Google Workspace management and security
Not every business runs on Microsoft. For organizations that live in Gmail, Drive and Meet, we provide the same managed administration and security we deliver for Microsoft 365: people set up properly on day one, settings locked down, email authenticated, data retained, and a real person to call.
Reviewed by the ITRS security team · Last updated
Admin and user lifecycle
Most Google Workspace problems we're asked to fix started as small admin shortcuts: a shared super admin login, a departed employee's account left active 'for their email', groups that let anyone outside the company post. We take day-to-day administration off your plate and keep it tidy:
- Onboarding: accounts created in the right organizational unit, licences assigned, groups and shared drives set up, 2-Step Verification enrolled before first use.
- Changes: role changes, name changes, mail delegation and shared mailboxes handled through a ticket with a record of who asked and who approved.
- Offboarding: sign-out and suspension, mail and Drive ownership transferred, Vault holds where required, connected apps reviewed, devices wiped of company data.
- Admin hygiene: named admin accounts for every person, more than one super admin, super admin accounts separate from daily accounts, and least-privilege admin roles for routine work, following Google's own best practices.
Security settings baseline
We apply and document a baseline drawn from Google's Admin Help security guidance, then tune it for how you work:
| Area | Baseline |
|---|---|
Sign-in | 2SV enforced for everyone; security keys or passkeys only for admins and finance; short new-user enrollment period |
Third-party apps | Unconfigured apps limited to basic 'Sign in with Google'; Gmail and Drive restricted to trusted apps |
Sharing | External sharing defaults set deliberately; warnings for sharing outside the organization; review of public links |
Gmail safety | Advanced phishing and malware protections reviewed; automatic forwarding controlled |
Groups | Posting and membership permissions locked down so outsiders can't email or join internal lists |
Monitoring | Alert center notifications routed to our team; admin log and login events reviewed |
Devices and endpoint management
- Google endpoint management for phones and tablets: screen lock, encryption, and the ability to remove company data from a lost or departing employee's device without touching their personal photos.
- Company-owned laptops managed and patched, with disk encryption and endpoint protection, whether they run Windows, macOS or ChromeOS.
- Device approval where it makes sense, so new devices don't get access to company data until someone checks them.
Email authentication
Spoofing your domain is the cheapest attack there is. We set up and maintain SPF, DKIM signing with your own domain for Google Workspace and every other service that sends as you, and a DMARC policy taken from monitoring (p=none) to enforcement (p=reject) in stages, as RFC 7489 and M3AAWG best practice describe. We read the aggregate reports so you don't have to, and we keep you within Google's and Yahoo's sender requirements if you send newsletters or high volumes.
Vault, retention and backup
- Google Vault retention rules set to match your legal and business obligations, not left at 'keep nothing' or 'keep everything forever'.
- Litigation holds when you anticipate a dispute, so mail and Drive content is preserved defensibly.
- A separate backup of Workspace data where your risk calls for it. Vault is for retention and eDiscovery; it isn't designed to restore a ransomware-encrypted Drive or a mass deletion quickly.
- Exports for departing employees, litigation or regulators handled through documented, repeatable steps.
Support model
Google Workspace management is part of our managed IT plans, and urgent security incidents go to our 24/7 incident line. Day-to-day requests go through tickets so there's a record; changes to security settings are documented and reviewed. We're based in Vaughan with offices in Toronto and Vancouver and have supported Canadian businesses since 2018. We carry $2M cyber liability insurance.
If something has already gone wrong, our forensic team can investigate Google Workspace compromises properly, preserving logs and evidence before the retention windows close, and support your counsel and insurer. For urgent incidents call the 24/7 incident line at (289) 582-9930.
No. We manage both. It is common for an organization's partners and clients to use the other platform, so making the two work together is part of the job.
Yes. We start with an access and settings review, document what we find, rotate admin credentials and fix the high-risk items first.
Not if it's done in the right order. We inventory the apps and sharing your staff actually use first, trust what's needed, then restrict.
A baseline review of admin accounts, 2-Step Verification status, third-party apps, sharing settings, email authentication and Vault rules. You get a short written report ranked by risk, then we fix the urgent items first and agree a schedule for the rest.
Yes. Migrations in either direction are a project of their own; we plan mail, files, calendars and identities so people can keep working through the cut-over.
Related work.
- Case studyCleaning Up a Microsoft 365 Tenant for a Fire Protection & Security CompanyHow IT Rapid Support audited every Microsoft 365 group for a GTA fire protection company, fixed mail routing, and cut an 82,456-item mailbox by 62%.
- Case studyRecovering a Total ERP Database Outage in a Single MorningHow IT Rapid Support traced a total Spire database outage to a changed server network profile and had every affected workstation back the same morning.
Related.
- PracticeManaged IT SupportHelpdesk and break/fix, networking, security systems, devices, Microsoft 365, cloud and backup.
- ServiceMicrosoft 365 Managed Services for Canadian BusinessesMicrosoft 365 needs active management after setup or migration.
- GuideEnforcing 2-Step Verification and security keys in Google WorkspaceTurning on 2-Step Verification in Google Workspace takes a few clicks.
- GuideControlling third-party app access in Google WorkspaceEvery 'Sign in with Google' button and every add-on that asks to 'see, edit and delete your Drive files' is a third-party app with a token to your data.
- ArticleMicrosoft 365 vs Google Workspace in the GTA: What 479 Business Domains Actually RunOriginal 2026 research: 46.8% of 479 GTA business domains run Microsoft 365 and 25.1% Google Workspace, and the two enforce DMARC at very different rates.
Want this handled for your business?
Tell us your users, devices and sites. We are staffed 24/7 and reply with next steps. Quotes are built from your environment, not a price list. Active incident? Call (289) 582-9930, 24/7.