Secure Score vs a Microsoft 365 assessment
Vitals vs Microsoft Secure Score
Vitals reads each customer’s Secure Score and prints it in the report, beside its own findings. The two measure different things. Here is what each one is for.
Secure Score is not trying to answer the same question. It scores a tenant against Microsoft’s recommended controls; Vitals asks which customers need attention, why, what changed, and what to discuss next. Most MSPs need both views, which is why Vitals includes Secure Score rather than trying to replace it.
Is Microsoft Secure Score enough?
For what it measures, yes. The question is whether what it measures is everything you need to know about every customer.
Use Secure Score for
The controls Microsoft recommends, in Microsoft’s own portal, kept by the people who run the tenant. It is free, it is theirs, and Vitals reports it rather than replacing it.
Use Vitals for
The questions Secure Score does not ask, across every customer you look after: who needs attention, why, what changed, what to discuss next, and where your services fit. With evidence, for the person who is not going to log in to a portal.
Use both when
Somebody outside the tenant needs to see where it stands. Secure Score is a number the administrator watches; the Vitals report is a document the director reads, and it carries the Secure Score inside it.
Side by side: Secure Score and Vitals
What Secure Score is, as Microsoft describes it, against what Vitals is.
| Microsoft Secure Score | Vitals | |
|---|---|---|
| What it measures | Microsoft Secure ScoreYour tenant against Microsoft’s recommended security controls, as points out of a maximum. | VitalsEach customer’s tenant against 26 checks across identity, email, content, licensing and workplace, including Secure Score itself, with an outcome for a controlled Copilot pilot. |
| Where it lives | Microsoft Secure ScoreThe Microsoft Defender portal, for whoever has access to that tenant. | VitalsThe partner portal, every customer in one order of attention, and a paginated report for each, written for whoever decides what happens next. |
| What it says about a finding | Microsoft Secure ScoreThe control, the points available, and Microsoft’s implementation guidance. | VitalsThe finding, the evidence it was read from, why it matters in plain English, what to do, and whether it was read directly or inferred. |
| Email domain protection | Microsoft Secure ScoreNot covered: SPF, DKIM and DMARC are DNS records, outside the tenant. | VitalsEvery custom domain checked in public DNS: who can send as you, and whether anything stops them. |
| What you already pay for | Microsoft Secure ScoreRecommends controls; does not compare entitlement with use. | VitalsReads subscriptions and service plans against what is switched on: device management licensed for sixty-nine, fourteen enrolled. |
| Content and sharing | Microsoft Secure ScoreNot covered at file level. | VitalsThe largest sites crawled for anonymous links, organisation-wide sharing, unlabelled and stale content, with the share of content covered stated. |
| Change over time | Microsoft Secure ScoreA history chart of points. | VitalsWhat changed in the customer’s tenant since the last report they were sent, kept apart from what Vitals can now see or reads differently. |
| Who operates it | Microsoft Secure ScoreYour administrators, in each tenant. | VitalsNobody operates it. Vitals reads each tenant on consent the customer can withdraw: every quarter for a partner’s subscribed customers, or once for a single assessment. |
| Price | Microsoft Secure ScoreIncluded with Microsoft 365. | VitalsFrom £99 a month for MSPs, or a single assessment. The bands and the one-tenant routes are on the pricing page. |
Microsoft Secure Score is a Microsoft product; the description of it here is drawn from Microsoft’s own documentation. Vitals is not affiliated with or endorsed by Microsoft.
Management consoles
Not a console either.
Management consoles help operate Microsoft 365 tenants. Vitals reads Microsoft 365 evidence and tells the MSP which customers need attention, why, and what to discuss next.
Microsoft 365 Lighthouse, CIPP and tools like them are where an MSP does the work: baselines, policies, users, licences. Vitals does not connect to them and does not replace them. It reads each customer’s tenant directly, on the customer’s own read-only consent, and hands your team the evidence, the reason and the conversation. The work still happens where it always did.
What the assessment covers
Vitals runs 26 checks across five areas, including Secure Score itself. See how it works, see pricing, or read about Vitals security and access.
See both numbers in one report.
The sample report is published in full. Microsoft’s Secure Score is on the security baseline page, beside the checks Vitals runs beyond it.