How do I secure Microsoft 365 or Google Workspace for a small business?

The details

Both platforms publish security baselines and secure score style dashboards that list recommended settings. Review them every few months, because new features arrive with default settings that may not suit you.

What to do

• Enforce MFA for all users, strongest for admins.
• Keep admin rights to as few accounts as possible.
• Disable legacy authentication protocols.
• Alert on external auto-forwarding rules.
• Publish SPF, DKIM and DMARC records.

Useful next reads and tools

• Phishing Email Header Analyzer · tool

Terms explained

DMARC

DMARC is a DNS policy that tells receiving mail servers what to do with email that fails SPF and DKIM alignment for your domain, and where to send reports about it.

Least privilege

Least privilege means giving each user, service or AI agent only the access it needs to do its job, and no more, for only as long as it needs it.

DKIM

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email so receivers can verify it came from an authorized sender for the domain and was not altered in transit.

Multi-factor authentication

Multi-factor authentication (MFA) requires two or more kinds of proof to sign in, such as a password plus an app prompt, security key or biometric unlock of a passkey.

Phishing

Phishing is a fraudulent message, usually email, that impersonates a trusted sender to trick people into revealing credentials, paying money or running malware.

SPF

SPF (Sender Policy Framework) is a DNS record listing the servers allowed to send email for a domain.

Sources

• CISA: More than a Password (MFA)
• Google Workspace: Email sender guidelines