Microsoft 365 and Google Workspace Security Settings Every Business Should Turn On
The most important security settings in Microsoft 365 and Google Workspace are: enforce multi-factor authentication for every user, block legacy sign-in methods that bypass it, turn on advanced phishing and malware protection, stop automatic forwarding of email to outside addresses, restrict external file sharing, limit the number of administrators, and turn on audit logging and alerts. Together, these close the gaps attackers exploit most often in cloud email and file accounts.
Microsoft 365
| # | Setting | Why it matters |
|---|---|---|
| 1 | Require MFA for all users. Use Security defaults on smaller tenants, or Conditional Access policies if you're licensed for Entra ID P1 | Stops most password-based account takeovers |
| 2 | Block legacy authentication (older protocols such as POP, IMAP and basic SMTP authentication) | Legacy protocols can bypass MFA |
| 3 | Use separate admin accounts and keep Global Administrators to 2–4 people | Limits the damage if one account is compromised |
| 4 | Turn on Defender for Office 365 Safe Links and Safe Attachments (where licensed) and use the Standard or Strict preset security policies | Scans links and attachments at click and open time |
| 5 | Block automatic forwarding to external domains in the outbound spam policy | Attackers create forwarding rules to monitor mailboxes silently |
| 6 | Tag external senders | Helps staff spot impersonation |
| 7 | Restrict SharePoint and OneDrive external sharing to specific people, with link expiry | Prevents accidental public exposure of files |
| 8 | Make sure audit logging is on and review sign-in logs | Needed to investigate any incident |
| 9 | Restrict user consent to third-party apps | Blocks malicious apps that request mailbox access |
| 10 | Configure SPF, DKIM and DMARC for your domain | Stops attackers spoofing your exact domain |
Google Workspace
| # | Setting | Why it matters |
|---|---|---|
| 1 | Enforce 2-Step Verification for all users, with security keys or prompts for admins | Stops most account takeovers |
| 2 | Enrol admins in the Advanced Protection Program | Strongest protection for the most powerful accounts |
| 3 | Turn on Gmail's advanced safety settings: enhanced pre-delivery scanning, attachment protection, and spoofing and authentication protection | Catches more phishing and malware before delivery |
| 4 | Disable automatic forwarding to external addresses, or restrict it | Prevents silent mailbox monitoring |
| 5 | Restrict Drive sharing outside your domain, or warn users when they share externally | Reduces accidental data leaks |
| 6 | Control third-party app access (API controls) and block unverified apps | Stops apps that over-request access to data |
| 7 | Keep super admins to a minimum and use separate admin accounts | Limits the impact of a compromise |
| 8 | Review the Alert Center and security dashboard regularly | Early warning of suspicious activity |
| 9 | Turn on endpoint management for phones and laptops that access company data | Allows remote wipe of lost devices |
| 10 | Configure SPF, DKIM and DMARC | Domain spoofing protection |
DMARC in plain English
- SPF lists the servers allowed to send email for your domain.
- DKIM adds a digital signature to prove the email wasn't altered.
- DMARC tells receiving servers what to do with email that fails those checks, and sends you reports.
Start DMARC at p=none to monitor, fix any legitimate services that fail, then move to quarantine and finally reject.
Order of work
- MFA + legacy authentication (day 1)
- Admin accounts (day 1)
- Forwarding rules + external tagging (week 1)
- Email protection policies (week 1)
- Sharing + third-party apps (week 2)
- SPF/DKIM/DMARC (weeks 2–6, moving gradually to reject)
- Logging and alert review (ongoing)
Tell staff before you enforce MFA, and give them a simple guide. Most problems in rollout are communication problems, not technical ones.
Frequently asked questions
Is Microsoft 365 secure by default?
Microsoft 365 includes strong security features, but many must be enabled and configured. New tenants get Security defaults, which help, but settings such as forwarding restrictions, sharing limits and DMARC are usually left to the business.
Do we need extra licences for these settings?
Many settings are available in standard business plans. Some, such as Conditional Access in Microsoft 365 and certain advanced protections, need higher-tier licences. Check your plan before choosing an approach.
Will enforcing MFA disrupt our staff?
Briefly. With a short guide and a set enrolment window, most teams adapt within a day. Authenticator apps with push approval keep sign-in quick.
How do I know if someone has set up a malicious forwarding rule?
Review mailbox rules in the admin centre and watch for alerts about new external forwarding. Blocking external auto-forwarding prevents most of these rules from working.
Want it done properly, in a day?
Eleova's Microsoft 365 and Google Workspace security hardening starts from $399. Strengthen your digital security →