Clear Path step · Business · Accounts you know and control

Turn on your email system's safety settings

Set onceAbout 90 minNow

Your email system blocks the quiet tricks: unapproved apps, mail forwarded outside and strangers posing as IT in chat.

Why it matters: Both platforms ship with safety settings that stop common takeovers and quiet data leaks, but several are off or loose by default for small businesses. Each is a single setting; together they close the doors attackers use most once they have one password.

On your path if you use Microsoft 365 or Google Workspace.

Do it

  1. Sign in to the admin console with your separate admin account, and note today's date so you can check these settings again next quarter.
  2. If you use Microsoft 365: Turn on security defaults, which require MFA and block older sign-in methods that can't use it, along with device code sign-in; if your plan includes Conditional Access, create policies that do the same instead.
  3. If you use Microsoft 365: In the Entra admin center, set user consent for apps to 'Do not allow user consent' and turn on the admin consent workflow so staff can request apps.
  4. If you use Microsoft 365: In Microsoft Defender, set automatic forwarding in the outbound spam filter policy to 'Off - Forwarding is disabled'; the 'Automatic' default doesn't block forwarding in every organization.
  5. If you use Microsoft 365: In the Teams admin center, limit external access to the specific outside organizations you work with, so strangers can't message staff pretending to be IT.
  6. If you use Microsoft 365: If you use Conditional Access instead of security defaults, block the device code sign-in flow unless someone in the business needs it.
  7. If you use Microsoft 365: Before turning on Copilot, review SharePoint and OneDrive sharing and remove 'everyone' and 'anyone with the link' access to sensitive sites, because Copilot can surface anything a user can open.
  8. If you use Microsoft 365: Open Microsoft Secure Score in the Defender portal and make it the checklist the security owner reviews each month.
  9. If you use Google Workspace: Enforce 2-Step Verification for every user, and steer staff to passkeys or security keys as their second step.
  10. If you use Google Workspace: Give each super admin a separate admin-only account protected by security keys and enrolled in Google's Advanced Protection Program.
  11. If you use Google Workspace: In Security, then Access and data control, then API controls, set Unconfigured third-party apps to allow only apps that request basic sign-in info, so any app that wants user data needs your approval first.
  12. If you use Google Workspace: In Gmail settings for the organization, turn off automatic forwarding.
  13. If you use Google Workspace: In Drive and Docs sharing settings, keep sharing internal by default and turn on warnings when someone shares outside the company.
  14. If you use Google Workspace: Before turning on Gemini, review Drive sharing and remove broad 'anyone with the link' access to sensitive folders, because Gemini can surface anything a user can open.
  15. If you use Google Workspace: Check the Alert center under Security weekly and act on suspicious sign-in alerts.

Say this: If a message from "IT" asks me to approve an app or a sign-in, I check with our IT contact on a known number first.

Check it worked: Your Microsoft 365 or Google Workspace admin console enforces MFA, blocks unapproved app connections and automatic forwarding outside the company, limits outside chat and sharing, and gets a monthly review by the security owner.

If an outside IT company handles your IT, send them this:

Hi, could you please review our Microsoft 365 (or Google Workspace) safety settings? We'd like MFA enforced, older sign-in methods blocked, admin approval for new apps, outside forwarding blocked, outside chat limited to organizations we work with, device code sign-in blocked if unused, and broad sharing removed from sensitive folders before any AI assistant goes on. Please confirm each change and send our Secure Score or security dashboard.

Simply put

Your admin console is like a building's control panel: the alarms and door locks are already installed, but several are switched off at delivery. Turning them on closes the doors attackers use once they have one password.

In detail

These settings target what happens after a password is stolen: forwarding rules that copy mail out, malicious apps that keep access through tokens, and outside chats that impersonate IT. Menu names change often on both platforms, so check each one against the vendor's current admin help before relying on the exact path.

Points toward the Long View: an email system that limits the damage of any one stolen password.

Read more