How do we secure our Microsoft 365 or Google Workspace accounts?
Start with identities, because most account takeovers begin with a phished or reused password. The essentials, in order: multi-factor authentication for every user, with phishing-resistant methods such as security keys or passkeys for admins; separate admin accounts used only for administration, and as few global admins as possible; legacy authentication protocols that bypass MFA switched off; sign-in policies that block risky locations or unmanaged devices where your licence allows; audit logging switched on and kept long enough to investigate; alerts on new mail forwarding rules, new admin roles and new OAuth app consents; limits on external sharing and on which third-party apps users may connect; and a backup of mail and files outside the provider, because the provider's recycle bins are not a backup. Review admin roles and guest accounts every quarter. Most of this is configuration you already pay for. A network sensor does not see what happens inside these services; what it can add is the view of the devices that connect to them, such as a laptop that starts beaconing after someone opened a phishing attachment.