Get-DefenderSecureScoreReport

<#
.SYNOPSIS
    Reports current Secure Score and top unimplemented recommendations.

.DESCRIPTION
    Pulls the tenant's current Secure Score and lists the highest impact
    unimplemented control recommendations, so security work stays
    prioritized by what actually moves the score rather than whatever
    seems most urgent that day.

.PARAMETER TopCount
    Number of top recommendations to show. Defaults to 10.

.EXAMPLE
    .\Get-DefenderSecureScoreReport.ps1 -TopCount 15

.NOTES
    Requires Microsoft.Graph.Security with an active Connect-MgGraph
    session and SecurityEvents.Read.All scope.

.AUTHOR
    Shehryar Hassan
#>

param(
    [int]$TopCount = 10
)

$scores = Get-MgSecuritySecureScore -Top 1 | Sort-Object CreatedDateTime -Descending
$latest = $scores[0]

Write-Host "Current Secure Score: $($latest.CurrentScore) / $($latest.MaxScore)" -ForegroundColor Cyan

$controlProfiles = Get-MgSecuritySecureScoreControlProfile -All
$unimplemented = $controlProfiles | Where-Object { $_.ImplementationStatus -ne "Implemented" } |
    Sort-Object -Property @{Expression = "MaxScore"; Descending = $true} |
    Select-Object -First $TopCount Title, MaxScore, ImplementationStatus

$unimplemented | Format-Table -AutoSize