Know what your workspace plan protects.

Match the plan to the controls you need.

A subscription label does not tell you whether the tenant is configured securely. Start with the controls required by your data, devices, contracts, and recovery needs. Then check which are available in your current edition and which require another license or service.

• Identity: multi-factor authentication, administrator roles, application consent, and emergency access.
• Data: external sharing, device access, retention, and restrictions for sensitive material.
• Visibility: the events you can inspect, how long they remain available, and who reviews alerts.
• Recovery: what can be restored, by whom, and within which limits.

Ask the administrator for evidence from your environment. For each control, record enabled, partially enabled, unavailable, or not assessed. “We bought the premium plan” is not a completed check.

Choose your checklist.

Microsoft 365: ten checks →
Google Workspace: ten checks →

The checklists identify decisions to make with an administrator. They are not a universal configuration script. Test changes, account for service dependencies, and keep a recovery route before enforcing a new rule.

Use a baseline, then document the exceptions.

CISA publishes assessment tooling for Microsoft 365 through ScubaGear and Google Workspace through ScubaGoggles. These are useful starting points for an administrator who can review the required permissions and interpret the results.

A failed check needs investigation. A passing report covers the checks it ran, not every security risk or legal obligation. Document exceptions with a reason, an owner, a compensating control where appropriate, and a review date.

Use a short meeting to agree the three highest-priority gaps. Assign an owner and target date to each. Recheck after changes and after material changes to the workspace.

Finish with a restoration exercise. The recovery guide helps distinguish what is retained from what you can actually get back.