microsoft.com Security Score: 83 (Grade B)

Scanning external signals… this can take up to a couple of minutes.

Download PDF report

FairSRS Score - microsoft.com

83/100

FairSRS Score

Grade

Acceptable

Signal Rating

24 positive signals

4 risk signals

87 host(s), 100 subdomain(s)

Scan coverage. This report analyzed microsoft.com plus a random sample of 100 of its 264 discovered subdomains (up to 100 subdomains are checked per scan). The score reflects this sampled portion of the external attack surface, so re-scanning may surface additional hosts.

Category Breakdown

Categories with items of opportunity are clickable - open one to see the action items that would raise its score.

		71/100
		81/100
		73/100
Vulnerability Exposure		95/100
Email Security		100/100

7 items of opportunity in this category: 3 risk signals costing -2 points, and 4 strengths to extend to more hosts worth up to +25 points.

Risk signals found

TLS 1.0 Enabled-1

Deprecated TLS 1.0 is still enabled

a00000000000000000000000000000000000000000000000000000000001337.ms.a.microsoft.com 23.219.36.132 :443 + 4 other hosts · 5 of 84 SSL hosts (6%)

TLS Versions	TLSv1, -SSLv2, -SSLv3, TLSv1.1, TLSv1.2, TLSv1.3
Observed Subdomains	a00000000000000000000000000000000000000000000000000000000001337.ms.a.microsoft.com + 4 others
Adoption	5 of 84 SSL hosts (6%)

Certificate Hostname Mismatch-1

Domain not found in certificate Subject Alternative Names

a00000000000000000000000000000000000000000000000000000000001337.ms.a.microsoft.com 23.219.36.132 :443 + 5 other hosts · 6 of 84 SSL hosts (7%)

Certificate CN	a248.e.akamai.net
Certificate SANs	(none)
Expected Domain	a00000000000000000000000000000000000000000000000000000000001337.ms.a.microsoft.com
Observed Subdomains	a00000000000000000000000000000000000000000000000000000000001337.ms.a.microsoft.com + 5 others
Adoption	6 of 84 SSL hosts (7%)

TLS 1.1 Enabled0

Deprecated TLS 1.1 is still enabled

a00000000000000000000000000000000000000000000000000000000001337.ms.a.microsoft.com 23.219.36.132 :443 + 4 other hosts · 5 of 84 SSL hosts (6%)

TLS Versions	TLSv1, -SSLv2, -SSLv3, TLSv1.1, TLSv1.2, TLSv1.3
Observed Subdomains	a00000000000000000000000000000000000000000000000000000000001337.ms.a.microsoft.com + 4 others
Adoption	5 of 84 SSL hosts (6%)

Strengths to extend to more hosts

You already do these right on some hosts - rolling them out to the rest is the fastest way to raise this score. Points shown are the signal’s full value; the actual gain scales with how many hosts you cover.

TLS 1.3 Supported+9

Present on 11 of 84 hosts (13%).

Re-scan to list the 73 hosts still missing this.

HSTS Enabled+7

Present on 1 of 84 hosts (1%).

Re-scan to list the 83 hosts still missing this.

PQC-Ready Infrastructure+5

Present on 11 of 84 hosts (13%).

Re-scan to list the 73 hosts still missing this.

OCSP Stapling+4

Present on 5 of 84 hosts (6%).

Re-scan to list the 79 hosts still missing this.

6 items of opportunity in this category: 1 risk signal costing no points, and 5 unearned strengths worth up to +24 points.

Risk signals found

Server Version Disclosed0

Server header reveals software version information

3p-dataconnectors.microsoft.com 20.118.40.7 :443 · 1 of 84 HTTP hosts (1%)

Server Header	microsoft-iis/10.0
Adoption	1 of 84 HTTP hosts (1%)

Strengths not yet earned

Signals this category has on no host yet. Points are the signal’s full value - the effect on the overall score is weighted.

Content Security Policy Header+8

X-Frame-Options Header+5

X-Content-Type-Options Header+5

Referrer-Policy Header+3

Permissions-Policy Header+3

Security Signals

Risk Signals (4)

Category	Signal	Points
TLS / Cryptography	TLS 1.0 Enabled Deprecated TLS 1.0 is still enabled a00000000000000000000000000000000000000000000000000000000001337.ms.a.microsoft.com 23.219.36.132 :443 + 4 other hosts · 5 of 84 SSL hosts (6%)	-1
TLS / Cryptography	Certificate Hostname Mismatch Domain not found in certificate Subject Alternative Names a00000000000000000000000000000000000000000000000000000000001337.ms.a.microsoft.com 23.219.36.132 :443 + 5 other hosts · 6 of 84 SSL hosts (7%)	-1
TLS / Cryptography	TLS 1.1 Enabled Deprecated TLS 1.1 is still enabled a00000000000000000000000000000000000000000000000000000000001337.ms.a.microsoft.com 23.219.36.132 :443 + 4 other hosts · 5 of 84 SSL hosts (6%)	0
Application Hardening	Server Version Disclosed Server header reveals software version information 3p-dataconnectors.microsoft.com 20.118.40.7 :443 · 1 of 84 HTTP hosts (1%)	0

Positive Signals (24)

Category	Signal	Points
TLS / Cryptography	TLS 1.3 Supported Server supports TLS 1.3 52-113-36-24.d.ipdns.public-teams.main.ml.teams.microsoft.com 52.113.36.24 :443 + 10 other hosts · 11 of 84 SSL hosts (13%)	+1
TLS / Cryptography	Strong Ciphers Only Only strong cipher suites detected (ECDHE+AES-GCM/ChaCha20) 52-113-10-186.relay.teams.microsoft.com 52.113.10.186 :443	+8
TLS / Cryptography	Valid Certificate SSL/TLS certificate is valid and not expired 52-113-10-186.relay.teams.microsoft.com 52.113.10.186 :443 + 83 other hosts · 84 of 84 SSL hosts (100%)	+8
TLS / Cryptography	Reputable Certificate Authority Certificate issued by a reputable CA 52-113-10-186.relay.teams.microsoft.com 52.113.10.186 :443 + 83 other hosts · 84 of 84 SSL hosts (100%)	+5
TLS / Cryptography	HSTS Enabled HTTP Strict Transport Security header present microsoft.com 150.171.109.65 :443 · 1 of 84 SSL hosts (1%)	+0
TLS / Cryptography	OCSP Stapling OCSP stapling is enabled a00000000000000000000000000000000000000000000000000000000001337.ms.a.microsoft.com 23.219.36.132 :443 + 4 other hosts · 5 of 84 SSL hosts (6%)	+0
TLS / Cryptography	PQC-Ready Infrastructure Server supports TLS 1.3 with TLS_AES_256_GCM_SHA384 cipher suite, indicating readiness for post-quantum hybrid key exchange (X25519 + ML-KEM-768) 52-113-36-24.d.ipdns.public-teams.main.ml.teams.microsoft.com 52.113.36.24 :443 + 10 other hosts · 11 of 84 SSL hosts (13%)	+1
Network Security	WAF/CDN Detected Protected by Akamai a00000000000000000000000000000000000000000000000000000000001337.ms.a.microsoft.com 23.219.36.132 + 4 other hosts · 5 of 84 HTTP hosts (6%)	+1
Network Security	Enterprise Cloud Hosting Hosted on Azure 52-115-240-178.relay.teams.microsoft.com 52.115.240.178	+8
Network Security	Standard Ports Only Only standard web ports (80, 443, 8080, 8443) are open 52-113-10-186.relay.teams.microsoft.com 52.113.10.186	+7
Network Security	Minimal Open Ports Only 2 port(s) open 52-113-10-186.relay.teams.microsoft.com 52.113.10.186	+5
Network Security	No High-Risk Ports Detected No high-risk service ports (RDP, Telnet, FTP, etc.) are exposed 52-113-10-186.relay.teams.microsoft.com 52.113.10.186	+5
Network Security	No Database Ports Exposed No database ports (MySQL, PostgreSQL, MongoDB, etc.) are exposed 52-113-10-186.relay.teams.microsoft.com 52.113.10.186	+5
Application Hardening	No Server Version Disclosure Server header does not reveal software version 52-113-10-186.relay.teams.microsoft.com 52.113.10.186 + 82 other hosts · 83 of 84 HTTP hosts (99%)	+10
Application Hardening	No Default Pages No default/welcome pages detected 52-113-10-186.relay.teams.microsoft.com 52.113.10.186 + 83 other hosts · 84 of 84 HTTP hosts (100%)	+5
Application Hardening	No Admin Interfaces Exposed No exposed admin panels detected 52-113-10-186.relay.teams.microsoft.com 52.113.10.186	+8
Vulnerability Exposure	No CVEs Detected No known vulnerabilities detected across all hosts 52-113-10-186.relay.teams.microsoft.com 52.113.10.186	+30
Vulnerability Exposure	No Outdated Software Detected All detected software versions are within acceptable ranges 52-113-10-186.relay.teams.microsoft.com 52.113.10.186	+15
Email Security	SPF Hard Fail (-all) SPF record with strict enforcement 52-113-10-186.relay.teams.microsoft.com 52.113.10.186	+12
Email Security	DMARC Reject Policy DMARC policy set to reject unauthenticated email 52-113-10-186.relay.teams.microsoft.com 52.113.10.186	+15
Email Security	DKIM Record Found DKIM record found (selector: selector2) 52-113-10-186.relay.teams.microsoft.com 52.113.10.186	+10
Email Security	Enterprise Email Gateway Email protected by Microsoft EOP 52-113-10-186.relay.teams.microsoft.com 52.113.10.186	+10
Email Security	MTA-STS Present MTA Strict Transport Security is configured 52-113-10-186.relay.teams.microsoft.com 52.113.10.186	+5
Email Security	Managed DNS Provider Using Azure DNS 52-113-10-186.relay.teams.microsoft.com 52.113.10.186	+5

Vulnerability Exposure

0 Critical 0 High 0 Medium 0 Low

No high-severity (CVSS ≥ 7.0) CVEs identified in external data.

Open Ports & Services

Port	Service	Host
443	https	52-113-10-186.relay.teams.microsoft.com 52.113.10.186
443	https	52-113-11-164.relay.teams.microsoft.com 52.113.11.164
443	https	52-115-240-168.relay.teams.microsoft.com 52.115.240.168
443	https	52-113-11-59.relay.teams.microsoft.com 52.113.11.59
443	https	52-115-240-19.relay.teams.microsoft.com 52.115.240.19
443	https	52-113-11-245.relay.teams.microsoft.com 52.113.11.245
443	https	52-113-10-203.relay.teams.microsoft.com 52.113.10.203
443	https	52-113-10-195.relay.teams.microsoft.com 52.113.10.195
443	https	52-113-11-228.relay.teams.microsoft.com 52.113.11.228
443	https	52-113-10-202.relay.teams.microsoft.com 52.113.10.202
443	https	52-113-11-252.relay.teams.microsoft.com 52.113.11.252
443	https	52-113-11-221.relay.teams.microsoft.com 52.113.11.221
443	https	52-115-240-78.relay.teams.microsoft.com 52.115.240.78
443	Kestrel	52-113-36-24.d.ipdns.public-teams.main.ml.teams.microsoft.com 52.113.36.24
443	https	52-113-11-173.relay.teams.microsoft.com 52.113.11.173
443	https	52-113-11-243.relay.teams.microsoft.com 52.113.11.243
443	https	52-113-11-199.relay.teams.microsoft.com 52.113.11.199
443	https	52-113-11-222.relay.teams.microsoft.com 52.113.11.222
443	https	52-113-11-128.relay.teams.microsoft.com 52.113.11.128
443	https	52-113-10-192.relay.teams.microsoft.com 52.113.10.192
443	Kestrel	52-114-34-120.d.ipdns.public-teams.main.ml.teams.microsoft.com 52.114.34.120
443	https	52-113-11-32.relay.teams.microsoft.com 52.113.11.32
80	http	microsoft.com 150.171.109.65
443	https	microsoft.com 150.171.109.65
443	https	52-115-240-82.relay.teams.microsoft.com 52.115.240.82
443	https	52-113-11-62.relay.teams.microsoft.com 52.113.11.62
443	https	52-113-11-218.relay.teams.microsoft.com 52.113.11.218
80	AkamaiGHost	a00000000000000000000000000000000000000000000000000000000001337.ms.a.microsoft.com 23.219.36.132
443	AkamaiGHost	a00000000000000000000000000000000000000000000000000000000001337.ms.a.microsoft.com 23.219.36.132
443	https	52-113-10-40.relay.teams.microsoft.com 52.113.10.40
443	https	52-113-11-92.relay.teams.microsoft.com 52.113.11.92
443	https	52-113-11-132.relay.teams.microsoft.com 52.113.11.132
443	https	52-115-240-66.relay.teams.microsoft.com 52.115.240.66
443	https	52-113-10-198.relay.teams.microsoft.com 52.113.10.198
443	https	52-113-10-194.relay.teams.microsoft.com 52.113.10.194
443	https	52-113-11-89.relay.teams.microsoft.com 52.113.11.89
443	https	52-113-10-197.relay.teams.microsoft.com 52.113.10.197
443	https	52-115-240-77.relay.teams.microsoft.com 52.115.240.77
443	https	52-113-11-56.relay.teams.microsoft.com 52.113.11.56
443	https	52-113-11-179.relay.teams.microsoft.com 52.113.11.179

Technology Inventory

Microsoft CorporationKestrelMicrosoft ASP.NETAzure Front DoorAzureAkamaiGHostAkamaiDigiCert IncMicrosoft IIS httpd 10.0Microsoft-IIS 10.0Windows ServerIIS 10.0GoDaddy.com, Inc.10.0Microsoft EOPAzure DNS

Important - how to read this rating. Security Rating Services (SRS) like FairSRS provide signals to help identify potential third-party risk from externally observable data. They should not be relied upon as the sole measure of an organization’s security posture. External signals are incomplete by nature. In particular, some organizations deliberately run deception technology (honeypots and decoy services) that is designed to appear vulnerable to lure and study attackers - such systems may surface here as risk signals but can actually reflect a mature, positive security program. Always corroborate these signals with direct assessment and evidence before drawing conclusions.

What is the FairSRS Score?

The FairSRS Score is a free security rating from 0 to 100 that measures a company’s externally observable security posture - the same outside-in signals a security team (or an attacker) can see without any access to the target’s internal systems. Enter any company domain above and FairSRS scans publicly available data to grade its third-party and vendor security risk in seconds, then generates a shareable report you can download as a PDF.

It’s powered by the free, open-source Fair TPRM platform and the same continuous security monitoring engine used inside our vendor risk management workflows - so the rating you see here is the same one security teams rely on to monitor their vendors.

What the score measures

Your FairSRS Score is a weighted blend of five externally observable security categories:

TLS / Cryptography - TLS protocol versions, certificate validity, HSTS, cipher strength, and post-quantum readiness.
Network Security - open ports, exposed services, WAF/CDN protection, and hosting posture.
Application Hardening - security headers, software version disclosure, exposed admin panels, and directory listings.
Vulnerability Exposure - known CVEs on internet-facing services, weighted by severity.
Email Security - SPF, DKIM, DMARC, and MTA-STS configuration that protects against spoofing.

Each finding is a signal that adds or subtracts points, producing a 0-100 score and an A-F grade. To turn these signals into quantified financial risk, pair them with FAIR risk analysis and a full GRC compliance program.

Recently scored vendors

Every domain below has a saved FairSRS Score you can open directly - no scan, no waiting, ranked highest score to lowest. Scores reflect the most recent scan and are re-checked when someone re-scans the domain.

Frequently asked questions

Is the FairSRS vendor security score really free?

Yes. FairSRS is completely free with no login, account, or credit card required. It is powered by the free, open-source Fair TPRM platform.

What does the FairSRS Score measure?

It measures a company’s externally observable security posture across five categories - TLS/cryptography, network security, application hardening, vulnerability (CVE) exposure, and email security - and combines them into a 0-100 score with an A-F grade.

How is the score calculated?

FairSRS analyzes publicly observable data about a domain - open services, TLS and certificate configuration, security headers, known CVEs, and DNS-based email protections such as SPF, DKIM and DMARC - and weights each signal to produce the score. No login or access to the target is required.

Is my data private?

Yes. No account is needed, and if you choose to have the report emailed, your address is used only to send that one report, encrypted in transit, then permanently deleted. We never store it, never sell or share it, and no one from Fair TPRM will contact you.

Can I scan any company or vendor?

Yes. Enter any public company domain to check its external security posture. It is designed to help you assess third-party vendors and suppliers.

How accurate is an external security rating?

A security rating provides signals to help identify risk, but it is not a complete picture and should not be the sole basis for judging a company’s security. Some organizations run deception technology that can appear vulnerable but reflects a mature program. Always corroborate with direct assessment.