What to secure first
Microsoft 365 and Google Workspace hold the accounts, email, files, and administrative access the organization depends on. Start with four areas that reduce the most avoidable exposure.
- Require stronger sign-in controls and limit administrator access.
- Record the sign-in, sharing, and administrative activity needed for an investigation.
- Set clear rules for external sharing, retention, and sensitive data.
- Maintain an independent backup and test how data will be restored.
When to use this guide
- While setting up or migrating to Microsoft 365 or Google Workspace.
- Before renewing cyber insurance or answering client security questionnaires.
- When cleaning up a tenant that has accumulated old accounts, broad access, or sharing exceptions.
Start with identity and access
A secure tenant starts with knowing who can sign in, which accounts hold administrative roles, and which devices can reach company data. Default settings and inherited exceptions often leave more access than the organization intends.
For Microsoft 365, review MFA enforcement, Conditional Access, administrator roles, and device compliance. For Google Workspace, review 2-Step Verification, Context-Aware Access where licensed, administrator roles, organizational units, and managed browser or device policies. The controls differ, but the decision is the same: define who gets access, from where, and under which conditions.
Then review external sharing, mailbox or Gmail routing rules, third-party application access, audit logs, and recovery settings. These controls show whether data can leave unexpectedly and whether the organization will have enough evidence to investigate.
Controls to verify in each tenant
Apply the controls in a safe order
Start with an inventory of users, devices, groups, administrator roles, shared sites and drives, and third-party applications. This makes stale accounts, inherited access, and old sharing exceptions visible before policies change.
Test access policies with a small pilot group. Then enforce stronger sign-ins, restrict administrator roles, and apply device requirements in stages. A pilot exposes dependencies before a broad policy locks out staff or interrupts a business application.
Assign ongoing ownership for alerts, backup tests, onboarding and offboarding, and external sharing reviews. The controls only stay useful when someone checks them and adjusts them as the organization changes.