Skip to main content
The Posture tab shows the latest daily security posture snapshot for every connected tenant, on both Microsoft 365 and Google Workspace, in one table. One row is one company on one platform, so a client running both shows up twice with a score for each. This is the page to open before a QBR: it answers “how secure is this client’s cloud, and what moved since last time” without logging into either vendor console.

​
Accessing Cloud Posture

  1. Click Cloud in the sidebar
  2. Select the Posture tab

​
The Posture Table

Only the latest snapshot per company per platform is listed, so the table is always a current-state view.

​
Two Scoring Models

Microsoft Secure Score

Sourced directly from Microsoft. MSPortal displays Microsoft’s own score and controls without modification.

MSPortal-calculated

For Google Workspace. Google does not publish a native secure score, so MSPortal calculates one from Google’s own admin reporting using a published, fixed formula.
The Score source column always states which model produced a number, so a Google Workspace score is never mistaken for a vendor-issued one.

​
The Google Workspace Posture Score

The Google Workspace score is out of 100 points, recalculated on every daily synchronization from Google’s directory and admin usage reports. Six checks contribute, weighted by how much each one matters to a real breach.

​
The Six Checks

Enrollment and enforcement are scored separately on purpose. A user who has enrolled in 2-Step Verification can still turn it off unless the administrator enforces it, so an environment can score well on enrollment and still be exposed.

​
How Points Are Awarded

Each check earns its points in proportion to coverage: Points earned = coverage percentage x maximum points For example, 18 of 20 active users enrolled in 2-Step Verification is 90% coverage, which earns 22.5 of the 25 available points.

​
Check Status

Each check carries a status badge in the details panel:
Administrator 2-step verification and Verified domains have no warning band. Because both are all-or-nothing controls, a single unprotected administrator or a single unverified domain moves the check straight to Needs attention.

​
What Is Excluded From Scoring

  • Suspended and archived users are excluded from every user-based check, so offboarded staff never drag a score down
  • Sign-in activity for an account that has never signed in falls back to its creation date, so newly created accounts are not immediately counted as stale
  • Unknown checks score zero points rather than being silently skipped, so a data gap is visible instead of flattering the score
Google publishes its usage reporting on a short delay, so the 2-Step Verification and sign-in signals in a snapshot reflect account activity from a few days prior. Directory data such as domains and licenses reflects the moment of the sync. The Snapshot date column always states the date the score represents.

​
Posture Details

Click any Google Workspace row to open the details panel.
  • Posture score card showing the percentage and the exact points out of 100
  • Calculated checks, one card per check, each with its title, plain-language description, status badge, coverage as ” of ”, and the points it contributed
The description on each check is written in business language, for example “18 of 20 active users are enrolled in 2-step verification”, so the panel can be read directly to a client. Clicking a Microsoft 365 row opens Microsoft Secure Score details, with a Secure Score button that takes you to the full Microsoft control list and remediation guidance.

​
Microsoft 365 Posture Views

Select Microsoft 365 in the provider filter and three additional views appear: These views are the existing Microsoft 365 pages, presented inside the Cloud module. Bulk actions from Secure Score, such as creating planner tasks from several controls at once, work exactly as before.

​
Using Posture With Clients

QBR preparation

Open the details panel and read the check descriptions verbatim. Each one is already written in plain language with real counts.

Prioritize the work

Administrator 2-step verification is the heaviest critical check. Closing a single unprotected admin account is usually the largest single score movement available.

Show the trend

Snapshots are stored daily, so a score improvement after remediation is evidenced by date rather than asserted.

Compare platforms fairly

Lead with the Score source column when a client runs both platforms, so a Microsoft score and a Google score are never compared as if they used the same scale.

​
Best Practices

  1. Fix administrator coverage first. It carries critical severity, 25 points, and no warning band.
  2. Chase enforcement, not just enrollment. Moving users from enrolled to enforced is worth 20 points and closes the gap where a user can disable their own second factor.
  3. Review account hygiene quarterly. Accounts dormant beyond 90 days are both a security exposure and a license reclamation opportunity. Cross-reference with Cloud Licenses.
  4. Verify every domain. Ten points sit behind a task that is usually a single DNS record.

​
Troubleshooting

Connect Google Workspace

Set up connections and enable posture scoring

Cloud Users

See per-user 2-step verification status behind the score

Microsoft 365 Secure Score

Microsoft controls and remediation planning

Planner

Turn findings into tracked remediation work