For most small businesses, Microsoft 365 or Google Workspace is the heart of the operation: email, documents, calendars, Teams or Meet. That also makes it a prime target for fraudsters. A single compromised account is enough to redirect a payment or phish your clients from a legitimate address.
Default settings aren't always the safest, and configurations drift over the years: former administrators, temporary exceptions that became permanent, forgotten sharing links. Our audit cleans things up without changing anything in your environment.
What we check in Microsoft 365
Identity and access (Microsoft Entra ID)
MFA on every account, starting with administrators; Conditional Access policies or security defaults; blocking legacy authentication, the older protocols that let attackers bypass MFA; the number of Global Administrators; user consent to third-party apps.
Email (Exchange Online and Defender)
Mailbox auditing enabled; automatic forwarding rules to external addresses; anti-phishing policies, Safe Links and Safe Attachments in Defender for Office 365; SPF, DKIM and DMARC records.
Sharing and logging
External sharing in SharePoint, OneDrive and Teams; "Anyone" links; guest access; the unified audit log and how long logs are retained.
Our Microsoft 365 security audit article walks through the most important settings.
And in Google Workspace
The logic is the same, with Google's tools:
- enforced 2-Step Verification, with security keys for super admins;
- the number of super admin accounts and separation of admin accounts from daily use;
- control over third-party apps that can access your data (API controls and OAuth);
- Gmail safety settings: spoofing protection, attachments, SPF, DKIM and DMARC;
- external sharing in Google Drive and shared drives;
- audit logs and security alerts.
Learn more in our article on the Google Workspace security audit.
A read-only audit
We don't need the keys to the kingdom. In Microsoft 365, your administrator assigns us roles such as Global Reader and Security Reader; in Google Workspace, a custom admin role limited to viewing. The few checks that need more privileges are done alongside your administrator in a shared session.
The result: no risk of changing a setting by mistake, and you keep full control of your environment. The audit is done entirely remotely, whether your office is in downtown Montréal, Sherbrooke or anywhere else in Quebec.
Why it's a priority for small businesses
Business email compromise is a serious threat for SMBs: a fraudster gets into a mailbox, quietly watches the conversations, then sends fake banking details at just the right moment. Our article on business email compromise and CEO fraud describes how it plays out.
Cyber insurance questionnaires now routinely ask whether MFA is enforced on email and admin accounts. And your mailboxes hold personal information protected under Quebec's Law 25. A well-configured environment addresses all three concerns at once.