How to Secure Google Workspace and Microsoft 365: A Small Business Admin Guide
This is general information, not legal, tax, financial, medical or security advice. Rules and prices change, so confirm details with the official sources linked below or a qualified professional.
To secure Google Workspace or Microsoft 365, start with identity: enforce multi-factor authentication for everyone (Microsoft security defaults or Google 2-Step Verification enforcement), give admins separate accounts with phishing-resistant MFA, and block legacy sign-in methods. Then protect email with SPF, DKIM and DMARC and stronger filtering, restrict external sharing defaults, turn on alerts, and back up your data. Most of this is included in the subscription you already pay for.
Your email platform is the master key to the business. Password resets for your bank, domain, store and payroll all land in that inbox.
This is general information, not professional security advice. Settings names and locations change; follow each vendor's current documentation.
Key takeaways
- Turn on what's free first. Microsoft security defaults and Google 2SV enforcement cost nothing extra.
- Block legacy authentication. Microsoft says MFA plus blocking legacy authentication stops more than 99.9 percent of common identity attacks.
- Protect admins harder than anyone. At least two super admins, separate admin accounts, phishing-resistant MFA.
- Make sharing private by default. New files shouldn't be link-shared until someone chooses to.
- Back up SaaS data. The provider's uptime is not your data recovery plan.
Google Workspace vs Microsoft 365: where the key controls live
| Control | Google Workspace | Microsoft 365 |
|---|---|---|
| Baseline MFA | Enforce 2-Step Verification in Admin console | Security defaults (free) or Conditional Access |
| Block legacy sign-in | Review third-party and legacy app access in the Admin console | Included in security defaults |
| Phishing-resistant MFA | Security keys and passkeys; Advanced Protection Program for high-risk users | FIDO2 security keys and passkeys; stricter policies through Conditional Access (plan-dependent) |
| Admin protection | Multiple super admins, limited admin roles | Multiple global admins, least-privilege roles |
| Email authentication | SPF, DKIM, DMARC setup guides | SPF, DKIM, DMARC setup guides |
| Advanced email filtering | Enhanced pre-delivery scanning; attachment and link screening | Anti-phishing and attachment protections (plan-dependent) |
| Sharing controls | Drive link-sharing defaults, external sharing warnings | SharePoint/OneDrive external sharing settings |
| Alerts and logs | Alert center, security center (edition-dependent) | Entra sign-in logs and Microsoft security portal (plan-dependent) |
Step 1: Enforce MFA for everyone
Microsoft 365: turn on security defaults
Security defaults are a free, preconfigured set of identity protections in Microsoft Entra ID. According to Microsoft, they:
- Require all users to register for multifactor authentication
- Require administrators to use MFA
- Require users to use MFA when necessary
- Block legacy authentication protocols
- Block device code flow
- Protect privileged activities such as access to the Azure portal
Microsoft removed the old 14-day grace period for MFA registration for new and existing tenants starting July 29, 2024. Users signing in with the Microsoft Authenticator app see a number to enter, which Microsoft says helps prevent MFA fatigue attacks.
Microsoft notes that tenants created on or after October 22, 2019 may already have security defaults enabled, and that organizations with Entra ID P1 or P2 licenses are probably better served by Conditional Access policies. Whichever you use, don't run with neither. Microsoft also recommends emergency "break glass" admin accounts for the rare case where all other administrators are locked out.
Google Workspace: enforce 2-Step Verification
Google's security checklist for small businesses recommends that everyone use 2-Step Verification and that you enforce it for admins and key users, especially those handling financial records and employee information. Roll it out by allowing users to enroll, setting an enrollment window, then enforcing. For high-risk users such as owners and finance staff, consider security keys or passkeys.
Detailed rollout guidance, including recovery planning, is in how to set up 2FA and a password manager for a team.
Step 2: Lock down admin accounts
Admin accounts can read every mailbox and change every setting. Google's checklist recommends:
- More than one super admin, each managed by a separate person, so a lost or compromised account can be recovered.
- Recovery phone and email on admin accounts, plus printed backup codes.
- Not staying signed in as super admin. Sign in for specific admin tasks, then sign out; use an account with limited admin roles for daily work.
- Keeping account and DNS information secure in case Google Support needs to verify ownership.
Apply the same principles in Microsoft 365: at least two global admins held by different people, separate admin and daily accounts, and the least-privileged admin role for each task (for example, a user administrator rather than a global admin for password resets).
Step 3: Protect email
- Publish SPF so receiving servers know which servers may send for your domain. Google notes that without SPF, some messages could bounce or be marked as spam.
- Turn on DKIM signing in your admin console and publish the DNS record.
- Publish DMARC. It tells receivers whether to reject, quarantine or deliver mail that fails SPF or DKIM, and sends reports about who is sending as your domain. Start by monitoring, then tighten.
- Strengthen filtering. In Google Workspace, Google recommends turning on enhanced pre-delivery message scanning and additional screening for malicious attachments, links and external images. In Microsoft 365, review the anti-phishing and safe attachment options available on your plan.
- Watch for forwarding rules. Attackers who take over a mailbox often create rules that forward or hide messages. Review alerts and audit mailbox rules regularly.
See phishing protection for small teams for the human side of email security.
Step 4: Control sharing
Google's checklist recommends three sharing controls worth copying on either platform:
- Restrict external calendar sharing to free/busy information only.
- Make new files private by default by turning off default link sharing, so files are visible only to their creator until shared.
- Warn users when sharing externally, prompting them to confirm before a file leaves the company.
In Microsoft 365, set SharePoint and OneDrive external sharing to the most restrictive level that still lets people work, and prefer sharing with specific people over "anyone with the link."
Step 5: Keep devices and apps updated
Google's checklist also recommends enabling automatic updates for apps and browsers, and Chrome can be configured to auto-update across your organization. In a Microsoft environment, use Windows Update for Business or Intune if you have it, and at minimum confirm that every laptop installs updates automatically.
Step 6: Monitor and back up
- Turn on alerts for suspicious sign-ins, new admin role assignments, new forwarding rules and unusual downloads. Check the alert center or Microsoft's security portal weekly.
- Review sign-in logs for admin accounts monthly.
- Back up your tenant. CISA's ransomware guide recommends understanding the cloud shared responsibility model and considering cloud-to-cloud backups. Our 3-2-1 backup strategy explains how.
From experience. In fractional CTO work with small teams across the US, UAE, Canada and Malaysia, I recommend putting a one-hour review of admin roles, MFA enforcement and sharing defaults on the calendar every quarter. Email platforms are easy to set up once and forget, and that is exactly when settings drift.
Offboarding: the step most small teams skip
When someone leaves, a disabled password isn't enough. Work through this list on their last day:
- Suspend or block sign-in rather than deleting immediately, so their data isn't lost.
- Sign them out of all sessions and remove registered MFA methods and app passwords.
- Transfer ownership of their files, shared drives and calendars to a manager.
- Convert or delegate the mailbox if customers still email that address, and set an auto-reply.
- Remove admin roles and group memberships, including shared mailboxes.
- Revoke third-party app access they authorized with their account.
- Rotate shared passwords they could see in the password manager.
- Delete or archive the account once data is retained according to your policy and backups confirm it.
Regulated businesses need more
Google notes that even very small businesses can have the security requirements of a much larger company, for example financial planning firms or any business handling health information, and points them to its checklist for organizations with 100 or more users. If you're in a regulated field, plan for stricter controls, audit logs and possibly higher-tier licenses.
Admin security checklist
- [ ] MFA enforced for all users (security defaults, Conditional Access or Google 2SV enforcement)
- [ ] Legacy authentication blocked
- [ ] Phishing-resistant MFA for admins and finance users
- [ ] At least two super/global admins held by different people
- [ ] Separate admin and daily-use accounts
- [ ] SPF, DKIM and DMARC published; DMARC reports reviewed
- [ ] Enhanced email filtering enabled
- [ ] External calendar sharing limited to free/busy
- [ ] New files private by default; external sharing warnings on
- [ ] Auto-updates on for devices, apps and browsers
- [ ] Alerts configured and reviewed weekly
- [ ] Tenant data backed up with a cloud-to-cloud service
Next steps
- Turn on Microsoft security defaults or enforce Google 2-Step Verification today, starting with admins.
- Add a second super/global admin and move daily work off admin accounts.
- Publish SPF, DKIM and a monitoring DMARC record, then review reports in two weeks.
- Set up tenant backups and test a mailbox restore.
- If you want an experienced technical lead to own this setup and review it quarterly, see our fractional CTO service.
Sources
- Microsoft, Security defaults in Microsoft Entra ID: https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults
- Google Workspace, Security checklist for small businesses (1-100 users): https://knowledge.workspace.google.com/admin/security/security-checklist-for-small-businesses-1-100-users
- Google Workspace, Set up DMARC: https://support.google.com/a/answer/2466580
- CISA, Require Multifactor Authentication: https://www.cisa.gov/secure-our-world/require-multifactor-authentication
- CISA, #StopRansomware Guide: https://www.cisa.gov/stopransomware/ransomware-guide
Frequently asked questions
What are Microsoft security defaults?
Security defaults are a free, preconfigured set of protections in Microsoft Entra ID, the identity system behind Microsoft 365. They require all users to register for MFA, require MFA for administrators, prompt users for MFA when needed, block legacy authentication and device code flow, and protect privileged activities. Microsoft says MFA plus blocking legacy authentication stops more than 99.9 percent of common identity attacks.
Should I use security defaults or Conditional Access?
If you don't have a dedicated IT admin and your plan doesn't include Conditional Access, use security defaults; they are free and effective. If your licenses include Conditional Access, it lets you build more tailored policies, such as requiring phishing-resistant MFA for admins or blocking sign-ins from risky locations. Microsoft says organizations with Entra ID P1 or P2 licenses or complex requirements should consider Conditional Access instead.
How do I enforce 2-Step Verification in Google Workspace?
In the Google Admin console, go to the security settings for 2-Step Verification, allow users to turn it on, give them an enrollment period, then enforce it. Google's small business checklist recommends enforcing it for admins and key users at minimum and encourages it for everyone. Generate backup codes and keep at least two super admins to avoid lockouts.
How many admin accounts should a small business have?
At least two super admin or global admin accounts, each held by a different trusted person, so you can recover if one is lost or compromised. Google's checklist recommends this explicitly. Admins should use those accounts only for admin tasks and use a separate, limited account for daily email and work.
Do I need to back up Microsoft 365 or Google Workspace?
Yes, for most businesses. The providers keep their services running, but deletions, ransomware that syncs encrypted files, expired retention and removed accounts can still cost you data. CISA's ransomware guidance advises reviewing the cloud shared responsibility model and using cloud-to-cloud backups for services like Microsoft 365.