Review Secure Score and Entra recommendations periodically

Description

At least every {{ posture_review_interval_days }} days, the security team reviews Microsoft Secure Score (Microsoft Defender portal) and Microsoft Entra recommendations. Each open recommendation is either remediated, planned with an owner and a date, or accepted as a risk with a recorded justification (status Risk accepted or Planned in Secure Score, Dismissed or Postponed with a reason in Entra). The score trend and decisions are reported to the security officer.

Rationale

Microsoft adds checks as the platform changes (new features, new attack techniques). A baseline applied once drifts: settings are changed, new workloads arrive. A regular review of the vendor's own recommendations is a cheap way to catch drift between full audits and to keep exceptions documented.

Impact

A few hours of work per review. Some Entra recommendations require Entra ID P2 to be displayed.

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader, browse to Exposure management > Secure Score (or Secure Score) > Recommended actions, and check that open actions have a status other than To address or a recent history entry.
2. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader, browse to Entra ID > Overview > Recommendations, and check that active recommendations are being handled or dismissed with a reason.
3. Graph alternative (read only): GET https://graph.microsoft.com/v1.0/security/secureScores?$top=1 and GET https://graph.microsoft.com/beta/directory/recommendations.
4. Ask for the last review record (minutes, ticket, report).
5. Fail if no review took place in the last {{ posture_review_interval_days }} days, or if high-impact recommendations stay To address without owner or decision.

Remediation

1. Schedule a recurring review every {{ posture_review_interval_days }} days with an owner in the security team.
2. During each review, process every new or open recommendation: remediate, plan with an owner, or set Risk accepted with a justification in Secure Score and dismiss with a reason in Entra recommendations.
3. Record the score trend and decisions, and report them to the security officer.
4. Roles required to change statuses: Security Administrator (Secure Score), Security Administrator or Global Administrator (Entra recommendations).

Rollback

Not applicable.

References

• Microsoft Secure Score Microsoft, vendor-doc, accessed 2026-10-24
• What are Microsoft Entra recommendations Microsoft, vendor-doc, accessed 2026-10-24
• Maester MT.1024 Maester, tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-AUDIT-011 Connect Microsoft Defender for Cloud Apps to Microsoft 365 and enable its policies

People and lifecycle