Hey everyone, I've been lurking for a bit and finally have a question that's really stumping me. We're pretty new to Microsoft Defender for Endpoint (we've been using it for about 3 months now), and I'm in charge of monitoring our security posture.
Here's the confusing part: every time we successfully deploy a new security recommendation from the Microsoft 365 Defender portal—like enabling a certain firewall rule or applying a BitLocker policy—our overall "Microsoft Secure Score" seems to *drop* a little instead of going up. Shouldn't fixing things make the score better?
For example, last week we addressed a recommendation about "Block executable content from email client and webmail." We configured it exactly as guided. The status changed to "Completed," but then our overall score dipped by like 0.2 points. It's not a huge drop, but it's happening consistently and it feels like we're being penalized for doing the right thing.
Is this a normal thing? Are we reading the metrics wrong? Maybe the scoring system is adjusting based on new threats or something? I'm worried I'm missing a basic concept here, and I don't want to report progress to my boss that looks like we're going backwards.
Any insights from others who've seen this would be super helpful. Thanks