[{"data":1,"prerenderedAt":244},["ShallowReactive",2],{"footer-services-en":3,"footer-local-en":32,"svc-\u002Fen\u002Fservices\u002Fmicrosoft-365-google-workspace-audit":49,"svc-alt-\u002Fen\u002Fservices\u002Fmicrosoft-365-google-workspace-audit":219,"svc-others-\u002Fen\u002Fservices\u002Fmicrosoft-365-google-workspace-audit":221},[4,8,12,16,20,24,28],{"path":5,"navTitle":6,"order":7},"\u002Fen\u002Fservices\u002Fcybersecurity-audit","Cybersecurity Audit",1,{"path":9,"navTitle":10,"order":11},"\u002Fen\u002Fservices\u002Fpenetration-testing","Penetration Testing",2,{"path":13,"navTitle":14,"order":15},"\u002Fen\u002Fservices\u002Fmicrosoft-365-google-workspace-audit","Microsoft 365 \u002F Google Workspace Audit",3,{"path":17,"navTitle":18,"order":19},"\u002Fen\u002Fservices\u002Flaw-25-compliance","Law 25 Compliance",4,{"path":21,"navTitle":22,"order":23},"\u002Fen\u002Fservices\u002Fremediation-hardening","Remediation and Hardening",5,{"path":25,"navTitle":26,"order":27},"\u002Fen\u002Fservices\u002Fdevelopment-improvement","Development and improvement",5.5,{"path":29,"navTitle":30,"order":31},"\u002Fen\u002Fservices\u002Fongoing-security-partner","Ongoing Security Partner (vCISO)",6,[33,37,41,45],{"path":34,"city":35,"translationKey":36},"\u002Fen\u002Fcybersecurity-audit\u002Fmontreal","Montréal","montreal",{"path":38,"city":39,"translationKey":40},"\u002Fen\u002Fcybersecurity-audit\u002Flaval","Laval","laval",{"path":42,"city":43,"translationKey":44},"\u002Fen\u002Fcybersecurity-audit\u002Fsouth-shore","South Shore","rive-sud",{"path":46,"city":47,"translationKey":48},"\u002Fen\u002Fcybersecurity-audit\u002Fnorth-shore","North Shore","rive-nord",{"id":50,"title":51,"body":52,"deliverables":171,"description":178,"extension":179,"faq":180,"icon":190,"idealFor":191,"meta":196,"navTitle":14,"navigation":197,"order":15,"path":13,"price":190,"process":198,"rawbody":214,"seo":215,"stem":216,"tagline":217,"translationKey":190,"__hash__":218},"services_en\u002Fen\u002Fservices\u002Fmicrosoft-365-google-workspace-audit.md","Microsoft 365 and Google Workspace Security Audit",{"type":53,"value":54,"toc":160},"minimark",[55,59,62,67,72,75,79,82,86,89,98,102,105,127,135,139,142,145,149,157],[56,57,58],"p",{},"For most small businesses, Microsoft 365 or Google Workspace is the heart of the operation: email, documents, calendars, Teams or Meet. That also makes it a prime target for fraudsters. A single compromised account is enough to redirect a payment or phish your clients from a legitimate address.",[56,60,61],{},"Default settings aren't always the safest, and configurations drift over the years: former administrators, temporary exceptions that became permanent, forgotten sharing links. Our audit cleans things up without changing anything in your environment.",[63,64,66],"h2",{"id":65},"what-we-check-in-microsoft-365","What we check in Microsoft 365",[68,69,71],"h3",{"id":70},"identity-and-access-microsoft-entra-id","Identity and access (Microsoft Entra ID)",[56,73,74],{},"MFA on every account, starting with administrators; Conditional Access policies or security defaults; blocking legacy authentication, the older protocols that let attackers bypass MFA; the number of Global Administrators; user consent to third-party apps.",[68,76,78],{"id":77},"email-exchange-online-and-defender","Email (Exchange Online and Defender)",[56,80,81],{},"Mailbox auditing enabled; automatic forwarding rules to external addresses; anti-phishing policies, Safe Links and Safe Attachments in Defender for Office 365; SPF, DKIM and DMARC records.",[68,83,85],{"id":84},"sharing-and-logging","Sharing and logging",[56,87,88],{},"External sharing in SharePoint, OneDrive and Teams; \"Anyone\" links; guest access; the unified audit log and how long logs are retained.",[56,90,91,92,97],{},"Our ",[93,94,96],"a",{"href":95},"\u002Fen\u002Fblog\u002Fmicrosoft-365-security-audit","Microsoft 365 security audit"," article walks through the most important settings.",[63,99,101],{"id":100},"and-in-google-workspace","And in Google Workspace",[56,103,104],{},"The logic is the same, with Google's tools:",[106,107,108,112,115,118,121,124],"ul",{},[109,110,111],"li",{},"enforced 2-Step Verification, with security keys for super admins;",[109,113,114],{},"the number of super admin accounts and separation of admin accounts from daily use;",[109,116,117],{},"control over third-party apps that can access your data (API controls and OAuth);",[109,119,120],{},"Gmail safety settings: spoofing protection, attachments, SPF, DKIM and DMARC;",[109,122,123],{},"external sharing in Google Drive and shared drives;",[109,125,126],{},"audit logs and security alerts.",[56,128,129,130,134],{},"Learn more in our article on the ",[93,131,133],{"href":132},"\u002Fen\u002Fblog\u002Fgoogle-workspace-security-audit","Google Workspace security audit",".",[63,136,138],{"id":137},"a-read-only-audit","A read-only audit",[56,140,141],{},"We don't need the keys to the kingdom. In Microsoft 365, your administrator assigns us roles such as Global Reader and Security Reader; in Google Workspace, a custom admin role limited to viewing. The few checks that need more privileges are done alongside your administrator in a shared session.",[56,143,144],{},"The result: no risk of changing a setting by mistake, and you keep full control of your environment. The audit is done entirely remotely, whether your office is in downtown Montréal, Sherbrooke or anywhere else in Quebec.",[63,146,148],{"id":147},"why-its-a-priority-for-small-businesses","Why it's a priority for small businesses",[56,150,151,152,156],{},"Business email compromise is a serious threat for SMBs: a fraudster gets into a mailbox, quietly watches the conversations, then sends fake banking details at just the right moment. Our article on ",[93,153,155],{"href":154},"\u002Fen\u002Fblog\u002Fbusiness-email-compromise-ceo-fraud","business email compromise and CEO fraud"," describes how it plays out.",[56,158,159],{},"Cyber insurance questionnaires now routinely ask whether MFA is enforced on email and admin accounts. And your mailboxes hold personal information protected under Quebec's Law 25. A well-configured environment addresses all three concerns at once.",{"title":161,"searchDepth":11,"depth":15,"links":162},"",[163,168,169,170],{"id":65,"depth":11,"text":66,"children":164},[165,166,167],{"id":70,"depth":15,"text":71},{"id":77,"depth":15,"text":78},{"id":84,"depth":15,"text":85},{"id":100,"depth":11,"text":101},{"id":137,"depth":11,"text":138},{"id":147,"depth":11,"text":148},[172,173,174,175,176,177],"A full configuration review of your Microsoft 365 tenant or Google Workspace domain","A list of risky accounts: admins, accounts without MFA, inactive or shared accounts","Findings ranked by risk, with the exact location of each setting to change in the admin console","A check of your SPF, DKIM and DMARC records","A prioritized remediation plan, ready to hand to your IT provider","A results walkthrough and Q&A session with your team","Security audit for Microsoft 365 or Google Workspace: MFA, Conditional Access, sharing, email and logging. Read-only access and a prioritized, plain report.","md",[181,184,187],{"q":182,"a":183},"Do you read our email or documents during the audit?","No. We review settings, logs and account lists, not the contents of your mailboxes or files. The read-only roles we use don't grant access to email content in the first place. Access is removed at the end of the engagement.",{"q":185,"a":186},"Is our Microsoft 365 licence enough to be properly protected?","Several essential protections are available with every licence, such as security defaults, which enforce MFA. Others, like Conditional Access or Defender for Office 365, require higher-tier licences such as Business Premium. The report shows what you can do with your current licences and what an upgrade would add.",{"q":188,"a":189},"Don't Microsoft and Google already handle security?","They secure their infrastructure, but configuring your account is up to you: who can sign in, how, and what can be shared externally. This is the shared responsibility model, and your side of it is exactly what the audit checks.","cloud",[192,193,194,195],"A small business that has used Microsoft 365 or Google Workspace for years without a security review","A company that has dealt with a compromised email account or an attempted payment fraud","An organization that must prove to its insurer that MFA is enforced for everyone","A business whose environment was set up by a former provider or an employee who has since left",{},true,[199,202,205,208,211],{"title":200,"text":201},"Scoping","We confirm your platform, licences and priorities. You then receive a fixed-price quote.",{"title":203,"text":204},"Read-only access","Your administrator grants us read-only access, which you can revoke at any time. We guide you through it step by step.",{"title":206,"text":207},"Analysis","We review identity, email, sharing and logging settings, then go through your accounts one by one.",{"title":209,"text":210},"Report","You receive a prioritized report that sets out, for each finding, the concrete risk and the fix to apply.",{"title":212,"text":213},"Remediation (optional)","Your team applies the fixes, or we take care of them on a quoted basis.","---\ntitle: \"Microsoft 365 and Google Workspace Security Audit\"\nnavTitle: \"Microsoft 365 \u002F Google Workspace Audit\"\ndescription: \"Security audit for Microsoft 365 or Google Workspace: MFA, Conditional Access, sharing, email and logging. Read-only access and a prioritized, plain report.\"\ntranslationKey: cloud\norder: 3\nicon: cloud\nprice: cloud\ntagline: \"Your email and files live in the cloud. Let's make sure the right settings are actually protecting your business.\"\ndeliverables:\n  - \"A full configuration review of your Microsoft 365 tenant or Google Workspace domain\"\n  - \"A list of risky accounts: admins, accounts without MFA, inactive or shared accounts\"\n  - \"Findings ranked by risk, with the exact location of each setting to change in the admin console\"\n  - \"A check of your SPF, DKIM and DMARC records\"\n  - \"A prioritized remediation plan, ready to hand to your IT provider\"\n  - \"A results walkthrough and Q&A session with your team\"\nprocess:\n  - title: \"Scoping\"\n    text: \"We confirm your platform, licences and priorities. You then receive a fixed-price quote.\"\n  - title: \"Read-only access\"\n    text: \"Your administrator grants us read-only access, which you can revoke at any time. We guide you through it step by step.\"\n  - title: \"Analysis\"\n    text: \"We review identity, email, sharing and logging settings, then go through your accounts one by one.\"\n  - title: \"Report\"\n    text: \"You receive a prioritized report that sets out, for each finding, the concrete risk and the fix to apply.\"\n  - title: \"Remediation (optional)\"\n    text: \"Your team applies the fixes, or we take care of them on a quoted basis.\"\nidealFor:\n  - \"A small business that has used Microsoft 365 or Google Workspace for years without a security review\"\n  - \"A company that has dealt with a compromised email account or an attempted payment fraud\"\n  - \"An organization that must prove to its insurer that MFA is enforced for everyone\"\n  - \"A business whose environment was set up by a former provider or an employee who has since left\"\nfaq:\n  - q: \"Do you read our email or documents during the audit?\"\n    a: \"No. We review settings, logs and account lists, not the contents of your mailboxes or files. The read-only roles we use don't grant access to email content in the first place. Access is removed at the end of the engagement.\"\n  - q: \"Is our Microsoft 365 licence enough to be properly protected?\"\n    a: \"Several essential protections are available with every licence, such as security defaults, which enforce MFA. Others, like Conditional Access or Defender for Office 365, require higher-tier licences such as Business Premium. The report shows what you can do with your current licences and what an upgrade would add.\"\n  - q: \"Don't Microsoft and Google already handle security?\"\n    a: \"They secure their infrastructure, but configuring your account is up to you: who can sign in, how, and what can be shared externally. This is the shared responsibility model, and your side of it is exactly what the audit checks.\"\n---\n\nFor most small businesses, Microsoft 365 or Google Workspace is the heart of the operation: email, documents, calendars, Teams or Meet. That also makes it a prime target for fraudsters. A single compromised account is enough to redirect a payment or phish your clients from a legitimate address.\n\nDefault settings aren't always the safest, and configurations drift over the years: former administrators, temporary exceptions that became permanent, forgotten sharing links. Our audit cleans things up without changing anything in your environment.\n\n## What we check in Microsoft 365\n\n### Identity and access (Microsoft Entra ID)\n\nMFA on every account, starting with administrators; Conditional Access policies or security defaults; blocking legacy authentication, the older protocols that let attackers bypass MFA; the number of Global Administrators; user consent to third-party apps.\n\n### Email (Exchange Online and Defender)\n\nMailbox auditing enabled; automatic forwarding rules to external addresses; anti-phishing policies, Safe Links and Safe Attachments in Defender for Office 365; SPF, DKIM and DMARC records.\n\n### Sharing and logging\n\nExternal sharing in SharePoint, OneDrive and Teams; \"Anyone\" links; guest access; the unified audit log and how long logs are retained.\n\nOur [Microsoft 365 security audit](\u002Fen\u002Fblog\u002Fmicrosoft-365-security-audit) article walks through the most important settings.\n\n## And in Google Workspace\n\nThe logic is the same, with Google's tools:\n\n- enforced 2-Step Verification, with security keys for super admins;\n- the number of super admin accounts and separation of admin accounts from daily use;\n- control over third-party apps that can access your data (API controls and OAuth);\n- Gmail safety settings: spoofing protection, attachments, SPF, DKIM and DMARC;\n- external sharing in Google Drive and shared drives;\n- audit logs and security alerts.\n\nLearn more in our article on the [Google Workspace security audit](\u002Fen\u002Fblog\u002Fgoogle-workspace-security-audit).\n\n## A read-only audit\n\nWe don't need the keys to the kingdom. In Microsoft 365, your administrator assigns us roles such as Global Reader and Security Reader; in Google Workspace, a custom admin role limited to viewing. The few checks that need more privileges are done alongside your administrator in a shared session.\n\nThe result: no risk of changing a setting by mistake, and you keep full control of your environment. The audit is done entirely remotely, whether your office is in downtown Montréal, Sherbrooke or anywhere else in Quebec.\n\n## Why it's a priority for small businesses\n\nBusiness email compromise is a serious threat for SMBs: a fraudster gets into a mailbox, quietly watches the conversations, then sends fake banking details at just the right moment. Our article on [business email compromise and CEO fraud](\u002Fen\u002Fblog\u002Fbusiness-email-compromise-ceo-fraud) describes how it plays out.\n\nCyber insurance questionnaires now routinely ask whether MFA is enforced on email and admin accounts. And your mailboxes hold personal information protected under Quebec's Law 25. A well-configured environment addresses all three concerns at once.\n",{"title":51,"description":178},"en\u002Fservices\u002Fmicrosoft-365-google-workspace-audit","Your email and files live in the cloud. Let's make sure the right settings are actually protecting your business.","f205_19uFWpbkA-kak-ra6-lbX9hxGhhK3MxI9I3qHU",{"path":220},"\u002Fservices\u002Faudit-microsoft-365-google-workspace",[222,226,229,233,237,240],{"path":5,"navTitle":6,"tagline":223,"icon":224,"price":225,"order":7},"Find out where your business really stands, and get a clear, prioritized plan to fix what matters most.","audit","diagnostic",{"path":9,"navTitle":10,"tagline":227,"icon":228,"price":228,"order":11},"We attack your systems the way a real adversary would, with your written permission, so you can fix the gaps first.","pentest",{"path":17,"navTitle":18,"tagline":230,"icon":231,"price":232,"order":19},"Turn Law 25 from a vague to-do into documented, working practices, starting with the security of your data.","law","loi25",{"path":21,"navTitle":22,"tagline":234,"icon":235,"price":236,"order":23},"Not just an audit: we do the fixes ourselves, at your office in Greater Montréal or remotely.","wrench",null,{"path":25,"navTitle":26,"tagline":238,"icon":239,"price":236,"order":27},"A band of geeks who code, at your office: we fix, improve and automate your tools, with security built in from the start.","code",{"path":29,"navTitle":30,"tagline":241,"icon":242,"price":243,"order":31},"A part-time security lead who knows your business and keeps an eye on your risks, month after month.","partner","vciso",1792981238992]