What Compares Microsoft 365 Security Configurations to Best Practices?
You have a Microsoft 365 subscription that uses Microsoft 365 Defender. You need to compare your company's security configurations to Microsoft best practices and review improvement actions to increase the security posture. What should you use?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests recognition of the two unique Secure Score capabilities — comparing configurations to Microsoft baselines and producing improvement actions — while the trap is picking another Defender risk metric (Exposure score) that sounds like a posture measure but only grades attack surface risk.
Microsoft Secure Score is the Microsoft 365 Defender feature that benchmarks your tenant's security configuration against Microsoft best practices and returns prioritized improvement actions. This page confirms why Secure Score, not Exposure score or Threat tracker, is the answer to this MS-102 posture question.
The most tempting wrong choice is Exposure score, because it is also a Defender posture percentage; however it rates device and identity attack surface risk in Defender Vulnerability Management and never benchmarks tenant configuration against Microsoft baselines or lists improvement actions.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Microsoft Secure Score is the only Microsoft 365 Defender capability that measures your tenant's current security configuration against Microsoft's recommended baselines and returns a percentage score plus a ranked list of improvement actions. The question contains both triggers verbatim in concept: "compare your company's security configurations to Microsoft best practices" and "review improvement actions to increase the security posture". Secure Score also shows points achieved versus points available, so an administrator can track whether remediation actually raises the score over time. Because it aggregates signals from Microsoft 365 services such as Exchange Online, SharePoint, Microsoft Entra ID and Defender workloads, it is the tenant-wide benchmark the scenario asks for. Every recorded learner vote (100 in total) landed on Microsoft Secure Score, and the cited Microsoft Learn page describes exactly this behavior.Why the Other Options Are Wrong
Cloud discovery is a Defender for Cloud Apps feature that catalogs shadow IT and SaaS usage, so it reveals which apps are in use rather than how well the tenant is configured. Exposure distribution and Exposure score belong to Defender Vulnerability Management and quantify the attack surface risk of devices and identities; they do not compare tenant settings against a Microsoft baseline and produce no improvement action list. Threat tracker follows threat actor activity and campaigns in Defender for Cloud Apps, which is threat intelligence rather than configuration benchmarking. None of these four options offers the paired "best-practice comparison plus improvement actions" behavior the question requires.Community Comment Notes
arsh807 answered simply "Easy." and linked the Microsoft Secure Score documentation, which matches the tool named in option A. TonyTe0 and SBGM both replied "Correct" while pointing to the same Learn article, and Khattak3143 summarized the mood with "A all the way!!!". All 100 votes went to Microsoft Secure Score, so there was no community disagreement to weigh — but the deciding factor remains the wording of the question, since the tool must both benchmark against Microsoft best practices and list improvement actions.Official Reference
Exam Strategy
When a question asks you to compare configurations against Microsoft best practices and then act on improvement actions, lock onto Microsoft Secure Score immediately. Reserve Exposure score and Exposure distribution for device or identity attack-surface risk questions, and Cloud discovery or Threat tracker for Defender for Cloud Apps shadow-IT and threat-actor scenarios.
Frequently Asked Questions
Why is Exposure score (E) not the same as Microsoft Secure Score?
Exposure score rates the attack surface risk of devices and identities in Defender Vulnerability Management. It never compares tenant configuration to Microsoft baselines or produces improvement actions.
Does Microsoft Secure Score cover Defender for Cloud Apps recommendations?
Yes. Secure Score aggregates recommendations across Microsoft 365 services, including Defender for Cloud Apps, so some improvement actions relate to cloud app governance.
Related Analysis
Practice All MS-102 Questions
Access 111 questions with complete answers and detailed explanations.
View Full MS-102 Practice Test →