Google Workspace and Microsoft 365 security hardening
Most break-ins start with a stolen password. This project makes a stolen password close to useless.
- Price
- Fixed-fee, quoted after a free call.
- Typical timeline
- 2 to 4 weeks
Sound familiar?
- Some people have MFA. We are not sure who.
- Half the office seems to be a super admin or a global admin.
- We keep getting phishing emails that look like they came from us.
- Our insurer wants proof of MFA and we need to show it.
What is included
- 2-Step Verification or MFA enforced on every account, with security keys or passkeys for admins.
- Access policies that fit your platform: Context-Aware Access in Google Workspace, Conditional Access in Microsoft 365. Block legacy sign-ins and limit access by device and location where it fits your business.
- Admin cleanup: the fewest possible super admins or global admins, separate admin accounts, scoped roles, and break-glass accounts kept safe.
- Login challenges, alert rules and sign-in risk policies, wherever your edition includes them.
- Single sign-on for your other business apps with SAML or OIDC, so one strong login covers everything.
- Mail authentication with SPF, DKIM and DMARC, plus Gmail or Exchange Online protection settings, so others cannot easily send mail as you.
- Drive, Shared Drive, SharePoint and OneDrive sharing settings that match how you actually work.
- Audit logs and alerting turned on and retained, so there is a record if something goes wrong.
What you receive at the end
- A written runbook: what changed and why, how to add and remove staff, and what to do when someone is locked out.
- A before and after summary you can give to your insurer or a client who asks.
Who it suits
- Businesses on Google Workspace (Business Starter through Enterprise).
- Businesses on Microsoft 365 (Business Basic through Business Premium).
- Anyone who just finished an assessment with identity findings at the top of the list.
Where this work happens
Almost entirely remote: Google Workspace and Microsoft 365 are administered from anywhere. Carson City and Reno clients can have the kickoff and the final walkthrough in person.
Related services
Most clients start with the $1,500 IT and security assessment, so the scope is grounded in facts. This project pairs well with Security retainer and IT and security assessment.
Workspace and Microsoft 365 security: common questions
Will staff get locked out?
Changes roll out in stages: a pilot group first (or report-only mode in Microsoft 365), a short heads-up message to staff, and a grace period before anything is enforced for everyone.
Do we need to buy new licenses?
Sometimes. A few controls need a higher edition, such as Google Workspace Business Plus or Enterprise, or Microsoft 365 Business Premium. You will know exactly what is needed, and why, before you buy anything, and you buy it directly from Google, Microsoft or your existing reseller.
How much of our time does it take?
A kickoff call, a short check-in each week, and a final walkthrough. The work itself happens in the background.
Talk it through first
Every workspace and microsoft 365 security project is fixed-fee, quoted after a free call. Many clients start with the $1,500 IT assessment so the scope is grounded in facts.