Protection guide by Mark Parfenov, published 10 November 2026
Your email and files run your business, so the way they’re set up matters. Most of these steps apply to both Google Workspace and Microsoft 365. I set up Google Workspace for clients; the Microsoft 365 notes are general advice.
Google Workspace suits teams that live in Gmail, Docs, Sheets and Drive and work in the browser. Microsoft 365 suits teams that depend on Word, Excel, Outlook and Teams. For cold outreach there’s little deliverability difference between the two once mailboxes are authenticated and warmed up. I set up Google Workspace.
Create the account with a company admin address, not a personal one, and verify your domain with the DNS record the platform gives you. Then point your MX records to the platform so mail arrives there.
Add the SPF record your platform specifies, switch on DKIM signing (in the Google Admin console, or in Microsoft’s security settings) and publish a DMARC record. Start DMARC in monitoring mode, read the reports, then move to quarantine or reject once your real senders pass.
Give every person their own account. For addresses like info@ or sales@, use groups or shared mailboxes (Google Groups or Microsoft shared mailboxes) instead of one login many people share.
Turn on two-step verification for all users and enforce it, not just recommend it: in the Google Admin console, or with Microsoft’s security defaults or Conditional Access, depending on your plan. Give admins security keys or an authenticator app.
Have at least two admins so you’re never locked out, keep admin rights to as few people as possible, and use a normal account for everyday work.
Decide whether files can be shared outside the company, warn people before sharing externally, and avoid “anyone with the link” sharing for anything sensitive, in Google Drive or OneDrive and SharePoint.
Switch on the built-in protections against spoofing, phishing links and dangerous attachments: Google’s advanced phishing and malware settings, or Microsoft’s anti-phishing and link-checking policies, depending on your plan. Mark external emails so staff notice them.
Require a screen lock and keep devices updated. Basic device management (Google’s endpoint management or Microsoft Intune, where your plan includes it) lets you wipe company data from a lost device.
Check which third-party apps and AI assistants are connected to accounts, allow only the ones you trust, and give them only the access they need.
Set recovery phone numbers and emails for admins. Retention tools such as Google Vault or Microsoft’s retention policies help with keeping records, but they aren’t a full backup; for important mail and files, use a dedicated backup service.
When someone leaves, suspend their account, transfer their files and email to a colleague, remove them from groups and shared tools, and change any shared passwords they knew.
What I’ve learned and use in practice, checked against current benchmarks and official checklists on 10 November 2026. Experience and benchmarks, not guarantees.
A well-set-up workspace stops most spoofing and account takeovers, keeps company files in company hands and makes your email land in inboxes. Most of it is settings you switch on once.
The first call is free. The diagnostic (€950, fixed) finds where your leads and deals are lost and gives you the fixes in priority order.