ISPM Reporting: Non-Applicable Controls and Compliance Ratings
A
Andy Roehrs
We'd love to see more flexibility in tailoring ISPM reports to a customer's actual Microsoft 365 environment.
Many of our MSP customers use Security Defaults and don't have licensing for Conditional Access or advanced Defender features. Yet these controls still appear as non-compliant, driving down their overall compliance rating.
Ideally, ISPM could recognize licensing and baseline configurations automatically, or let MSPs define which controls apply. For example, a Business Standard tenant using Security Defaults shouldn't be penalized for not having Conditional Access policies.
We'd also like to see a distinction between Not Applicable, Risk Accepted, and Non-Compliant, with the compliance rating adjusted accordingly. Simply hiding controls from the report doesn't solve the scoring problem.
These are customer-facing reports that we use to demonstrate security improvements over time. We want customers focused on actionable improvements, not overwhelmed by findings that don't apply to their environment.
The goal is simple: Make compliance ratings reflect the security controls a customer can actually implement within their existing configuration.
J
John Cocchiarella
I support this request from the perspective of a vCIO who presents these reports to business owners and helps them make security and budget decisions.
The challenge is turning the report into a clear, actionable business conversation. For example, our report shows a 54.4% Huntress Compliance Rating alongside a separate 52% Microsoft Secure Score labeled “High Risk.” A business owner naturally wants to know: How exposed are we, what needs attention first, and what investment will meaningfully reduce that exposure? Those answers are difficult to draw from the report without considerable interpretation.
The findings also combine technical security gaps with settings that require a business decision, such as restricting external Teams communication or guest access. Presenting these together as compliance deficiencies makes it difficult for an owner to distinguish an urgent vulnerability from a recommended restriction that could affect daily operations.
I appreciate that the report states unlicensed controls are excluded and already includes a Risk Accepted category. What would help is greater transparency about why each control applies, whether an existing configuration or alternative protection addresses the objective, and exactly how exclusions and accepted risks affect the rating.
An executive report should help us explain:
What requires action now.
What requires a business decision.
What requires additional licensing or investment.
What is not applicable or has been formally accepted.
We want to demonstrate measurable security progress and give owners a sound basis for decisions. Clear applicability, transparent scoring, and business-focused priorities would make these reports much more effective in those conversations.