Microsoft 365 & Google Workspace Administration

Microsoft 365 and Google Workspace Administration

For most organizations, Microsoft 365 or Google Workspace is the digital workplace itself: email, calendars, documents, chat, meetings, and file sharing, plus the identity system everything else trusts. Their default settings are designed for easy collaboration, not for any particular organization's security, legal, or compliance needs — and the consequences of weak administration are concrete: phishing-compromised mailboxes, sensitive files shared with "anyone with the link", former employees with access, and no records when legal or regulators ask.

Good tenant administration treats the platform as critical infrastructure: identity tied to the HR lifecycle, strong authentication, minimal standing admin access, deliberate sharing and retention policies, authenticated email, managed devices, audit logs that someone reviews, and a clear support model for users.

TL;DR

Integrate identity: one source of truth, SSO, SCIM or directory sync, and accounts that follow the joiner–mover–leaver process.
Require MFA (phishing-resistant for admins) and use conditional access or context-aware access.
Keep admin roles minimal and specific; use just-in-time elevation for global or super admin rights.
Set external sharing, guest, and meeting policies deliberately; default links to internal-only.
Configure retention, legal hold, eDiscovery, DLP, and sensitivity labels with legal and security teams.
Authenticate email with SPF, DKIM, and DMARC; manage devices; review audit logs; track platform changes; define user support tiers.

Quick Example

Finding member accounts without MFA registration in Microsoft 365 with Microsoft Graph PowerShell:

Restricting SharePoint and OneDrive sharing to existing guests, with internal-only, view-only default links:

The equivalent MFA check in Google Workspace with the GAM command-line tool:

Core Concepts

Identity and Access

Drive account creation and removal from the HR system through the identity provider, so leavers lose access on their last day. Require phishing-resistant MFA (security keys or passkeys) for administrators, block legacy authentication, and keep two break-glass accounts with strong, monitored credentials. See Identity Lifecycle Management and MFA.

Admin Roles

Most administrators need narrow roles — user management, helpdesk password resets, Exchange or Gmail settings, Teams or Meet settings — not global or super admin. Limit global admins to a few people, elevate just in time where supported, and review role assignments quarterly. See Privileged Access Management.

Collaboration and Sharing Policies

Unapproved OAuth apps with broad mailbox or file scopes are a common data-exposure path; require admin consent and review grants regularly.

Retention, eDiscovery, and Data Protection

Retention policies (Microsoft Purview, Google Vault) keep or delete content by location and age to meet legal and business requirements; legal holds preserve content for litigation; eDiscovery searches and exports it. Data loss prevention policies detect sensitive data such as card or national ID numbers in email and files, and sensitivity labels classify and protect documents with encryption and sharing limits. Design these with legal, privacy, and security teams. See Data Retention.

Email Security

Publish SPF, sign with DKIM, and enforce DMARC (moving from p=none to quarantine or reject once reports show legitimate senders aligned). Enable anti-phishing and attachment protections, warn on external senders, disable automatic forwarding to external addresses, and monitor for suspicious inbox rules — a classic sign of a compromised mailbox.

Devices

Manage devices with Microsoft Intune or Google endpoint management: enrollment, encryption, screen locks, OS updates, app protection for personal devices, and remote wipe of corporate data.

Operations and Support

Lifecycle: on departure, block sign-in, revoke sessions, transfer files and calendars, convert or delegate mailboxes, and remove licenses after retention needs are met.
Audit logs: unified audit logs (Microsoft Purview) and Admin console reports and investigation tool (Google) — forward to the SIEM and alert on admin role changes, mass downloads, and new forwarding rules.
Change tracking: follow the Microsoft 365 Message center and Roadmap, and Google Workspace Updates, to prepare for feature changes.
Backups: understand native retention limits and decide whether third-party or native backup services are needed.
Support model: self-service help, a service desk for common requests, and a small tenant admin team for configuration. See Service Desk Operations.

Best Practices

Automate the Account Lifecycle

Provision and deprovision from HR through the identity provider, not by manual tickets.

Minimize Standing Admin Rights

Use narrow roles, just-in-time elevation, and phishing-resistant MFA for every administrator.

Make Sharing Defaults Safe

Default to internal, view-only links and controlled guest access, and let users request broader sharing deliberately.

Treat Configuration as Managed Change

Document tenant settings, review changes, and use scripts or configuration-as-code tools where possible.

Common Mistakes

Many Global Administrators

Anonymous Links by Default

Manual Offboarding

FAQ

Should Microsoft 365 or Google Workspace be the identity provider?

Either can be, or both can trust an external identity provider. The key is one source of truth, tied to HR, with SSO and provisioning to other applications.

How should external sharing be configured?

Allow sharing with specific external people where business needs it, default links to internal-only and view-only, restrict or expire anonymous links, and review guest access regularly.

What is the difference between retention and backup?

Retention policies keep or delete content inside the platform to meet legal and business rules; backups are independent copies for recovery from deletion, corruption, or account compromise. They serve different purposes.

How do I protect a tenant from phishing?

Require MFA (phishing-resistant for admins), enforce SPF, DKIM, and DMARC, enable anti-phishing protections, block external auto-forwarding, require admin consent for apps, and monitor sign-ins and inbox rules.

How many global or super administrators should a tenant have?

A small number — commonly two to four — plus break-glass accounts, with other administrators using narrower roles.