Photo: Shixart1985 / Wikimedia Commons, CC BY 2.0
For most small businesses, Microsoft 365 or Google Workspace is the office. Email, calendars, shared files, chat and video calls all run there, and so do the logins that unlock everything else. That makes your cloud workspace the most valuable target you own. Most attacks on small teams don’t start with a clever hack. They start with a stolen password or a phishing email that lands in an account nobody was watching.
The good news is that both platforms come with strong security features built in. The bad news is that many of them are switched off, set to permissive defaults, or only half-configured when a company first signs up. A busy owner or office manager sets up the tenant, invites staff and moves on, and the security settings never get a second look.
This guide walks through the settings that matter most, in the order we’d tackle them, for both Microsoft 365 and Google Workspace. You don’t need a security team to do this. You need an admin login, a couple of focused afternoons and a willingness to change a few habits.
Key takeaways
- Your cloud provider secures the platform; you are responsible for accounts, settings, sharing and data.
- Protect admin accounts first: keep them few, separate from daily use and guarded with the strongest MFA you have.
- Enforce MFA for every user and block old sign-in methods that can bypass it.
- Set up SPF, DKIM and DMARC, block automatic forwarding to outside addresses and tighten file sharing defaults.
- Control which third-party apps can access company data, and review alerts and sign-in logs on a schedule.
Why default settings aren’t enough
Microsoft and Google both work on a shared responsibility model. They keep their data centers, servers and core software secure. You are responsible for who can sign in, what those people can do, how files are shared, which apps are connected and whether your data is backed up. If an attacker logs in with a real employee’s password, the platform is working exactly as designed: it let in someone with valid credentials.
Defaults are designed for easy adoption, not for the tightest security. Depending on when your account was created and which plan you’re on, you may find external file sharing wide open, automatic email forwarding allowed, users free to connect any third-party app, and MFA available but not required.
A useful reference point is CISA’s Secure Cloud Business Applications (SCuBA) project, which publishes secure configuration baselines for both Microsoft 365 and Google Workspace. They were written for government agencies, so not every item will fit a ten-person firm, but they are an excellent free checklist of what “good” looks like.
Start with your admin accounts
An administrator account can reset passwords, read mailboxes, change security settings and delete data. If one is compromised, the attacker effectively owns your company’s digital workplace. So admin accounts come first.
Keep the number of admins small
Review who holds the top roles: Global Administrator in Microsoft 365 and Super Admin in Google Workspace. Microsoft recommends having more than one but fewer than five global admins. In practice, a small business usually needs two: one for the person who runs IT day to day and one emergency backup. Everyone else who needs some admin power should get a narrower role, such as User Administrator, Helpdesk Administrator or Billing Administrator in Microsoft 365, or a custom role in Google Workspace.
Separate admin work from daily work
The person who reads email and browses the web all day should not do it while logged in as a global admin. Create a dedicated admin account (for example, [email protected]) that has no mailbox in daily use and is only used for administration. If a phishing link catches the daily account, the attacker doesn’t get the keys to the tenant.
Plan for emergencies
Keep one “break-glass” admin account with a long, unique password and strong MFA such as a hardware security key, stored securely and used only if normal admin access fails. Document where its credentials live and who can retrieve them. Check it a few times a year so you know it still works.
Turn on MFA for everyone
Multi-factor authentication is the single most effective control for cloud accounts. A stolen password alone is no longer enough to get in. If you want the background on MFA types, passkeys and password managers, see our guide to passwords, passkeys and MFA.
In Microsoft 365
You have two main options:
- Security defaults. Available on every plan at no extra cost. Found in the Microsoft Entra admin center under Identity > Overview > Properties > Manage security defaults. It requires all users to register for MFA, requires MFA for admins, and blocks legacy authentication. For many small businesses, this is the right starting point.
- Conditional Access. Requires Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium. It lets you build rules such as “require MFA for everyone,” “block sign-ins from countries where we don’t operate” or “require a compliant device to open email.” Security defaults and Conditional Access can’t run at the same time, so plan the switch carefully and build your policies before turning defaults off.
Whichever route you take, encourage the Microsoft Authenticator app with number matching, or passkeys and security keys, over text-message codes. Text messages are better than nothing but are the weakest option.
In Google Workspace
In the Google Admin console, go to Security > Authentication > 2-step verification. Make sure users are allowed to turn it on, then set Enforcement to on, with a short new-user enrollment period (a week is reasonable) so new hires have time to set it up. Under allowed methods, consider excluding text and phone call codes once everyone is enrolled with the Google prompt, an authenticator app, passkeys or security keys.
For super admins and anyone who handles money, consider requiring security keys or enrolling them in Google’s Advanced Protection Program, which adds stronger protections for high-risk accounts.
Close the back doors
MFA only helps if every sign-in path uses it. Older protocols such as POP, IMAP and basic SMTP authentication can let an attacker try passwords without ever seeing an MFA prompt. Microsoft has retired basic authentication for most Exchange Online protocols, and security defaults block legacy sign-ins. In Google Workspace, review whether IMAP and POP access are needed under Apps > Google Workspace > Gmail > End User Access, and switch them off for users who don’t use them.
Harden email against phishing and fraud
Email is where most attacks begin, and both platforms give you strong tools to cut the risk.
Authenticate your domain: SPF, DKIM and DMARC
These three DNS records tell the world which servers are allowed to send mail as your domain and what to do with messages that fail the check. They make it much harder for criminals to spoof your address when emailing your customers and suppliers. Both admin consoles walk you through generating a DKIM key. Start DMARC at a monitoring policy (p=none), review the reports for a few weeks to make sure every legitimate sender (your billing system, newsletter tool, website forms) is covered, then move to p=quarantine and eventually p=reject.
Turn on the built-in protections
- Microsoft 365: In the Microsoft Defender portal, apply the Standard or Strict preset security policies. They configure anti-spam, anti-malware and anti-phishing settings to Microsoft’s recommended values, and on Business Premium they also enable Safe Links and Safe Attachments. Turn on the “External” tag in Outlook so staff can see at a glance when a message came from outside the company.
- Google Workspace: Under Apps > Google Workspace > Gmail > Safety, enable the recommended protections for attachments, links and external images, and spoofing and authentication. Consider turning on enhanced pre-delivery message scanning and the warning banners for messages from outside your organization.
Block automatic forwarding to outside addresses
One of the first things attackers do after taking over a mailbox is create a rule that quietly forwards every message to an outside address, so they can watch invoices and payment conversations. In Microsoft 365, check the outbound spam filter policy in the Defender portal and make sure automatic forwarding is off (the “Automatic – System-controlled” setting also blocks it). In Google Workspace, uncheck automatic forwarding under Gmail > End User Access. If a specific person truly needs forwarding, make an exception for that person only.
Control file sharing and connected apps
Sharing a link is so easy that sensitive files often end up open to anyone who has the URL. Tightening sharing settings is one of the highest-value, lowest-effort changes you can make.
SharePoint and OneDrive
In the SharePoint admin center, go to Policies > Sharing. External sharing can be set to one of four levels: Anyone, New and existing guests, Existing guests, or Only people in your organization. For most small businesses, New and existing guests is a sensible balance, because it requires outsiders to verify their identity. If you do allow “Anyone” links, set them to expire after a set number of days and make the default link type Specific people rather than “Anyone with the link.”
Google Drive
Go to Apps > Google Workspace > Drive and Docs > Sharing settings. Decide whether sharing outside your organization should be allowed at all. If it is, turn on the warning when users share files outside the company, and consider preventing users from making files visible to anyone with the link. Use shared drives for team files so documents belong to the company rather than to the individual who created them; that way files don’t disappear or stay with a departed employee.
Rein in third-party app access
When someone clicks “Sign in with Microsoft” or “Sign in with Google” on a new tool, they may be granting that app ongoing access to their email, calendar or files. Attackers exploit this with “consent phishing”: a fake app asks for permissions, and once a user approves, the attacker can read data without ever needing the password or passing MFA.
- Microsoft 365: In the Entra admin center, go to Enterprise applications > Consent and permissions. Restrict user consent to apps from verified publishers requesting low-risk permissions, or turn user consent off entirely, and enable the admin consent workflow so staff can request access to tools they need.
- Google Workspace: Under Security > Access and data control > API controls, review the list of connected apps. Mark the ones you rely on as trusted, limit or block the rest, and decide whether users can grant access to unconfigured apps.
Whichever platform you use, schedule a quarterly review of connected apps and remove any that nobody recognizes or uses anymore.
Secure the devices that connect
A perfectly configured tenant can still leak data through an unlocked, unencrypted laptop or a personal phone that’s never updated. Set minimum standards for any device that opens company email or files:
- A screen lock with a PIN, password or biometric
- Full-disk encryption (BitLocker on Windows, FileVault on Mac, on by default on modern phones)
- Automatic operating system and browser updates
- The ability to remotely wipe company data if the device is lost or the employee leaves
Microsoft 365 Business Premium includes Intune for device management, and Business Basic and Standard include basic mobility and security features. Google Workspace includes basic endpoint management on all business plans, with advanced management on higher editions. Even basic management lets you require a screen lock and wipe company accounts from a lost phone.
Turn on logging and watch the alerts
If something goes wrong, logs tell you what happened, when, and from where. Without them, an investigation turns into guesswork.
- Microsoft 365: Confirm that audit logging is on in the Microsoft Purview portal under Audit. Check your Microsoft Secure Score in the Defender portal; it lists recommended improvements ranked by impact, and it’s a handy way to track progress. Review the Entra sign-in logs for unexpected countries or repeated failures.
- Google Workspace: Use the Alert center (Security > Alert center) for warnings about suspicious logins, phishing and government-backed attacks, and make sure alerts are emailed to someone who will act on them. Audit logs for logins, Drive, Gmail and admin actions are under Reporting.
Set a recurring 15-minute calendar block every week or two to look at alerts and sign-ins. Consistency matters more than depth.
Watch out
Don’t lock yourself out. Before enforcing MFA, enabling Conditional Access or restricting sign-ins, confirm that at least two admins (including your break-glass account) can still sign in and that the break-glass account is excluded from any policy that could block it. And remember that neither platform’s recycle bin or version history is a true backup: deleted or encrypted data can still be lost for good once retention windows pass. Pair these settings with a real backup strategy.
Your hardening checklist and maintenance rhythm
Settings at a glance
Use this table as a working checklist. Menu paths change from time to time, so if a setting has moved, search for its name in the admin console.
| Control | Microsoft 365 | Google Workspace |
|---|---|---|
| Limit top-level admins | Two to four Global Administrators; use narrower roles for others | At least two Super Admins; use custom admin roles for others |
| Require MFA | Security defaults or Conditional Access (Entra ID P1) | Security > Authentication > 2-step verification, enforcement on |
| Block legacy sign-ins | Security defaults or a Conditional Access policy | Disable POP/IMAP where not needed |
| Email protection | Defender preset security policies; external sender tag | Gmail > Safety settings; external warning banners |
| Block auto-forwarding | Outbound spam filter policy | Gmail > End User Access > Automatic forwarding |
| Restrict external sharing | SharePoint admin center > Policies > Sharing | Drive and Docs > Sharing settings |
| Control app consent | Entra > Enterprise applications > Consent and permissions | Security > API controls |
| Monitor activity | Secure Score, audit log, sign-in logs | Alert center, audit and investigation reports |
Keep it going
Hardening isn’t a one-time project. People join and leave, new apps get connected and both platforms add features regularly. A light routine keeps you secure without becoming a second job:
- Weekly: skim security alerts and risky sign-ins
- On every departure: block sign-in, reset MFA, transfer file ownership and wipe company data from devices the same day
- Monthly: review admin role assignments and any new external sharing
- Quarterly: review connected third-party apps and your Secure Score or security recommendations
- Twice a year: test the break-glass account and review DMARC reports
- Annually: compare your settings against the CISA SCuBA baselines and your licensing options
If you’d like a structured, self-paced walkthrough of these topics, our Cloud Security Essentials program covers them step by step for non-technical owners and office managers.
How SecuritySage can help
Configuring Microsoft 365 or Google Workspace securely is very doable, but it’s easy to miss a setting or to break a workflow your team relies on. Through our Secure Infrastructure and Cloud Services Consulting, we review your tenant against current best-practice baselines, explain each finding in plain English, and help you roll out MFA, email authentication and sharing controls without disrupting the people who keep your business running.
Not sure where your cloud setup stands today? Get started with SecuritySage and we’ll help you prioritize the changes that make the biggest difference first, so you can focus on growth while we handle the rest.
Frequently asked questions
Is Microsoft 365 or Google Workspace secure out of the box?
Both platforms are secure at the infrastructure level, but many protective settings are optional or permissive by default. Under the shared responsibility model, you are responsible for accounts, MFA, sharing settings, connected apps and backups. A few hours of configuration closes most of the common gaps.
Should a small business use Microsoft security defaults or Conditional Access?
Security defaults are free on every plan and are a strong baseline for most small businesses, requiring MFA and blocking legacy sign-ins. Conditional Access needs Microsoft Entra ID P1, which comes with Microsoft 365 Business Premium, and allows finer rules such as blocking certain countries or requiring managed devices. You can't run both at once, so build Conditional Access policies before turning security defaults off.
How many admin accounts should a small business have?
Most small businesses need two top-level admins: one for day-to-day administration and one emergency break-glass account. Microsoft recommends fewer than five Global Administrators. Admin accounts should be separate from the accounts people use for email and browsing, and protected with the strongest MFA available.
Do I still need backups if my data is in Microsoft 365 or Google Workspace?
Yes. Recycle bins and version history only keep deleted items for a limited time, and they won't help if an attacker or a sync error deletes or encrypts data and nobody notices in time. A third-party backup of mailboxes and files gives you an independent copy you control.
