Microsoft Defender for Cloud: Challenges in Improving Subscription's Secure Score — Need Guidance

Question

Microsoft Defender for Cloud: Challenges in Improving Subscription's Secure Score — Need Guidance

GC-7046 0

Problem description

I am trying to increase my subscription's Secure Score in Microsoft Defender for Cloud. Despite remediating most critical and high-severity recommendations, and deleting unused container images, I haven't observed a significant increase in the overall Secure Score. Additionally, some recommendation categories display a potential score impact but have no active findings, making it unclear which actions will most effectively improve the score.

Environment

Microsoft Defender for Cloud, using the Recommendations portal, subscription level, in a cloud environment.

What I've already tried

I have applied remediations for critical and high-severity findings, deleted unused container images, and compared the classic Secure Score portal with the new Recommendations portal. I have tried enabling the "Secure Score Over Time" workbook, but have not seen any data appear specifically around the score metrics. Only the "Top recommendations with recent increase in unhealthy resources" returns any findings, which does not help me in the spirit of prioritizing work towards improving the score.

Current status

I am seeking guidance on how to effectively prioritize actions to improve my Secure Score and whether the current scoring methodology accurately reflects the security posture, especially given the discrepancies and lack of impact observed after remediation efforts.

Jose Benjamin Solis Nolasco 12,036 Reputation points Volunteer Moderator

2026-08-25T20:26:57.32+00:00

@GC-7046 Welcome to Microsoft Q&A,

I hope you are doing well.

I think the way you are handling it is good. There are several ways to approach this, but I prefer working with Critical Vulnerabilities from software, or by updating them directly. After fixing them, Defender may take about 2–3 days to reflect the changes.

It also depends on the workstation or server, and whether it is responsive to Defender at the time.

1 answer

Your answer

Jose Benjamin Solis Nolasco 12,036 Reputation points Volunteer Moderator

2026-08-25T20:26:57.32+00:00

@GC-7046 Welcome to Microsoft Q&A,

I hope you are doing well.

I think the way you are handling it is good. There are several ways to approach this, but I prefer working with Critical Vulnerabilities from software, or by updating them directly. After fixing them, Defender may take about 2–3 days to reflect the changes.

It also depends on the workstation or server, and whether it is responsive to Defender at the time.

Answer 1

Dear @GC-7046

The behavior you're seeing can be expected, because Defender for Cloud Secure Score should not be interpreted simply as a count of remediated Critical or High recommendations.

Secure Score is calculated at the security control level. Each control has a maximum possible score, and the score you currently receive depends on how much of that control has been satisfied across the applicable resources.

Because of this, remediating a large number of individual recommendations does not necessarily produce a proportional increase in the overall score. A recommendation may also have a relatively small impact on the total score, even if it is classified as High or Critical.

I would therefore recommend using Security controls --› Current score / Potential score as the primary way of prioritizing remediation. Look for controls with a significant remaining score gap and then drill down into the recommendations contributing to that gap.

The situation where a category shows potential score impact but currently has no active findings can also be confusing. The potential score represents the improvement available from that control; it should not be interpreted as meaning that there must currently be unhealthy resources behind it.

One other important point is that Secure Score is not necessarily recalculated immediately after remediation. Defender for Cloud needs to reassess the affected resources, so I would allow some time and then verify both the recommendation status and the control score.

For troubleshooting, I would compare these three things rather than relying only on the overall percentage:

Security control --› current score vs. maximum score
Recommendations contributing to the control
Number of affected resources before and after remediation

This usually gives a much clearer picture of why the overall score has (or has not) moved.

If the recommendations are showing as healthy, the affected resources have been successfully reassessed, and the corresponding security control score still does not change, then I would investigate that specific control/recommendation rather than the overall Secure Score.

If this answers your query, please click Accept Answer and Upvote if you found it helpful. If you have any further questions, feel free to let us know.