Microsoft 365 and Google Workspace security, checked and fixed

What a Microsoft 365 security assessment checks

A Microsoft 365 security assessment checks seven areas of your tenant: sign-in and the second step, administrator roles, older sign-in methods, mail forwarding and inbox rules, sharing of files and sites, the audit log, and the devices that open company data. Each finding is written against a public recommendation, so you can see why it matters and who says so.

The yardsticks are Microsoft's and Google's own guidance and the Canadian Centre for Cyber Security baseline controls for organizations with fewer than 500 employees.¹¹ As a stricter public reference, the US Cybersecurity and Infrastructure Security Agency (CISA) publishes secure configuration baselines for both Microsoft 365 and Google Workspace through its SCuBA project, with no-cost assessment tools named ScubaGear and ScubaGoggles.¹³

MFA, security defaults and Conditional Access in Microsoft 365

Microsoft 365 offers two ways to make the second sign-in step mandatory: security defaults, which every tenant can switch on at no extra cost, and Conditional Access, which needs at least a Microsoft Entra ID P1 licence. Microsoft 365 Business Premium includes Conditional Access, so many small offices already pay for the stronger option without using it.¹²

Security defaults are a single on-or-off switch. Once on, every user must register for multifactor authentication, the listed administrator roles must use it at every sign-in, and older sign-in protocols are blocked. Since July 29, 2024, Microsoft no longer gives users a 14-day grace period to register, so switching it on without preparation sends every person to the registration screen at their next sign-in.¹

Conditional Access policies work as if-then statements: if a user wants to reach an application such as Microsoft 365, then they must complete an action, for example a second sign-in step or a sign-in from a company device.² An organization that moves to Conditional Access must switch security defaults off, so the replacement policies have to be ready on the same day.¹

• Number matching in the authenticator app, which the Cyber Centre recommends against prompt-fatigue attacks and which Microsoft shows at sign-in under security defaults.¹²¹
• Phishing-resistant keys for administrators and senior staff where the budget allows: the Cyber Centre strongly recommends FIDO-based methods for online accounts.¹²

Google Workspace security: the same review on Google's side

Google Workspace security rests on the same handful of settings, under different names: 2-Step Verification, super administrator accounts, Drive sharing, Gmail forwarding and the alert and log pages of the Admin console. Google's own guidance for small businesses asks for 2-Step Verification on admins and key users, and for more than one super administrator account, each managed by a separate person.⁸

For larger organizations Google goes further: security keys at least for admins and other high-value accounts, blocking automatic forwarding of incoming mail to another address, blocking less secure apps that skip modern standards such as OAuth, and approving which third-party apps can reach Gmail and Drive.⁹ We apply what fits your size.

Microsoft Secure Score: a starting list for the work

Microsoft Secure Score is a measurement in the Microsoft Defender portal, with a higher number indicating that more of Microsoft's recommended actions have been taken. Each recommended action is worth 10 points or less, and partial points come when an action covers only some users or devices.⁴

Turning on security defaults earns full points for three actions at once: making sure all users can complete multifactor authentication (nine points), requiring it for administrative roles (10 points) and blocking legacy authentication (seven points).⁴ Microsoft warns that the score is a summary of controls in use and isn't an absolute measurement of how likely a breach is.⁴

We read Secure Score as one input. Our report ranks findings by what an attacker would actually use against your office, then shows how the score moved after the fixes.

Admin roles, forwarding rules and sharing: where quiet takeovers hide

Most mailbox takeovers stay invisible for weeks because they use ordinary features: an inbox rule that copies payment mail to an outside address, a forgotten administrator account, a folder shared with anyone who has the link. Microsoft notes that users can set inbox rules to forward messages outside the organization deliberately or as a result of a compromised account.⁵

Microsoft's outbound spam policy has three forwarding settings. The default, Automatic - System-controlled, has behaved as Off for new organizations since 2021, but for some older tenants it can still mean On, and Microsoft advises choosing On or Off explicitly.⁵ We set it to Off and allow named exceptions you approve.

On the administrator side, Microsoft recommends assigning Global Administrator to fewer than five people and keeping two cloud-only emergency access accounts for the day everyone else is locked out.³ The Cyber Centre adds that administrator accounts should only be used for administrative work, and that cloud administration accounts need two-factor authentication.¹¹

• Every inbox rule and mailbox forward reviewed; anything nobody recognizes reported to you the same day.
• Global Administrators reduced, separate admin accounts created for daily-use people, emergency accounts documented and sealed.
• Accounts of former staff closed, with their mail and files handed over first.
• Audit log confirmed on: Audit (Standard) in Microsoft 365 keeps records for 180 days, and Google Workspace keeps most log events for generally 6 months.⁶¹⁰

How the changes are made without locking anyone out

Sign-in changes are made on a written plan agreed with you, in an order that keeps the office working. The plan lists who is affected, what each person will see, the date of each step and the way back if a step causes trouble.

Older devices are the usual trap. A scanner that emails documents, an accounting add-in or an old phone mail app may still sign in with basic credentials, and Microsoft warns administrators to check for older protocols before blocking them.¹ We find those devices first and move each one to a supported method. Conditional Access policies can run in report-only mode, which shows who would have been blocked before any policy is enforced.²

What you have in hand at the end

At the end of the review you hold a report on your tenant settings with priorities marked today, this month and later, a list of every change we made with its date, a before-and-after comparison, and a one-page note for the owner in plain language. The report belongs to you and can go to your insurer, your auditor or your next IT provider.

• Settings report for Microsoft 365, Google Workspace or both, with each finding tied to its source.
• Changes made on the agreed plan, listed with dates and the person who approved each one.
• Before-and-after comparison, including Secure Score where it applies.
• Mail authentication handled through our email security service and backups through backup and disaster recovery, when they are in scope.