In many of the tenants I review, the Identity Secure Score in Entra ID is still treated as a number on a dashboard. It looks good in quarterly reports, but it rarely leads anyone to actually do something. I think that's a missed opportunity. The Microsoft Entra recommendations (in the Entra admin center under 'Identity → Overview → Recommendations') make a very usable to-do list, provided you take them seriously and work through them on a regular schedule.

The recommendations are easy to find and more specific than most admins expect

A surprising number of admins come across the recommendations by accident. Still, a monthly look at this section is one of the cheapest ways to keep identity hygiene in shape. These aren't vague best-practice tips. Each one is actionable and sits in a category such as "Remove unused applications", "Renew expiring credentials" or "Migrate from legacy MFA". You also get the risk impact and direct links to start fixing the issue. Every recommendation carries a status (active, completed, dismissed, postponed), so you can track progress or write down why something isn't being handled right away. The same themes keep coming up in my work: getting rid of legacy MFA (phone, SMS) for privileged accounts, cleaning up old app registrations, and making sure admin accounts really are protected with phishing-resistant MFA. These are exactly the things that get lost in day-to-day operations.

Most recommendations are more practical than you might expect

Once you open the list, you'll find that most items are down to earth and nothing theoretical. These are the suggestions I see most often:

  • Reviewing and removing unused app registrations
  • Renewing expiring secrets and certificates
  • Migrating from legacy MFA methods or policies
  • Enabling phishing-resistant MFA for admin accounts
  • Setting up Conditional Access for critical applications

Many of them send you to other parts of the Entra admin center, or to related tools such as the Microsoft Defender or Intune portals. The Identity Secure Score reflects how far you've got with these items. The actual benefit, though, comes from treating this as a monthly routine and not as a one-time project.

Practical tip: Schedule a monthly admin team session to review Entra recommendations, update statuses, and assign tasks. Don't let old to-dos pile up – and focus first on items with the biggest risk reduction.

Four statuses keep the work organized across admins

The status field matters more than it looks, especially when several admins share the work. 'Active' marks open items. 'Completed' is often set automatically once Microsoft detects the fix, for example after you remove an app or enforce strong MFA for admins. 'Dismissed' covers recommendations that just don't apply to you, such as a rarely used legacy app you can't do without. 'Postponed' works well for things you plan to handle after an audit or a quarterly review. You can filter by status in the portal and record your reasoning, which makes reporting on progress and decisions straightforward.

The Identity Secure Score covers less ground than the Microsoft Secure Score

I'm often asked which of the two scores counts. The Identity Secure Score in Entra looks only at identity: authentication, app registrations, credentials, Conditional Access. The Microsoft Secure Score in the Defender portal spans M365 apps, endpoints, cloud apps, compliance and devices. The two overlap, but each also has items the other doesn't. I use both as a guide, but I don't chase every last point. What counts is knowing why a recommendation is there (expiring app secrets, for instance) and what it means for your own environment. If you want more detail, the official Entra recommendations overview is a good place to look.

Microsoft Graph returns the recommendations for dashboards and automation

In larger or automated environments, you may want to pull open recommendations through the API to feed dashboards or trigger workflows. Microsoft Graph handles this, as long as you have the right role (Global Reader or Security Reader) and app permissions. This is a typical call that returns all recommendations:

GET https://graph.microsoft.com/beta/identityProtection/identitySecureScore/recommendations

You'll need an app registration with Directory.Read.All or comparable rights. At the start of 2025 the API was still in beta, but it runs reliably against real tenants and is well suited to reporting, dashboards or automated reminders.

A monthly routine stops the slow drift into risk

Identity risks rarely show up all at once. They build up gradually through new app integrations, forgotten test accounts and legacy MFA that stayed behind after a rollout. In nearly every project I've seen, a monthly checkpoint on the Identity Secure Score recommendations keeps the team ahead of things instead of cleaning up surprises after a breach. The score itself matters less than actually getting through the high-impact items ("Protect privileged accounts with phishing-resistant MFA!").

This diagram shows the loop I typically follow for recommendations, statuses and follow-up:

flowchart TD
    Find["Find recommendations"] --> Assess["Assess (impact, relevance)"]
    Assess --> Status["Set status (active, completed, dismissed, postponed)"]
    Status --> Remediate["Remediate" ]
    Remediate --> Verify["Verify remediation"]
    Verify --> Find

Figure: Recommendation cycle for Identity Secure Score in Entra ID.

If you want more on hands-on identity protection, have a look at my posts on getting started with Conditional Access and, for apps and credentials, workload identities and managed identities in Entra ID.

I treat the Identity Secure Score as a compass for daily work

For me, the Identity Secure Score isn't a target in itself. It points the direction. You review the recommendations, set priorities, keep the statuses current and don't neglect the basics, and that is what turns the score from a dashboard decoration into actual security. Make it a monthly habit and the biggest risks won't slip out of view. The aim isn't to tick every box. It's to keep doing the right things, month after month.