Email Security for Microsoft 365 and Google Workspace

The threats

• Credential phishing pages that imitate sign-in screens.
• Malicious attachments and links to malware.
• Business email compromise: impersonated executives or suppliers requesting payments or bank detail changes.
• Taken-over mailboxes used to phish customers and partners.
• Spoofed messages that pretend to come from your own domain.

Protect the accounts

• Enforce MFA for every mailbox user, with phishing-resistant methods for administrators.
• Disable legacy authentication protocols that cannot use MFA.
• Use conditional access or context-aware access to restrict risky sign-ins.
• Monitor sign-in alerts and review them promptly.
• Keep administrator accounts separate from mailboxes used for daily email.

Authenticate your domain

Mailbox providers increasingly require authentication. Google's sender guidelines, for example, require SPF, DKIM and DMARC for organizations sending large volumes to personal Gmail accounts.

Microsoft 365

• Apply Microsoft's preset security policies (Standard or Strict) as a starting point.
• Where licensed, use Microsoft Defender for Office 365 features: Safe Links, Safe Attachments and impersonation protection for executives and key domains.
• Control automatic external forwarding through the outbound spam policy.
• Use alert policies for suspicious inbox rules and forwarding.
• Show external sender tags and make the built-in Report button available to users.
• Review quarantine policies so users know what is held and how to request release.

Google Workspace

• Enable the Gmail safety settings for attachments, links and spoofing, including protection against lookalike domains and employee name impersonation.
• Turn on enhanced pre-delivery message scanning.
• Use the security sandbox for attachments where your edition includes it.
• Show warnings for external recipients and restrict automatic forwarding.
• Monitor the alert center for suspicious sign-ins and forwarding changes.

Forwarding, rules and connected apps

Attackers who take over a mailbox often create rules that forward copies of mail or hide replies. Block automatic external forwarding by default, alert on new forwarding and deletion rules, and review third-party applications that users have allowed to read mail.

Stop payment fraud with process

• Require a call-back to a phone number already on file before changing any supplier's bank details.
• Use dual approval for payments above a set amount.
• Verify urgent or confidential payment requests from executives through a second channel.
• Control changes to supplier master data in the finance system.

Help people help you

• Run short, regular awareness sessions built around real examples.
• Use phishing simulations to teach, not to punish.
• Make reporting a suspicious message one click, and tell reporters what happened.

When a mailbox is compromised

1. Reset the password, revoke sessions and review registered MFA methods.
2. Remove malicious inbox rules, forwarding and connected applications.
3. Check sent items and warn anyone who received phishing from the account.
4. Assess what data the attacker could have accessed.
5. If personal data was exposed, follow your breach management procedure.