Factors Affecting Microsoft Entra Identity Secure Score

AB-900 By islever Editorial Last updated

Understand the Microsoft 365 security principles Identify the core security features of Microsoft 365 services

Short answer

BC The number of global administrators and passwords that are never expired affect the Identity Secure Score.

Question

Your organization has a Microsoft 365 subscription.
You need to evaluate your organization’s Identity Secure Score.
Which two factors affect the score? Each correct answer presents a complete the solution.
NOTE: Each correct selection is worth one point.
  1. the SharePoint site permissions
  2. the number of global administrators Correct Answer
  3. passwords that are never expired Correct Answer
  4. the location of the users

Key Takeaways

The Identity Secure Score focuses exclusively on identity-related security controls, such as privileged access management and password policies, rather than general data or network settings.

Learn which factors impact the Microsoft Entra Identity Secure Score. The correct answers are the number of global administrators and whether passwords are set to never expire.

Common mistake: Option A (SharePoint permissions) is a common distractor because it relates to security, but it falls under data protection, not identity security. Option D is irrelevant to the specific calculation of identity health metrics.

Expert Analysis

The Identity Secure Score in Microsoft Entra ID (formerly Azure AD) is a metric that measures how well an organization implements identity-related security controls. It provides recommendations to improve the security posture of identities within the tenant.

To determine which factors affect this score, we must look at what constitutes an "identity" risk:

  1. Number of Global Administrators: Having too many users with permanent Global Administrator privileges is a significant security risk. The Identity Secure Score specifically evaluates the ratio of Global Admins to total users and recommends reducing the number of standing admins or using Privileged Identity Management (PIM). Therefore, the count of global administrators directly impacts the score. This makes option B correct.
  2. Password Policies: Weak password configurations are a primary target for identity attacks. The Identity Secure Score includes recommendations related to password complexity, expiration policies, and the use of modern authentication. Specifically, allowing passwords that never expire is considered a weak control because compromised credentials remain valid indefinitely. Enforcing regular password rotation improves the score. Thus, option C is correct.

Why other options are incorrect:

  • SharePoint site permissions (A): These relate to data governance and access control within SharePoint Online, not identity security. They would be evaluated under Data Secure Score or Purview metrics, not Identity Secure Score.
  • Location of users (D): While geographic location might influence Conditional Access policies (e.g., blocking logins from high-risk countries), the mere physical or logical location of users is not a direct factor in calculating the Identity Secure Score itself. The score focuses on configuration and enforcement of security controls, not user demographics.

In summary, the Identity Secure Score is driven by identity-specific configurations such as admin roles and password lifecycle management.

Exam Strategy

When answering questions about Secure Scores, always identify the category of the score (Identity vs. Data vs. Compliance). For Identity Secure Score, focus on authentication methods, role assignments, and credential policies. Eliminate options related to file storage, network infrastructure, or user attributes like location unless they directly tie into identity validation rules.

Frequently Asked Questions

What does the Identity Secure Score measure?

It measures how well you have implemented identity-related security controls in Microsoft Entra ID, providing recommendations to reduce risks.

How can I improve my Identity Secure Score?

You can improve it by enabling multi-factor authentication, reducing the number of Global Administrators, enforcing strong password policies, and implementing Conditional Access.

More AB-900 FAQ →

Community Votes

B
50%
C
50%

50% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. omath 👍 5
    For Identity Secure Score, Microsoft evaluates how well your organization is implementing identity‑related security controls in Microsoft Entra. The two factors that directly affect the score are: ✅ B. the number of global administrators Having too many permanent Global Admins reduces your score. Reducing standing privilege and using PIM improves it. ✅ C. passwords that are never expired Password policies (including whether passwords expire or not) impact the score. Modern guidance prefers passwordless, but in Secure Score, “passwords never expire” still counts as a negative unless compensating controls exist.
  2. AnonymousJhb 👍 3
    correct
  3. Maria Camila Aristizabal 👍 1
    B. the number of global administrators C. passwords that are never expired

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Entra ID Security Group Capabilities and Exchange Mailbox Permissions

S-grade

Microsoft 365 Global Reader Role Permissions Analysis

S-grade

Configuring App Registrations for Third-Party Authentication in Microsoft Entra ID

S-grade

Exchange Admin Center Tasks: Mail Flow Rules and Shared Mailboxes

A-grade

← Back to AB-900 Study Guide