/secure-score-report

description: Generate a portfolio-wide M365 security posture report — Secure Score equivalents, MFA enrollment, conditional access coverage, and domain authentication across all managed tenants
argument-hint: "[format] [tenants]"
arguments: [format, tenants]

CIPP Secure Score Report

Portfolio-level security posture report across the MSP's managed tenants. Designed for monthly internal reviews, quarterly business reviews, and as the source data for client-facing security summaries.

Arguments

• `format` (optional) — scorecard (default) — tenant-by-tenant table sorted by risk; trend — compare to previous run; executive — client-deliverable summary
• `tenants` (optional) — Comma-separated list of tenants to include (defaults to all)

What it produces

For each tenant in scope:

| Metric | Source | |--------|--------| | Microsoft Secure Score (current %, 30-day change, vs similar-size tenants) | `cipp_get_secure_score` (`top: 31`, so a reading 30 days before the latest is included. Use the reading dated 30 days before the latest as the baseline; if that reading is missing, show the change with its actual comparison dates, or report the 30-day change as unavailable) | | Top 3 controls by points available | `cipp_list_secure_score_controls` joined to the score | | BPA fail count (Identity / Mail / Security) | `cipp_list_bpa` | | Enabled CA policies (count + presence of MFA-for-all-apps) | `cipp_list_conditional_access_policies` | | MFA enrollment % | `cipp_list_mfa_users` | | Domain health (DMARC enforced, SPF valid, DKIM enabled) | `cipp_list_domain_health` | | Standards baseline coverage and alignment % | `cipp_list_standards`, `cipp_get_tenant_alignment` | | Computed risk band | High / Medium / Low |

Tenants are sorted with high-risk first.

Use the agent for

Cross-tenant *change* analysis ("which tenants regressed since last month?") goes to `security-posture-reviewer`, which can compare against a stored baseline and recommend remediation paths. This command produces the data; the agent produces the narrative.