits they use based on their complexity of the request and actions taken.

You can pre-purchase Copilot Cowork credits at average discounted rates starting from US$0.0095 down to $0.0080 (i.e. 5 – 20% discount) for a fixed annual commitment.

Annual pre-paid Copilot Cowork credits are measured in Copilot Credit Commit Units (CCCUs) which have the ratio of 100 credits per 1 CCCU. The entry level CCCU is 3,000 which provides 300,000 credits across all users in the tenant.

These credits can be purchased from the M365 admin portal or the Azure portal (vis Reservations).

An administrator can restrict Copilot Cowork in various ways to control costs but that is the subject for additional post.

….. and we are done. Breath. In. Out.

Most security baseline deployments I walk into were finished in about four minutes.

Someone opened Intune, found Security baselines, picked the Windows one, clicked through the wizard accepting every default, hit Create, and moved on. Box ticked. Tenant “hardened”.

That’s not security configuration. That’s a screenshot for the onboarding report.

Here’s the thing nobody tells you. A baseline you’ve never read isn’t a baseline. It’s a pile of Microsoft’s opinions you’ve agreed to without looking. And one of those opinions might break BitLocker enrolment on every machine without a TPM.

So let’s actually do this properly. It’s already in the licence your client pays for.

What is a security baseline, really?

A security baseline is Microsoft’s own recommended configuration for a product, bundled into one policy you deploy from Intune.

Not a list of suggestions. Not a report. Actual settings that get pushed to the device — BitLocker, firewall, Defender, password rules, SmartScreen — preset to the values Microsoft’s security team uses internally.

The point is speed. Instead of hand-building forty configuration profiles, you deploy one baseline and you’re 80% of the way to a hardened endpoint. Microsoft maintains the recommended settings and ships new versions as Windows evolves.

You get a few flavours: Windows, Microsoft Defender for Endpoint, Microsoft Edge, and Windows 365. There’s no separate SKU to buy. If your client is on Business Premium, this is already sitting in their tenant waiting.

Step-by-Step: deploying your first baseline

Portal only. No PowerShell.

Open the baselines

Sign in to the Microsoft Intune admin center and go to Endpoint security > Security baselines. You’ll see each baseline type with its current version on the right.

Pick one and create the profile

Start with Security Baseline for Windows 10 and later. Click it, then Create profile. Always take the newest version — older ones go read-only the moment a new one ships.

Name it like you’ll see it again

Give it a name your future self can read at a glance, like WIN-Baseline-Pilot. When a tenant has thirty policies, naming is the documentation.

Read the settings. Actually read them.

This is the step everyone skips. Walk the Configuration settings tabs. The defaults are deliberately restrictive — that’s the point — but restrictive settings break things. BitLocker enforcement on hardware without TPM 2.0 will tank an enrolment. Firewall rules will fight on-prem Group Policy on hybrid devices.

Assign to a pilot, not the fleet

Assign to a device group of ten to twenty machines with mixed hardware. Not your IT team’s identical laptops — include the weird old Dell from accounting. That’s where the breakage hides.

Watch the overview

Give it 24 hours, then check the profile’s Overview. You’ll see four buckets:

Succeeded        – applied cleanly
Error            – failed to apply
Conflict         – this setting is fighting another policy
Not applicable   – device can't support it

Notice what’s missing? There’s no “Secure” status. The portal tells you settings applied — never that you’re protected. Those are different claims, and the gap between them is your job.

Why this actually changes behaviour

Two reasons this matters more than the four-minute version.

First, conflicts are real and they’re silent. If the same setting lives in a baseline and a configuration profile, the device gets neither. It sits in Conflict and quietly does nothing. Run a pilot and you catch it. Deploy to everyone on a Friday and you find out Monday.

Second — and this is the one that catches people — baseline settings tattoo. Remove the assignment and the settings don’t roll back. They stay frozen at the last value applied. There’s no undo button.

“So if I unassign it, doesn’t the device go back to normal?”

No. It stays exactly where the baseline left it. You’d have to push the opposite setting to reverse it. Treat every baseline deployment as a one-way door, because it mostly is.

A baseline is a starting line, not a finish line. Microsoft’s Windows baseline covers maybe 150 of the 450-odd settings a CIS benchmark wants. That’s fine. Start here, layer the rest later.

The four-minute deployment and the real one look identical in a screenshot. They behave nothing alike on the device.

Read the settings once. Pilot once. Then you can tell a client their fleet is hardened and actually mean it.

A baseline isn’t there to make you look secure. It’s there to make you secure — but only if you read it first.

Copilot — Cowork general availability

Copilot Cowork is now generally available

Copilot Cowork has moved out of preview and is now generally available. It lets users build agents and skills that automate repetitive, multi-step work across Microsoft 365 — drafting content, producing reports, triaging tickets and more — bringing autonomous task handling to everyday users.

Security — AI agent threats

AutoJack: How a single page can RCE the host running your AI agent

Microsoft’s Security team breaks down “AutoJack,” a technique where a single malicious web page can achieve remote code execution on the machine hosting an AI agent. It’s a clear illustration of the new attack surface that autonomous agents create when they browse and act on untrusted web content.

Security — Email protection

Microsoft Defender email security benchmarking: Key insights from one year of data

Drawing on a full year of benchmarking data, Microsoft shares what it’s learned about email threats and how organisations’ protection stacks up over time. Useful context for anyone tuning their Defender email-security posture.

Security — Industry recognition

Forrester names Microsoft a Leader in the 2026 Extended Detection and Response Platforms Wave

Microsoft has been named a Leader in Forrester’s 2026 Wave for Extended Detection and Response (XDR) platforms, reflecting the strength of its unified, cross-domain detection and response offering.

Infrastructure — Azure at scale

Azure sets a new performance record for LLM training benchmark at extreme scale

Azure has set a new performance record on a large-language-model training benchmark at extreme scale, underscoring the platform’s strength for the very largest AI training workloads.

After hours

Editorial

If you found this valuable, the I’d appreciate a ‘like’ or perhaps a donation at https://ko-fi.com/ciaops. This helps me know that people enjoy what I have created and provides resources to allow me to create more content. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week

The best sales conversations I’ve watched in the MSP world don’t feel like sales conversations at all. They feel like someone helping someone else work out what’s actually going on. There’s a diagnosis. There’s a plan. And then, at the very end, there’s a quiet question: would you like a hand putting this in place? That’s the whole thing. No closing technique. No manufactured urgency. No script that leaves either side feeling slightly off afterwards. Just a useful hour and a natural offer at the end of it.

Help is the offer

A few of my clients have built their front door around a paid consult. Someone pays a modest fee, sits down for an hour, and walks out with a real read on what’s happening inside their tenant — security gaps, licence waste, the four Copilot use cases their team would actually adopt, the Conditional Access policy that’s been quietly broken for months. The deliverable isn’t a quote. It’s clarity.

That changes the dynamic. The buyer isn’t being sold to. They’re being helped. And by the time the hour is up, they already know whether the person across the table is worth working with, because they’ve seen them work.

This is where Copilot has quietly become a useful ally in those conversations. Rather than disappearing for a week to write up findings, the consultant pulls a draft summary together in Word with Copilot during or right after the session — referencing the discovery notes, the screenshots from the tenant review, the Secure Score export. The buyer leaves with something tangible the same day. The speed is part of the help.

The invitation writes itself

Here’s the bit most MSPs still miss. When you have genuinely helped someone — when they walk out the door clearer than they walked in — you don’t need a pitch. You need one sentence. Want us to do this for you?

That sentence works because the buyer has already done the qualifying themselves. They’ve seen your thinking. They trust the diagnosis. They want the plan executed. The proposal that follows is short, because the work has been pre-sold by the consult itself.

I’ve watched clients use Copilot in Outlook to turn the same notes into the follow-up email — the recap, the recommended next steps, the link to a SharePoint page with the proposed scope. It lands inside a few hours, while the conversation is still warm. Nothing about it feels like a chase. It feels like a continuation.

Why this beats the old playbook

Free discovery calls dressed up as consults don’t fool anyone anymore. Buyers have sat through enough of them to recognise when they’re being qualified rather than helped. The free version trains people to expect a pitch at the end. The paid version trains them to expect value — and a small amount of money on the table changes how seriously both sides show up.

For MSPs trying to move up the value chain, this is a quieter, more dignified way to do it. You stop hunting. You start advising. The right buyers — the ones who want a partner rather than a price — self-select towards it. The wrong ones fall away on their own. That filtering is worth the effort by itself.

The thing I keep coming back to is how much pressure this approach takes off both sides of the table. The buyer doesn’t have to fend off a pitch. The MSP doesn’t have to manufacture one. Helping first, then inviting, with Copilot doing the heavy lifting on the write-up, turns the sales process into something that actually resembles the work itself. Which, when I think about it, is probably the point.

Most people meet Copilot in Word the same way. New blank document, click the icon, type “write me a proposal,” hit Generate.

Out comes 400 words of beige. Technically correct. Completely generic. The kind of thing that could be about your business or anyone else’s.

So they shrug, decide Copilot “isn’t that good,” and go back to writing from scratch.

Here’s the thing. They weren’t using Copilot wrong. They were using the worst part of it and ignoring the best part.

A blank page is the one thing Copilot is genuinely bad at. Give it nothing and it gives you nothing — just confident, well-punctuated filler. The magic isn’t in asking it to invent. It’s in pointing it at what you already have.

What is Copilot in Word, really?

Forget the demos where someone conjures a document from a one-line prompt. That’s the party trick, not the job.

What Copilot in Word actually does well is take your material — a file, an email, a meeting, a folder — and reshape it into something new. The official term Microsoft uses is grounding. The button you press is Reference a file.

That’s the whole ballgame. You’re not asking a stranger to guess what your last client proposal looked like. You’re handing it the last one and saying “another like this.”

So the question stops being “can Copilot write?” and becomes “what do I already have that Copilot can stand on?” For most SMBs, the answer is a lot. Years of proposals, reports, policies, and SOWs sitting in OneDrive, doing nothing.

Step-by-Step: drafting from something you already have

This is the workflow I show every client. It takes about ninety seconds.

Open a new document

Start a blank document in Word, then click the Copilot icon. You’ll get the Draft with Copilot box. Don’t type your prompt yet.

Reference the file first

Click Reference a file (the paperclip), and start typing the filename. Pick the document you want Copilot to learn from — an old proposal, a strong report, a policy you’re proud of. You can attach more than one. Microsoft has the full walkthrough in Draft and add content with Copilot in Word, and the Welcome to Copilot in Word page confirms it only ever looks at the files you choose — nothing else.

Write your prompt

Now tell it what you want, and point it back at what it’s holding:

Draft a one-page proposal for Acme Pty Ltd.
Reference: /Northwind-Proposal.docx /Acme-Discovery-Notes.docx
Match the structure and tone of the Northwind proposal.
Keep it under 400 words.

Notice what’s missing? Nowhere do I explain what a proposal is. I’m not teaching Copilot to write. I’m showing it how we write and telling it to do that again.

Keep, regenerate, or bin it

Copilot drops the draft in. Keep it, Regenerate for another go, or Discard. Then you edit like a human — because you still have to.

Why this actually changes behaviour

Before: “Copilot, write me a client report.” → generic mush you rewrite anyway. After: “Copilot, write this report the way I wrote the last three.” → a first draft that already sounds like the business.

That second one is the difference between a toy and a tool.

Here’s the real win for MSPs. Grounding turns your clients’ own document history into an asset they didn’t know they had. Every good proposal becomes a template. Every solid SOP becomes a pattern. The licence they’re already paying for suddenly does something a free chatbot never can — because the free chatbot can’t see their files.

And it’s not just drafting. Flip it around and Copilot becomes a reading tool. Open a long contract, type Summarize this document, and it’ll hand back the gist with citations back to the source — chat with Copilot about your Word document covers that side. Summarize before you read. Draft from what you’ve got. Same tool, both directions.

Don’t ask Copilot to know your business. Show it.

If you’re rolling Copilot out to clients and the first thing you teach them is “type a prompt on a blank page,” you’ve handed them the weakest trick in the box and you’ll get the predictable shrug.

Teach Reference a file first. That’s where the value lives, and it’s the bit nobody stumbles onto by accident.

Reference a file isn’t there to help you write faster. It’s there to make sure what gets written already sounds like you.

Someone said to me recently that the things you experience from actually going all in on something will change the way you think and the way you experience life. I sat with that for a few days, and I keep coming back to how true it is. The lessons I’ve learnt that actually shaped me — the ones I still use — never arrived from reading about them or watching someone else do it. They arrived after I committed. After I hit publish on the video. After I greenlit the project. After I said yes to the thing that might not work.

You can’t think your way to the lesson

For years I noticed a pattern in my own work. The plans that lived in a Word doc were always cleaner than the plans I actually shipped. The launches I’d rehearsed in my head were always smoother than the ones in the wild. But the rehearsal never taught me anything. The shipping did. You only find out what your audience actually wants once you put something in front of them. You only find out where the workflow breaks once a real client sits in it on a Tuesday morning.

This is where I think a tool like Copilot has quietly changed how I move. I used to delay things because the draft email wasn’t right, the outline wasn’t sharp enough, the slides weren’t worth showing yet. Now I’ll ask Copilot in Outlook to give me a first pass on a reply, sit with it for a minute, and send something that’s eighty per cent of where it needs to be. I’ll spin up a rough deck in PowerPoint with Copilot drafting from a Word doc I’ve already written, and I’ll show it to someone for feedback the same afternoon instead of next week. The point isn’t that Copilot writes the thing for me. The point is that it removes the excuse to keep polishing before I commit.

Not every bet pays off — and that’s the lesson

I’ve greenlit plenty of projects that didn’t go anywhere. Videos that landed flat. Ideas I was sure would resonate that quietly didn’t. If I’d waited for certainty on any of them, I wouldn’t have learnt what my audience actually responds to. I wouldn’t know which formats earn attention and which ones don’t. I wouldn’t have built the muscle of recovering from a miss and trying again the next week.

What I notice now in clients I work with is the same pattern. The teams that are getting real value from Microsoft 365 and Copilot aren’t the ones who ran a six-month readiness program. They’re the ones who picked a use case, tried it inside Teams or in a SharePoint workspace, watched what happened, and adjusted. They committed first and refined second. The ones still building the business case in a Loop component are usually the ones falling further behind.

The shift is in your thinking

Going all in changes you because it forces you to live with the result. You learn what works because you watched it land. You learn what doesn’t because you felt it. That kind of knowledge doesn’t come from analysis — it comes from being in the arena.

I’d rather ship something imperfect this week and know what to fix next week, than spend a month protecting an idea that never meets the world. Every meaningful jump I’ve made in my business started with that decision. Hit publish. Greenlight it. Find out.

Everyone’s proud of their MFA rollout. Every tenant I touch has it on now. Good.

But here’s the thing almost nobody checks: MFA only protects the front door. It proves who you are when you sign in. After that, you get a token, and that token is what actually keeps you logged in.

Steal the password? MFA stops you. Steal the token? You walk straight past it.

That’s the attack that’s quietly winning right now. Adversary-in-the-middle phishing kits don’t bother cracking your second factor. They sit between you and Microsoft, let you complete MFA, and pocket the session token on the way through. Now they’re you — no prompt, no challenge, no trace.

So the question isn’t “have I turned on MFA?” It’s “what happens after the token is issued?” And for most tenants, the honest answer is: nothing, for up to an hour.

What is CAE, really?

A Microsoft 365 access token lasts one hour by default. For that hour, the token is trusted. If you disable a compromised account at minute three, the attacker keeps working until minute sixty.

Continuous Access Evaluation closes that gap.

Instead of waiting for the token to expire, Entra and the app — Exchange, SharePoint, Teams — hold an open conversation. The moment something critical changes, Entra tells the app to stop trusting that token now. Account disabled, password reset, admin revokes sessions, ID Protection flags high risk — the session dies in near real time.

Here’s the part most people miss. CAE is already on. Critical-event evaluation runs in every tenant, no Conditional Access policy required. You don’t switch it on. You just need to not switch it off.

Step-by-Step: lock down the token, not just the login

Confirm CAE is still on

Go to the Entra admin centre → Entra ID → Conditional Access → Policies. Open any policy you’ve built, then look under Session → Customize continuous access evaluation.

If someone’s ticked Disable in there, untick it. That toggle exists for edge cases, and I’ve walked into tenants where it was flipped off years ago and forgotten. Microsoft documents the disable path — read it so you know what you’re looking at.

Stand up a Token Protection policy

CAE kills the session after a known event. Token Protection stops the stolen token being usable in the first place. It cryptographically binds the sign-in token to the device it was issued on. Steal it, move it to your machine, and it’s a dead key.

Create a new Conditional Access policy. Scope it to a pilot group first. Target Exchange Online, SharePoint Online, and Teams. Under Session, tick Require token protection for sign-in sessions.

Set it to report-only

Do not go straight to On. Set the policy to Report-only and let it run. Watch your sign-in logs for “Token Protection – Sign In Session” and look for Bound versus Unbound. The deployment guidance says the same thing, and it’s right — you want to see what breaks before it breaks for a client.

Here’s the session control you’re actually setting:

Session controls:
  Require token protection for sign-in sessions: ON
  Target resources: Exchange Online, SharePoint Online, Teams
  Device requirement: Entra joined / hybrid joined / registered
  Client apps: native desktop + mobile only

Notice what’s missing? Browsers. Token Protection covers native client apps today, not browser sessions. So an attacker who lifts a token through a browser can still replay it. This isn’t the finish line — it’s one layer in a stack that also needs phishing-resistant MFA and compliant devices.

Why this actually changes behaviour

Once you internalise that the token is the credential, your whole threat model shifts.

“We’re fully MFA’d, we’re fine.” No. You’re protected at sign-in. You’re exposed for every minute after it.

CAE shrinks that exposure window from an hour to near-zero. Token Protection makes the stolen token worthless on the wrong machine. Together they move you from “we hope nobody phishes a session” to “even if they do, it dies fast and travels nowhere.”

And it costs you nothing extra to start. CAE ships in the box. Token Protection now needs only Entra ID P1 — which your Business Premium clients already have.

MFA was the conversation three years ago. Token theft is the conversation now. If you’re still selling clients on the front door while attackers climb through the session, you’re protecting the wrong thing.

MFA proves who walked in. CAE and Token Protection make sure they can’t stay in once you’ve shown them the door.

You go through your numbers each month. You sit down with your team and review what’s working. You poke at your processes when something breaks. That’s normal business hygiene.

But there’s one thing on the books almost no one runs a proper audit on — and it’s the one most likely to be quietly costing you money.

It’s you. Specifically, your energy.

The hidden line item in your P&L

I’ve been in business long enough to notice a pattern. The weeks I sleep badly, eat rubbish, and skip my walk are the same weeks I send the email that lands the wrong way. Or I sit on a quote for three days when it should have gone out in three hours. Or I miss something obvious in a client conversation that I’d have caught when I was sharper.

None of that shows up on a balance sheet. But the cost is real. A deal that drifts. A client who feels half-listened-to. A reply that creates a problem instead of closing one.

You can’t see it in your numbers, but it’s in there. Every time.

No tactic survives a flat battery

Here’s the part people don’t want to hear: there’s no strategy, framework, or new hire that fixes a depleted owner. I see business owners trying to out-work, out-tool, or out-source their way around tiredness. It doesn’t work. The decisions still have to come through you, and the quality of those decisions tracks the quality of your sleep, your food, and your movement more closely than most of us care to admit.

And ironically, the tools we now have should make this easier, not harder. I use Copilot in Outlook to do the first pass on long replies, and Copilot in Teams to recap a meeting I half-listened to because the day got away from me. That’s not laziness — that’s protecting the limited number of sharp hours I actually have. Letting the machine do the rummaging means I get to spend my energy on the call that matters, not the inbox triage.

The same goes for the weekly running of the business. A clean Planner board, a proper SharePoint home for your documents, a few Power Automate flows handling the boring approvals — these aren’t productivity bling. They’re how you stop bleeding decision-making capacity on things that don’t deserve it.

Treat yourself like the asset you are

Run the audit on yourself the same way you’d run it on the business.

How did you sleep this week? When did you last move? What does the food in your kitchen actually look like? When was the last full day you took off — not “worked from home in a t-shirt”, but actually off?

I’m not pretending I get this right every week. I don’t. But when I notice the slide, I treat it the way I’d treat a leaking margin: stop, look at the inputs, fix what’s fixable. Block the walk in the calendar. Push the late meeting. Let Copilot draft the thing tonight so I can be in bed at a reasonable hour.

The business sits on top of you. If the foundation is shaky, nothing built on it is going to hold.

Audit the owner first.

Microsoft Secure Score is one of the most underused operational assets in the Microsoft 365 stack. Most MSPs know it exists. Most have shown it in a QBR. Most do not run it as part of service delivery.

That is the mistake.

If you manage Microsoft 365 for small and midsize businesses, Secure Score is not best understood as a dashboard, a maturity grade, or a client-facing marketing number. It is a Microsoft-maintained, impact-weighted queue of hardening actions, with tenant history, trend data, comparison data, and a Graph API. In practical terms, it is a free source of prioritized security work that many MSPs already pay for through the licenses they sell, then ignore in day-to-day operations.

For SMB-focused MSPs, that matters because the biggest failure mode is not the lack of security tools. It is the lack of an ownership loop. A control regresses, an exception gets added, a legacy app forces a bad compromise, or a policy quietly gets weakened to solve a ticket. Secure Score usually notices the change. The MSP often does not. The issue is not visibility. The issue is that the visibility never enters the workflow.

This article explains how to fix that. We will cover what Secure Score actually measures, why many MSPs do not trust it, where it is operationally useful, where it is incomplete, and how to turn it into a repeatable SMB security process instead of another unused portal tile.

What Microsoft Secure Score Actually Is

Microsoft defines Secure Score as a measurement of an organization’s security posture. A higher score means the tenant has taken more of Microsoft’s recommended actions. Microsoft is also explicit about what the score is not: it is not an absolute measure of breach likelihood, and it should not be treated as a guarantee of security.

That disclaimer is important because it is where many MSP conversations go wrong. When teams argue about whether the score is “accurate,” they are usually asking the wrong question. The useful question is whether the recommendation set helps you prioritize hardening work inside the Microsoft 365 estate. In that role, it is often very useful.

Secure Score groups improvement actions across major areas such as identity, devices, apps, and data. In the Defender portal, you also get historical views, comparison trends, regression tracking, risk acceptance trends, and benchmarks against similar organizations. In Microsoft Graph, the secureScore resource exposes tenant-level score data and control-level score data. Microsoft documents that the secureScores collection retains 90 days of data by default and is sorted by createdDateTime.

For an MSP, that means three things. Microsoft is already maintaining the recommendation model for you. The model is weighted, so high-impact items rise above low-value cleanup work. The data is retrievable, so you are not limited to screenshots and manual review.

Why MSPs Distrust Secure Score

The skepticism is not irrational. MSPs have good reasons to be wary of vendor scoring systems.

Secure Score can be gamed. Some controls can be marked as addressed by third-party solutions. Some organizations can push the percentage higher without meaningfully improving real-world resilience. Some recommendations align cleanly with Microsoft’s commercial interests. And a tenant can look respectable in Secure Score while still being weak against a framework-based assessment such as CIS Microsoft 365 Foundations.

All of that is true.

It is also beside the point if you use Secure Score correctly.

The score itself is not the deliverable. The recommendation queue is the useful artifact.

If you stop treating Secure Score as a grade to defend and start treating it as a stream of prioritized hardening opportunities, most of the common objections lose force. Whether the overall number is inflated matters much less when the MSP’s process is built around four operational questions:

1. What changed?
   

2. Which recommendation regressed?
   

3. Who owns the remediation?
   

4. Is the exception documented if the control cannot be implemented?

That is the shift SMB MSPs need. Do not sell the number. Operate the queue.

Why This Matters More in SMB Than Enterprise

Enterprise security teams can afford parallel governance structures, dedicated platform owners, and formal architecture boards. Most SMB MSPs cannot. They are working across dozens or hundreds of tenants with a small engineering team, limited time for advisory work, and constant pressure to resolve issues quickly without breaking line-of-business applications.

That environment creates predictable drift:

• MFA gets partially rolled back to support a legacy workflow.
  

• Conditional Access exclusions accumulate because no one wants to block the owner on Monday morning.
  

• POP, IMAP, or SMTP AUTH remains enabled longer than intended.
  

• Admin accounts sprawl because shared support habits were never fully cleaned up.
  

• Secure defaults are deferred until “after onboarding” and then never revisited.

Secure Score will not solve those cultural problems by itself. But it does give the MSP a standardized, per-tenant signal that the drift happened. That is useful when the alternative is discovering the gap after a compromise, an audit finding, or a cyber insurance questionnaire.

For SMB clients, the outcome you want is not elegant theory. It is repeatable motion: detect regressions, turn them into tickets, assign ownership, track exceptions, and report change over time.

The Best Way to Think About Secure Score

The most useful framing for an SMB MSP is this:

Secure Score is a free, Microsoft-maintained, prioritized work queue for Microsoft 365 hardening.

That framing is better than “dashboard” for several reasons.

It turns advisory data into service delivery work

Most MSPs already know how to manage queues. They know how to triage, assign owners, set SLAs, escalate blockers, and review aging items. Once Secure Score is treated as a work source instead of a summary chart, it can be managed with the same disciplines as patching, backups, or incident response.

It gives smaller MSPs prioritization they did not have to build themselves

Building a credible cross-tenant security backlog from scratch is expensive. Microsoft has already done a significant part of that work by maintaining a recommendation catalog and weighting system for the Microsoft 365 estate. That does not replace judgment, but it removes a lot of low-value manual triage.

It creates a missing ownership loop

This is the central operational gap in many MSP practices. Somebody reviews the score at QBR time. Nobody owns the regressions between reviews. A queue model closes that gap by creating named responsibility.

What Secure Score Is Good At

Secure Score is most useful for four operational jobs.

1. Baseline hardening of Microsoft 365 tenants

For Business Premium-heavy client bases, Secure Score is a practical way to identify incomplete baseline work in identity, email, collaboration, and access control. It is especially useful during onboarding and during the first 90 days after standardization.

2. Detecting configuration regression

The most valuable Secure Score capability for MSP operations is not the headline number. It is the visibility into changes, regressions, and trends over time. Microsoft documents history views, score changes, regression trends, and risk acceptance trends in the Defender portal. Those features support a simple but important operating model: when the score moves for a meaningful reason, someone should know why.

3. Supporting client communication

Clients generally do not want a pile of raw control language. They want to know whether their tenant is improving, where material gaps remain, and what decisions are blocked by budget, licensing, or business risk tolerance. Secure Score gives MSPs a way to show movement while still tying the discussion to concrete recommendations.

4. Feeding automations and downstream workflows

The Graph API is what makes Secure Score operationally interesting. The secureScore and secureScoreControlProfile entities mean the data can be extracted, normalized, compared, and pushed into PSA tickets, reporting systems, Power BI, or an internal security dashboard.

What Secure Score Is Not Good At

If you overstate Secure Score, you will lose credibility fast.

It is not a complete security program.

It is not a replacement for CIS-based assessment, conditional access architecture review, privileged identity strategy, incident response readiness, or broader governance work.

It is not proof that a tenant is secure.

It is not enough on its own for cyber insurance, regulated compliance, or board-level assurance.

And it does not reliably represent controls outside the parts of the Microsoft estate it can actually observe and score.

The correct role is upstream triage. If a tenant is weak in Secure Score, it is almost certainly not ready for anyone to pretend the security program is mature. If a tenant is strong in Secure Score, that is useful evidence of operational discipline, but it is still not the same thing as a framework-level assessment.

The MSP Operating Model: How to Turn Secure Score Into Real Work

If you want this to matter, you need a workflow, not a portal habit.

The simplest operating model for SMB MSPs looks like this.

Daily or scheduled collection

Pull each managed tenant’s latest Secure Score data on a schedule. For most SMB practices, daily is enough. The point is not constant polling. The point is to avoid relying on somebody remembering to open the Defender portal.

At minimum, collect:

• current score
  

• max score
  

• controlScores
  

• createdDateTime
  

• comparison data where available

Because Microsoft retains 90 days in the secureScores collection by default, MSPs that want trend history beyond that should store snapshots in their own reporting or data platform.

Change detection

Compare the latest data with the prior snapshot. You are looking for:

• newly regressed controls
  

• high-impact recommendations not yet addressed
  

• large score drops
  

• repeated exceptions on the same control

This matters more than chasing every available point. A tenant that loses 8 points because a meaningful identity control regressed deserves faster attention than a tenant sitting 12 points below your target because of a lower-priority backlog item.

Ticket creation

Do not create tickets for every single recommendation blindly. That becomes noise.

Instead, define queue rules such as:

• create a ticket when a control regresses
  

• create a ticket when a high-impact control remains open beyond a threshold
  

• create a project task when multiple related controls point to the same architectural gap
  

• suppress informational items that do not change the actual risk picture

For SMB MSPs, the PSA categories should be simple: remediation, client decision required, license blocker, accepted risk, and monitoring only.

Ownership and SLA

Every generated item needs one owner. Not a team. Not “security.” One owner.

If the ticket requires client approval, assign a technical owner internally anyway. The owner is responsible for moving the item to a decision, not just waiting for the client to act.

Review cadence

The cadence that usually works is:

• weekly internal review of new regressions and aging items
  

• monthly or quarterly client review of trend movement and blocked recommendations
  

• onboarding review for every newly managed Microsoft 365 tenant

Without this rhythm, the queue becomes another ignored data source.

What Good Looks Like for an SMB MSP

For most SMB-focused MSPs, “good” is not a perfect score. Good looks like operational discipline.

A mature practice usually has the following traits:

• a defined Business Premium baseline for standard clients
  

• a target Secure Score range by client profile, not one universal number
  

• documented exceptions where business requirements block a recommendation
  

• automated collection and comparison of score history
  

• tickets generated from regressions or materially important open actions
  

• reporting that shows trend, ownership, and blocked items rather than just a percentage

This is a much stronger position than telling clients, “Your Secure Score is 71%,” with no explanation of what changed, what remains open, and what the MSP is doing about it.

Practical Guidance for Business Premium-Centric Client Bases

Many SMB MSPs serve clients that standardize on Microsoft 365 Business Premium. That is a useful licensing position because it enables a meaningful portion of the high-value identity and security controls most small clients actually need.

In that environment, Secure Score becomes particularly effective as a baseline enforcement tool.

Examples of actions that usually deserve attention early include:

• enforcing MFA for admins and users where appropriate
  

• blocking or reducing legacy authentication exposure
  

• implementing Conditional Access with minimal, well-governed exclusions
  

• hardening privileged roles and admin account practices
  

• reviewing risky exceptions in Exchange, SharePoint, Teams, and collaboration settings
  

• tightening access paths that grew organically during onboarding or support work

The goal is not to squeeze every point out of the platform. The goal is to reach a defensible, supportable baseline and then catch drift quickly.

A Practical Graph API Pattern for MSPs

The technical unlock is Microsoft Graph.

Microsoft documents the Secure Score entities in the Graph security API, including secureScores and secureScoreControlProfiles. That means an MSP can stop relying on manual portal checks and start pulling the data into its own tooling.

At a high level, the pattern is:

1. authenticate to Microsoft Graph for the tenant context you manage
   

2. pull the latest secureScores data
   

3. store a normalized daily snapshot
   

4. compare the latest snapshot to the previous one
   

5. create or update PSA records based on meaningful changes

For example, the REST path for score history is:

GET https://graph.microsoft.com/v1.0/security/secureScores?$top=1

And for a specific score object:

GET https://graph.microsoft.com/v1.0/security/secureScores/{secureScoreId}

If you prefer PowerShell, a lightweight pattern with the Microsoft Graph PowerShell SDK is:

Import-Module Microsoft.Graph.Beta.Security

$latestScore = Get-MgBetaSecuritySecureScore -Top 1

$latestScore | Select-Object createdDateTime, currentScore, maxScore, vendorInformation

That example is intentionally simple. In production, an MSP should enrich it by extracting the control-level detail, normalizing the tenant identifier, storing the snapshot outside the 90-day retention window, and mapping meaningful changes to ticket logic.

Two cautions matter here.

First, the partner security score API is still documented in Graph beta. Microsoft explicitly notes that beta APIs can change and are not supported for production use. That makes it appropriate for research, internal visibility, and forward planning, but not something you should build a fragile client-facing dependency around without a fallback.

Second, do not confuse “we can query the score” with “we have an operational program.” The code is the easy part. The service workflow is the real work.

The Emerging MSP Angle: Microsoft Is Starting to Score the Partner Too

This is the part many MSPs are still underestimating.

Microsoft’s partner security score API preview exists to help partners understand the posture of their own tenant and their customer tenants. That is strategically important because it suggests the market is moving from optional tenant-level scoring toward partner-level accountability.

Even if the preview evolves before it reaches broader production maturity, the direction is clear. Microsoft wants partners to improve, monitor, and evidence security posture across customer estates, not just their own internal environment.

For SMB MSPs, the implication is straightforward: if you do not already have a method for turning customer posture data into operational action, you will eventually be judged as if you should.

Common MSP Mistakes to Avoid

There are a handful of failure patterns that show up repeatedly.

Showing the score without showing the work

If the QBR slide says 74% but you cannot explain the top regressions, top blockers, and next remediation steps, the number is decorative.

Chasing percentage points instead of risk reduction

Not every available point has equal operational value. Some changes are cheap but noisy. Some are strategically important but require client sign-off, licensing, or rollout planning. Mature MSPs do not let the metric outrank judgment.

Treating exceptions as invisible

Accepted risk is still risk. If a recommendation cannot be implemented because of a legacy app, business process, or licensing constraint, document it cleanly and review it on a schedule.

Leaving the score in the portal

If the only place Secure Score lives is inside someone’s browser tab, it is not part of operations. Export it, compare it, and attach action to it.

A 30-Day Rollout Plan for a Small MSP Team

If your MSP wants to operationalize Secure Score without overengineering it, use a staged rollout.

Week 1: Define the baseline

Decide which tenant types you serve and what “good enough” means for each. Separate standard Business Premium SMBs from regulated or higher-risk clients. Define which control categories matter most and which exceptions require formal documentation.

Week 2: Collect and store the data

Pull the latest Secure Score snapshots for a pilot group of tenants. Store the results somewhere you control so you keep history beyond Microsoft’s default retention window.

Week 3: Build ticket rules

Start with one rule only: create a ticket for meaningful regressions. Do not begin by flooding the PSA with every open recommendation. Tune for signal first.

Week 4: Review and report

Run the first internal security review. Validate that the created tickets were useful, not noisy. Adjust thresholds, add owner fields, and prepare a client-facing summary that focuses on movement, blockers, and decisions.

That is enough to move from passive observation to active management.

The Real Opportunity for SMB MSPs

The opportunity here is not that Secure Score is a perfect metric. It is that it is an available one, already present in the client estate, backed by Microsoft-maintained recommendations, visible in the Defender portal, and accessible through Graph.

For SMB MSPs, the winning move is not to argue endlessly about whether the number deserves trust. The winning move is to extract operational value from the recommendation set faster than competitors do.

The MSP that uses Secure Score as a workflow input can prove ownership, detect regressions, preserve history, and tie security posture directly to tasks, exceptions, and client decisions. The MSP that uses it only as a QBR screenshot gets none of that.

Secure Score is not the security program.

It is the free upstream queue that tells you where your Microsoft 365 hardening work should start, where it slipped, and where someone in your team needs to act next.

That is more useful than a dashboard. It is the beginning of an operating model.

Sources

• Microsoft Learn, Microsoft Secure Score
• Microsoft Learn, Assess your security posture with Microsoft Secure Score
• Microsoft Learn, Track your Microsoft Secure Score history and meet goals
• Microsoft Learn, secureScore resource type
• Microsoft Learn, Get secureScore
• Microsoft Learn, Microsoft Graph security API overview
• Microsoft Learn, Partner security score API overview (preview)