Google Workspace
Workspace security is mostly about admin console configuration discipline — the controls are there, they're just off or half-configured by default in most tenants I inherit.
Updated
How I use it
- Context-Aware Access policy design across Gmail, Drive, Calendar and Meet
- Third-party OAuth app review and restriction
- Drive external sharing and link-sharing default review
- 2-Step Verification enforcement with security key priority for admins
Recurring problems I find
- Context-Aware Access licensed but never configured beyond the default
- Third-party OAuth apps approved once and never reviewed again
- Link-sharing defaults left at 'anyone with the link' org-wide
Context-Aware Access now extends to all third-party OIDC applications via a single tenant-wide setting.
Related
Cloud security assessment
Configuration and architecture assessment for Azure, GCP and Alibaba Cloud: identity, network, data, logging and CSPM findings with a fix roadmap.
Microsoft 365
Microsoft 365 hardening: SharePoint oversharing, guest access, Purview DLP and DSPM, and data governance ahead of Copilot and agent rollout.