Home Blog Why Your Microsoft 365 Secure Score is Stuck (and How ISPM Fixes It) Published: June 17, 2026 Why Your Microsoft 365 Secure Score is Stuck (and How ISPM Fixes It) By: Aimee Simpson Scott Riley Summarize with AI Summarize ChatGPT Claude Perplexity Google AI Microsoft 365 gaps rarely announce themselves. Risk builds quietly in the background. An admin account accumulates more access than it needs. A Conditional Access policy gets a "temporary" exception that never gets revoked. A licensing change shifts a default setting, and nobody catches it for weeks. None of that feels like a big problem in the moment. But over time, those small gaps add up to exactly the kind of exposure attackers go looking for. That's what Identity Security Posture Management, or ISPM, is built to address. ISPM helps teams find those gaps before attackers do and, more importantly, close them. What is ISPM? ISPM is the practice of continuously assessing and hardening your identity environment. It looks at your configurations, policies, permissions, and account settings, then checks them against a defined security baseline on an ongoing basis. For Microsoft 365, that means evaluating things like Entra, SharePoint, and Exchange, where exposure can quietly take hold. The core question ISPM keeps asking is, “Does the access and configuration that exists in my environment right now create a security risk? A one-time audit only gives your team a snapshot. But ISPM gives you a continuously updated answer, one that evolves as your Microsoft environment, users, and settings change over time. Visibility is useful. Hardening is the actual work. This is where a lot of posture programs run into trouble. Visibility tools can tell you what's misconfigured, which controls are missing, and where your Secure Score falls short. That information has real value. But you still can't fix what you can't see. A list of findings doesn't fix anything by itself. After visibility, your team still has to prioritize the work. Someone has to decide which issues to address, figure out how a policy change will affect users, roll it out without breaking workflows, watch for drift, and document that the improvement actually stuck. But, as you might expect, most teams already have a full plate. And that's exactly why hardening stalls. Not because teams don't care, but because going from "here's what's wrong" to "it's fixed and will stay that way” requires more capacity and expertise than a dashboard provides. Effective ISPM helps teams move from awareness to action, then keeps checking that those actions hold. Huntress findings from the environments we evaluated Drift: Why Microsoft 365 hardening is harder than it looks Microsoft 365 doesn't sit still. Users join and leave. Roles change. Admins create exceptions to keep work moving. And not to mention Microsoft regularly updates defaults, features, and licensing tiers. Every one of those changes can quietly reopen the kind of gaps that show up in posture assessments. This is called “drift.” Your environment slowly moves away from the security posture your team intended, a little at a time, until there's meaningful exposure that nobody knew was there. Huntress found this consistently in the environments we evaluated: More than 60% of tenants were missing over half of Huntress-recommended controls. 55% of organizations allowed standard users to perform admin-level functions. In market research , we learned 45% had experienced a security incident caused by a misconfiguration in the past year. These weren't neglected environments. Many had tooling in place. The issue is that posture needs constant upkeep, and most tooling just surfaces the work rather than doing it. The risk of knowing and not acting Identity gaps are an active attack surface. Weak multi-factor authentication (MFA), overprivileged accounts, policy drift, and stale permissions all create paths that attackers use every day. The attacks that follow—account takeover, business email compromise (BEC), privilege escalation—don't require sophisticated techniques. They just require finding openings that are already there. The timing problem sharpens this. Microsoft data shows the average time from initial intrusion to lateral movement is 48 minutes. If your team is running daily or weekly posture scans, you're finding out about risky changes well after the attacker could’ve gained a foothold. There's also the expertise gap. Properly hardening identity posture requires deep Microsoft knowledge. Most teams don't have a dedicated Microsoft 365 identity specialist on staff. And even the teams that do often can't keep up with every Microsoft update, every exception that crept in, and every licensing change that shifted a default. Fear of disruption compounds the problem. When teams aren't confident about how a policy change will affect users, they delay the rollout. Known gaps stay open because enforcing the fix feels riskier than leaving things as-is. It's a rational hesitation that quietly stalls security programs for months. And increasingly, there's the proof problem. Cyber insurance renewals, compliance audits, leadership questions, and MSP client conversations all require evidence that identity posture is actively managed. Without automation, collecting that evidence is a manual project every time it's needed. Snapshot of the Managed ISPM dashboard Moving from awareness to actual hardening If your Secure Score indicates identity gaps but your team can't consistently close them and keep them closed, that's not a visibility problem. That's a hardening problem. Identity resilience means finding gaps before attackers do, closing them safely, and maintaining that posture as your environment keeps changing. It requires ongoing work, not just an automation tool with static baselines. Huntress Managed ISPM is built to solve the challenges that leave Secure Scores stuck below targets. Rather than surfacing a to-do list and handing it back to your team, it defines the gold standard for Microsoft 365 hardening, deploys the right controls, and enforces them continuously. Drift detection runs within minutes of a change hitting Microsoft logs, not on a 24-hour scan cycle like others on the market. And Learning Mode shows user impact before a policy goes live, so the controls that have been sitting on your backlog can actually get turned on without the fear of locking people out. If your Secure Score has stalled and the backlog keeps growing, the problem probably isn’t effort. It’s the gap between knowing what needs to change and having the capacity to keep identity posture hardened over time. Thinking about ISPM? Start here. Download The Practical Buyer's Guide to ISPM for a logical framework to compare solutions. It covers the capabilities that separate real hardening from posture visibility, how managed and self-managed approaches stack up, and the questions worth asking any vendor before you commit. And if you're ready to see it in your environment, demo Managed ISPM today. Summarize with AI Summarize ChatGPT Claude Perplexity Google AI Categories Cybersecurity Education How do cybercriminals end up in handcuffs? On July 28, join John Hammond for a special episode of _declassified and get a rare glimpse into a state-backed hacking campaign that turned into a rare win for defenders. Register now Share You Might Also Like Shifting Left: Huntress Expands Into Proactive Security Posture Management Huntress "shifts left" with Managed ESPM and Managed ISPM. We proactively harden your endpoints and identities to close the security gaps that attackers love to exploit. Learn More Attackers Love Your VPN To-Do List VPN misconfiguration is behind 70% of intrusions. See real Huntress SOC incidents and learn the simple steps to close your biggest open door before attackers walk through it. Learn More Cloudy with a Chance of Misinformation: Debunking Microsoft 365 & Identity Myths Don’t fall for common Microsoft 365 identity security myths. Here, Huntress debunks misconceptions around logins, MFA, Conditional Access, Impossible Travel, and security tuning. Learn More Huntress MDR for Microsoft 365: The Full Story Read up on how and why Huntress built its Managed ITDR (formerly MDR for Microsoft 365) solution to help combat the growing threat of business email compromise (BEC). Learn More 19 Cloud Security Challenges and How to Mitigate Risk Learn about some of the most common cloud security challenges facing modern businesses today, plus why it matters for you and your employees. Learn More Huntress MDR for Microsoft 365 Update An update on our MDR for Microsoft 365 product, some recent improvements, and what fixes and features are coming soon. Learn More What I Took Away from Gartner Security & Risk Management Summit 2026 Resilience, identity, and practical AI led the conversation at Gartner Security & Risk Management Summit 2026. Here are five key takeaways security leaders should act on. Learn More Exposed RDP: The Misconfiguration that Keeps Paying Off Exposed RDP is still one of the most reliable ways attackers get in and most teams don't know it's open. See real cases where it was caught before it became a catastrophe. Learn More Sign Up for Huntress Updates Get insider access to Huntress tradecraft, killer events, and the freshest blog updates. Business Email* Privacy • Terms Submit By submitting this form, you accept our Terms of Service & Privacy Policy