# How do we secure our Microsoft 365 or Google Workspace accounts?

Start with identities, because most account takeovers begin with a phished or reused password. The essentials, in order: multi-factor authentication for every user, with phishing-resistant methods such as security keys or passkeys for admins; separate admin accounts used only for administration, and as few global admins as possible; legacy authentication protocols that bypass MFA switched off; sign-in policies that block risky locations or unmanaged devices where your licence allows; audit logging switched on and kept long enough to investigate; alerts on new mail forwarding rules, new admin roles and new OAuth app consents; limits on external sharing and on which third-party apps users may connect; and a backup of mail and files outside the provider, because the provider's recycle bins are not a backup. Review admin roles and guest accounts every quarter. Most of this is configuration you already pay for. A network sensor does not see what happens inside these services; what it can add is the view of the devices that connect to them, such as a laptop that starts beaconing after someone opened a phishing attachment.

FAQ: [Cloud and SaaS security](https://netsenx.com/en/faq/cloud) · https://netsenx.com/en/faq/how-to-secure-microsoft-365-and-google-workspace-accounts

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/eu-data-residency

## Related questions

- [What is OAuth consent phishing?](https://netsenx.com/en/faq/what-is-oauth-consent-phishing)
- [Which cloud and SaaS logs should we switch on and keep?](https://netsenx.com/en/faq/what-logs-should-we-keep-for-cloud-and-saas)
- [What happens if cloud access keys leak, for example on GitHub?](https://netsenx.com/en/faq/what-happens-if-cloud-access-keys-leak)
- [What is a misconfigured storage bucket and how do we avoid one?](https://netsenx.com/en/faq/what-is-a-misconfigured-storage-bucket)
- [What is the cloud metadata service, and why do attackers want it?](https://netsenx.com/en/faq/what-is-the-cloud-metadata-service-and-why-do-attackers-want-it)