Microsoft 365 and Google Workspace Security: 10 Settings Every Business Should Check
Most business email accounts are protected by default settings that leave gaps. Ten configuration checks that close the most common attack paths.
Email and collaboration platforms hold a company's most valuable information: contracts, invoices, customer conversations and passwords sent "just this once". Microsoft 365 and Google Workspace are secure platforms, but many organisations leave important settings at their defaults. These ten checks address the most common ways accounts are compromised.
1. Enforce multi-factor authentication for everyone
Turn on MFA for all users, not only administrators. Prefer authenticator apps with number matching, passkeys or security keys over SMS. Use the platform's security defaults or conditional access policies to require it.
2. Block legacy authentication
Older protocols such as basic authentication for POP, IMAP and SMTP may not support MFA, which lets attackers bypass it. Disable legacy authentication wherever your platform still allows it, after checking which devices or apps still rely on it.
3. Limit and protect admin accounts
- Keep the number of global or super admins small.
- Use separate admin accounts that are not used for daily email.
- Protect admin accounts with the strongest MFA available.
- Assign specific admin roles (for example, user management or billing) instead of full admin rights.
4. Configure SPF, DKIM and DMARC
These DNS records help receiving servers verify that email claiming to come from your domain really does. Start DMARC in monitoring mode, review reports, then move to quarantine or reject. This makes it much harder for attackers to spoof your domain in phishing emails.
5. Control automatic forwarding to external addresses
Attackers who compromise a mailbox often create rules that forward all email to an outside address. Block automatic external forwarding by default and allow exceptions only where needed.
6. Review external sharing
Check settings for sharing files, folders and sites with people outside the organisation:
- Prefer sharing with specific people rather than "anyone with the link".
- Set expiry dates for external links.
- Regularly review what is shared externally, especially for finance and HR folders.
7. Turn on alerts and audit logs
Make sure audit logging is enabled and that someone receives alerts for:
- Suspicious sign-ins or sign-ins from unusual locations.
- New inbox forwarding rules.
- Mass file downloads or deletions.
- Changes to admin roles.
Alerts are only useful if someone reads them, so route them to an address that is monitored.
8. Use built-in email protection
Enable the platform's protections against phishing, malicious attachments and unsafe links. Add a banner warning users when an email comes from outside the organisation.
9. Manage devices
Require basic device security for accessing company data: screen lock, encryption and up-to-date operating systems. Use mobile device management to remove company data from lost or departed employees' phones.
10. Have a clean offboarding process
When someone leaves:
- Block sign-in immediately and revoke sessions.
- Transfer mailbox and files to a manager.
- Remove them from shared mailboxes, groups and external shares.
- Recover company devices.
Forgotten accounts of former employees are a common entry point.
Quick checklist
| Check | Done |
|---|---|
| MFA enforced for all users | ☐ |
| Legacy authentication blocked | ☐ |
| Few, separate, strongly protected admins | ☐ |
| SPF, DKIM and DMARC configured | ☐ |
| External auto-forwarding blocked | ☐ |
| External sharing reviewed and limited | ☐ |
| Security alerts monitored | ☐ |
| Phishing and attachment protection on | ☐ |
| Device requirements enforced | ☐ |
| Offboarding checklist in use | ☐ |
A real-world example
A trading company noticed that a supplier had received an email, apparently from its finance manager, asking to update bank details. The finance manager had sent nothing. Investigation showed his password had been reused on another website that was breached, MFA was not enforced, and a hidden inbox rule forwarded all invoices to an outside address. The company enforced MFA for all users, blocked automatic external forwarding, configured DMARC for its domain and set up alerts for new inbox rules and unusual sign-ins. It also introduced a rule that any bank detail change must be confirmed by phone using a known number. None of these steps required new software, only better use of settings the company already paid for.
Frequently asked questions
Do these settings cost extra? Many are included in standard business plans. Some advanced features, such as detailed conditional access or advanced threat protection, may require higher plans. Start with what your plan includes.
Will enforcing MFA annoy our staff? A short explanation and a guided setup session help a lot. With authenticator apps and "remember this device" options, daily friction is small compared to the protection gained.
How often should we review these settings? Review them at least every quarter and after any major change, such as new departments, a migration or a security incident.
Key takeaways
- Enforce MFA for everyone and block legacy authentication.
- Protect a small number of separate admin accounts with the strongest MFA.
- Configure email authentication and block automatic external forwarding.
- Monitor alerts and run a reliable offboarding process.
KHR Digital Solutions sets up and secures Microsoft 365 and Google Workspace environments as part of its IT infrastructure services.
Related articles
Password Managers for Teams: Why Your Business Needs One and How to Roll It Out
Shared passwords in spreadsheets and chats are a security risk. How team password managers work, what to look for and a smooth rollout plan.
Phishing in 2026: How to Recognise and Stop Modern Attacks
Phishing has moved beyond badly written emails to AI-written messages, QR codes, fake login pages and voice calls. Warning signs and defences that work.
Passkeys Explained: Why Passwords Are Being Replaced and How to Prepare
Passkeys let people sign in with a fingerprint, face or device PIN instead of a password. What they are, why they resist phishing, and how businesses can adopt them.