Microsoft Defender for Cloud: Security Score Not Improving After Remediation — Troubleshooting Persistent Score Issue

Question

Microsoft Defender for Cloud: Security Score Not Improving After Remediation — Troubleshooting Persistent Score Issue

Sumanth Myakala (NON EA SC ALT) 10 Microsoft Employee

Problem description

I am experiencing an issue where my Security Score in Microsoft Defender for Cloud has not increased despite completing multiple remediation steps for active security recommendations. I remediated specific recommendations, such as configuring storage accounts to use private link connections, but the score remains unchanged.

Environment

The affected environment includes Microsoft Defender for Cloud on Azure, with resources across multiple subscriptions. The subscription in question is associated with Azure Security Benchmark initiatives, and Defender plans are enabled.

What I've already tried

I have remediated several security recommendations, including private link configurations. I verified that the recommendations are no longer visible in Defender for Cloud, and I have checked the status of the Azure Security Benchmark initiative assignment, registration of the Microsoft.Security resource provider, and the activation of Defender plans. I also triggered a manual compliance scan using az policy state trigger-scan, but the Security Score still did not improve. Additionally, I examined Azure Monitor logs for configuration drift, confirmed the registration status of the resource provider, and reviewed agent health status, all without seeing any changes in the score.

Current status

I am seeking guidance on why the Security Score has not been updated despite remediation efforts. Specifically, I want to know if there is a backend delay, a need for additional validation, or other steps I should take to resolve this issue.

Moosa Khan 695 Reputation points Microsoft External Staff Moderator

2026-09-04T15:58:24.5633333+00:00
Hi Sumanth,

If the recommendation has been remediated and is no longer appearing in Microsoft Defender for Cloud, but the Secure Score has not increased, the most common causes are:

1. Allow time for Secure Score recalculation

Secure Score is not updated instantly after remediation. The recommendation state, Azure Policy compliance status, and Secure Score calculation are processed separately, so it can take some time before the updated score is reflected.

2. Verify the recommendation is contributing to Secure Score

Not every recommendation contributes equally to Secure Score. Some recommendations may have a very small score impact depending on:

The number of affected resources

The recommendation weighting

The security control to which the recommendation belongs

As a result, remediating a single recommendation may not produce a noticeable score increase.

3. Check the related Security Control

Secure Score is calculated at the Security Control level. Navigate to:

Defender for Cloud → Secure Score → Security Controls

Review the control associated with the remediated recommendation and verify whether:

Other recommendations within the same control remain unhealthy

The control score has changed

The recommendation is still marked as applicable

4. Validate Azure Policy compliance

Since Secure Score relies on policy evaluation, confirm that the affected resources have transitioned to a Compliant state under:

Azure Policy → Compliance

Although you've already triggered a policy scan, it is worth verifying that the compliance result itself has been updated successfully.

5. Confirm the correct score view

Microsoft currently exposes different score experiences (for example, Defender for Cloud Secure Score and Cloud Secure Score views). Ensure you are validating the same score model and subscription scope where the remediation was performed.

6. Review historical score changes

Use the Secure Score Over Time workbook to determine whether:

The score increase is delayed

A separate recommendation score decrease offset the improvement

No score recalculation has occurred

Additional information needed

To narrow this down, could you please share:

Which specific recommendation(s) were remediated?

Approximately when was the remediation completed?

Is the recommendation showing as Healthy/Compliant in both Defender for Cloud and Azure Policy?

Are you checking Secure Score at the subscription level or management group level?

These details will help determine whether this is a score recalculation delay, a policy compliance issue, or expected Secure Score behavior.

References

Microsoft Defender for Cloud Secure Score documentation: Secure score in Microsoft Defender for Cloud [Principles...soft Learn | Learn.Microsoft.com]

Microsoft Defender for Cloud workbooks and Secure Score trend analysis: Secure Score Over Time Workbook
Abdul Waqas 345 Reputation points

2026-09-04T18:04:18.2766667+00:00

Hi Sumanth,

If the recommendations have already been remediated and are no longer appearing as unhealthy, the Secure Score may still take some time to reflect the change.

I would suggest checking the following:

Go to Microsoft Defender for Cloud → Recommendations and confirm the remediated recommendations are no longer showing as unhealthy.

Check whether other recommendations within the same security control are still unhealthy. The Secure Score contribution for a control is based on the resources/recommendations covered by that control, so fixing only one recommendation may not increase the score.

Allow the Defender for Cloud assessment cycle to complete. Microsoft currently documents that Defender for Cloud calculates each security control approximately every 8 hours.

If the recommendations remain healthy but the Secure Score and potential score increase are still unchanged after the assessment cycle, check the recommendation/assessment status again and consider this a possible backend refresh issue.

In your case, since you have already checked the Security Benchmark, resource provider registration, Defender plans, and triggered compliance evaluation, I would first allow the normal assessment cycle to complete before making further configuration changes.

Microsoft Learn references:

https://learn.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls⁠

https://learn.microsoft.com/en-us/azure/defender-for-cloud/implement-security-recommendations⁠

https://learn.microsoft.com/en-us/azure/defender-for-cloud/faq-cspm⁠
Akshay Kaushik 18,041 Reputation points Microsoft Employee Moderator

2026-09-10T08:23:57.3733333+00:00
Hi @Sumanth Myakala (NON EA SC ALT) ,

Mismatch in the secure score is due to the difference in the calculation of secure score in the new risk based secure score and classic secure score. As per Cloud Secure Score in Microsoft Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn

Microsoft Defender for Cloud now offers two different Secure Score models. The new Cloud Secure Score (risk-based) is available in the Microsoft Defender portal and incorporates asset risk factors and criticality for more accurate prioritization. The classic Secure Score remains available in the Azure portal. These are completely different models with different calculations and values. For more information about the new model, see the Defender portal experience of this article.

Also, MDFC Transition from grouped recommendations, also known as sub-assessments, to individual recommendations. Transition from grouped to individual recommendations in Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn

Now the applicable resources have associated security findings that contribute to the posture signal for that area. Customers should switch to Risk view, the recommended view for reviewing and prioritizing the underlying findings. Risk view provides the current granular recommendation experience and identifies the specific findings to review or remediate.

Conclusion: To view the updated secure score by remediating the recommendations switch to Risk view. However, if you want to view the updated score in classic secure score portal then switch to classic view

Microsoft Defender for Cloud > General (Recommendations) > Switch to classic view. Now you will see the grouped recommendations.

To improve the score in this view, you need to resolve all the recommendations grouped together. Since the recommendation you resolved earlier was from the group “Restrict unauthorized network access” where other recommendations within the group were unattended, the score never changed.

Please "Accept the answer", this will help us and others in the community as well.

Thanks,

Akshay Kaushik
Daniel 0 Reputation points

2026-09-17T14:44:27.0866667+00:00

Hello,

Since the end of the grouping of recommendations at the end of July and the emergence of recommendations in the new model, the classic view is not working correctly, much less the Secure Score calculation in the classic model. In the following image you can see the first category (Remediate vulnerabilities) which is marked as Completed, but with a potential increase of 11%, which makes no sense and when trying to expand, nothing appears.

In the second category (Restrict unauthorized network access) the number of Unhealthy resources does not match what actually exists in the individual recommendations that can be seen in the image:

The impression it gives is that Microsoft started a change without carrying out proper testing and wants to maintain a classic vision that no longer works. If it is not working, the Secure Score model should be the new one and not the classic model that is not working. This was really a very poorly made change and it is not working well, forcing the use of another portal that has a different calculation and there is no access segmentation.

Your answer

Abdul Waqas 345 Reputation points

2026-09-04T18:04:18.2766667+00:00

Hi Sumanth,

If the recommendations have already been remediated and are no longer appearing as unhealthy, the Secure Score may still take some time to reflect the change.

I would suggest checking the following:

Go to Microsoft Defender for Cloud → Recommendations and confirm the remediated recommendations are no longer showing as unhealthy.

Check whether other recommendations within the same security control are still unhealthy. The Secure Score contribution for a control is based on the resources/recommendations covered by that control, so fixing only one recommendation may not increase the score.

Allow the Defender for Cloud assessment cycle to complete. Microsoft currently documents that Defender for Cloud calculates each security control approximately every 8 hours.

If the recommendations remain healthy but the Secure Score and potential score increase are still unchanged after the assessment cycle, check the recommendation/assessment status again and consider this a possible backend refresh issue.

In your case, since you have already checked the Security Benchmark, resource provider registration, Defender plans, and triggered compliance evaluation, I would first allow the normal assessment cycle to complete before making further configuration changes.

Microsoft Learn references:

https://learn.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls⁠

https://learn.microsoft.com/en-us/azure/defender-for-cloud/implement-security-recommendations⁠

https://learn.microsoft.com/en-us/azure/defender-for-cloud/faq-cspm⁠
Daniel 0 Reputation points

2026-09-17T14:44:27.0866667+00:00

Hello,

Since the end of the grouping of recommendations at the end of July and the emergence of recommendations in the new model, the classic view is not working correctly, much less the Secure Score calculation in the classic model. In the following image you can see the first category (Remediate vulnerabilities) which is marked as Completed, but with a potential increase of 11%, which makes no sense and when trying to expand, nothing appears.

In the second category (Restrict unauthorized network access) the number of Unhealthy resources does not match what actually exists in the individual recommendations that can be seen in the image:

The impression it gives is that Microsoft started a change without carrying out proper testing and wants to maintain a classic vision that no longer works. If it is not working, the Secure Score model should be the new one and not the classic model that is not working. This was really a very poorly made change and it is not working well, forcing the use of another portal that has a different calculation and there is no access segmentation.