Email, cloud & backup
Microsoft 365 and Google Workspace: the security settings a small business should check
Most small businesses run on Microsoft 365 or Google Workspace, and both are secure platforms. But many of the protections that matter aren’t fully switched on by default, or were set up years ago by someone who has since moved on. These are the settings worth checking, whichever platform you use.
The short version
Check these first
- MFA required for every user, not just admins.
- Separate admin accounts, and as few of them as possible.
- Automatic forwarding to outside addresses blocked.
- SPF, DKIM and DMARC set up for your domain.
Why these settings matter
When a small business mailbox is compromised, attackers usually got in with a stolen password, then used the mailbox to read conversations, forward emails and send fake invoices. The settings below target exactly that pattern.
You’ll need an administrator account for your tenant. If someone else manages it for you, use this as a checklist to ask them about.
The settings
| Setting | Microsoft 365 | Google Workspace |
|---|---|---|
| MFA for everyone | Turn on Security defaults in Microsoft Entra, or Conditional Access policies on Business Premium | Enforce 2-Step Verification for all users under Security, Authentication |
| Block legacy sign-in | Security defaults blocks older protocols that skip MFA | Turn off Less secure apps access where still available |
| Separate admin accounts | Use a dedicated admin account with no mailbox for daily use | Use a separate super admin account, protected with a security key |
| Block external auto-forwarding | Outbound spam policy in Microsoft Defender: set automatic forwarding to Off | Turn off automatic forwarding in Gmail settings for users |
| Alerts for suspicious activity | Review alert policies in the Microsoft Defender portal | Review the Alert center and set email notifications |
| Audit logging | Make sure audit logging is on in Microsoft Purview | Use the audit and investigation tools in the Admin console |
| Email authentication | Set up SPF, DKIM and DMARC for your domain | Set up SPF, DKIM and DMARC for your domain |
Exact menu names change from time to time, so search the admin help if something has moved.
In more detail
Require MFA for every account
Including the receptionist, the casual and the shared mailbox you think nobody uses. Attackers look for the account without it. See two-step verification.
Keep admin accounts few and separate
Two global or super admins is usually right for a small business, so one person leaving doesn’t lock you out. Those accounts should only be used for admin tasks, with the strongest sign-in method you have, ideally passkeys or security keys.
Block automatic forwarding to outside addresses
A forwarding rule to an outside address is one of the first things attackers set up. Blocking it at the tenant level stops it working even if they get in.
Set up SPF, DKIM and DMARC
These DNS records tell other email systems which servers may send email for your domain, and what to do with email that fails the check. They make it much harder for scammers to send email pretending to be you. Start DMARC in monitoring mode, then tighten it once you’ve confirmed your legitimate email passes.
Review who has access
Check for former staff, old contractors and external guests who still have access to files or Teams and Shared Drives. Remove what isn’t needed.
Check sharing settings
Decide whether staff can share files with anyone on the internet using a link, or only with signed-in people. For most businesses, requiring sign-in for external sharing, or setting links to expire, is a sensible default.
Microsoft 365 Business Premium is worth a look
It includes Conditional Access, Intune device management and Defender for Business. For many small businesses it covers several Essential Eight controls without extra products.
Habits that keep it secure
- Review sign-in alerts and risky sign-in reports regularly.
- Follow a proper process when staff leave. See onboarding and offboarding.
- Remember the platform keeps your data available, but a separate backup protects you from deletion, ransomware and mistakes.
- Check Microsoft Secure Score or Google’s security health page every few months.
Common questions
Will turning on Security defaults break anything?
It may affect very old email apps and devices that don’t support modern sign-in. Those should be updated anyway. Tell staff before you turn it on, so they’re ready to set up MFA.
Do we need a separate backup for Microsoft 365 or Google Workspace?
They’re reliable services, but deleted or encrypted data can still be lost, and retention is limited. A third-party backup is worth it for most businesses.
We use a shared mailbox like info@. Does it need MFA?
In Microsoft 365, block direct sign-in to shared mailboxes and give people access through their own accounts. In Google Workspace, use a group or a delegated mailbox rather than a shared password.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.