Microsoft 365 and Google Workspace: start with the admins
The questions we’d put to whoever runs your admin console, starting with who holds admin rights.
Start with the people who can change everything
Make a list of everyone with full admin rights in your Microsoft 365 or Google Workspace. In a thirty-person company that list is often longer than expected. The founder is on it. So is a former IT contractor, whoever set up the domain years ago, and sometimes a reseller.
An admin account can switch off protections for every other account, so it should have the strongest sign-in you have. We’d want at least two admins, so a lost phone can’t lock you out. Add an emergency account that nobody uses day to day, and make sure someone would notice if it were used.
Identity and device checks
MFA gaps are often exceptions. It’s on for everyone except the accounts that broke when it was switched on, and those exceptions have no end date.
Leavers are the other gap. Disabling someone’s main account does not always end sessions already open on their phone or remove them from tools they signed into with that account. Ask to see what was switched off for the last person who left, and when.
On devices, the question to ask is how many laptops can open company email without being managed at all. Personal devices may be fine, as long as someone decided that.
Email and sharing checks
Email spoofing is the risk your customers notice. Three DNS records protect your domain. SPF lists the servers allowed to send as you. DKIM lets receivers check a signature. DMARC tells them what to do with mail that fails, and sends you reports.
Setting DMARC to reject in one step is a common way to stop your own invoices arriving. We’d list every service that sends mail as you first, then tighten the policy in stages.
File sharing is a business choice as much as a security one. Decide who can share files outside the company and whether those links expire, then write the exceptions down.
Questions for whoever runs your admin console
- Who holds admin rights today, and does each person still need them?
- Which accounts are excused from MFA, and until when?
- Which services send email as our domain, and is DMARC enforcing yet?
- When the last person left, what did we switch off, and how long after they went?
Which part of your company this is about
This note is about your team: email, sign-ins and admin accounts. Our company IT security assessment goes through these settings with you.