Google Workspace runs email, calendars, documents, video meetings and shared files for thousands of small businesses. It’s easy to start using, which is exactly why so many businesses never go back to look at how it’s set up. Someone created the account years ago, a few people were added, and nobody has reviewed the settings since.
In the Google Workspace accounts we review, the same pattern shows up: the business is paying for a capable platform but running it on defaults. Here are the biggest opportunities, in three groups: security, licensing and productivity.
Part 1: Security settings worth checking today
One compromised Google account can expose email, Drive files and everything those accounts are signed in to. Google provides strong protections, but many of them have to be turned on and enforced by an administrator.
Enforce 2-Step Verification for every user
Two-step verification (also called two-factor or multi-factor authentication) stops most password-based attacks. In the Admin console you can require it instead of leaving it up to each person, and you can set a grace period for new users. The key word is every: owners, administrators and shared accounts included.
Separate your administrator accounts
If the account you read email with every day is also a super administrator, a single phished password hands over the whole domain. Keep super admin accounts separate, protected with 2-Step Verification, and used only for administration. Limit how many people have admin rights.
Block old sign-in methods
Older apps and sign-in methods can bypass modern protections. Make sure only approved apps can access your data, and review which third-party apps people have connected to their accounts.
Control automatic email forwarding
After an account is compromised, attackers often add a forwarding rule that quietly copies new mail to an outside address. You can restrict automatic forwarding and review who has it turned on.
Review how files are shared
Google Drive makes sharing fast, sometimes too fast. Check whether “anyone with the link” sharing is allowed and whether that’s right for your business. Many businesses limit sharing to named people and move important files into shared drives, where they belong to the company and not to one person.
Set up email authentication for your domain
SPF, DKIM and DMARC records stop other people from sending fake email as your business. Check yours with our free Email Security Checker, and let it watch your domain for changes.
Part 2: Licensing, the quiet budget leak
Workspace is billed per user, so unused accounts cost money every month.
- Former employees. A suspended or deleted account that was never cleaned up, or a mailbox someone still pays for, is the most common leak. Before removing anyone, transfer their Drive files and email to the right person.
- Shared mailboxes. A mailbox that several people use, such as sales@ or support@, often doesn’t need a full paid user. A group or shared inbox can do the job.
- The wrong plan. Different Workspace plans include different security, storage and management features. Look at what your plan actually includes before assuming you’re covered, and before paying for a separate tool that a higher plan already has.
We review licensing with each client at least once a year so the plan still matches how people work.
Part 3: Productivity features you’re already paying for
Use shared drives
A shared drive keeps team files in one place that doesn’t depend on any one employee. Permissions are set by team or project, and if someone leaves, the files stay. For many offices, shared drives are a clean replacement for an aging file server.
Make Calendar and Meet do more
Shared calendars, room and resource booking, and appointment scheduling pages replace a lot of back-and-forth email. Meet works from any device without installing anything.
Standardize onboarding and offboarding
A new employee can get the right groups, shared drives and settings on day one. When someone leaves, their access can be shut off the same day and their data handed to a manager.
Automate the repetitive stuff
Google Forms, Sheets and simple scripts can replace paper forms, hand-tracked spreadsheets and email chains. Pick one repetitive process each quarter and automate it.
Don’t forget backup
Google keeps your data available, but that isn’t the same as a backup. Deleted items and files from removed users can be recovered only for a limited time, and if ransomware encrypts files in a synced folder, the encrypted copies can sync to the cloud. A separate Google Workspace backup keeps independent copies of your email, Drive and other data, so you can restore a single message or a whole account from before the problem. It’s inexpensive and one of the easiest risks to remove.
A 10-minute Google Workspace health check
Put these questions to whoever manages your account:
- Is 2-Step Verification enforced for every user, including admins and shared accounts?
- How many super administrators do we have, and do they use separate admin accounts?
- Is automatic forwarding to outside addresses restricted?
- Which third-party apps have access to our data?
- Can anyone share files with “anyone with the link”?
- Are we paying for accounts that belong to former employees?
- Do our SPF, DKIM and DMARC records protect our domain?
- Is our email and Drive data backed up by a separate service?
If several of those don’t have a clear answer, there’s likely both savings and risk reduction waiting to be found.
How we help
We administer and secure Google Workspace for small businesses, including users, shared drives, 2-Step Verification, email security, backups and day-to-day support, and we handle migrations to or from Microsoft 365. Administration and backup are included in our Business and Premium managed IT plans. See our Microsoft 365 and Google Workspace page for more, or read our companion guide, Getting More From Microsoft 365.
Want a second opinion on your Google Workspace setup? We’ll review your security, licensing and backup as part of a free assessment.
Leave a Reply