--- title: "Microsoft 365 and Google Workspace" description: "Tenant setup and hardening, migrations, identity, licensing, Teams, SharePoint and Google Drive governance, and day to day administration." url: https://www.expandware.com/services/managed-it/microsoft-365-and-google-workspace/ section: "Services" topics: ["Managed IT", "Microsoft 365", "Microsoft Entra ID", "Exchange Online", "Microsoft Teams"] publisher: "Expandware Private Limited" --- # Microsoft 365 and Google Workspace Tenant setup and hardening, migrations, identity, licensing, Teams, SharePoint and Google Drive governance, and day to day administration. Microsoft 365 and Google Workspace, configured properly and kept that way. Productivity platforms are where most of an organization's information lives, and where default settings leave the most risk. We set up and migrate tenants, harden security and identity, govern how files and sites are shared, keep licensing matched to actual use, and administer the platform day to day, with every change documented and reviewed. Where it usually starts: - The tenant was set up quickly years ago, and nobody has reviewed its security settings since. - Files are shared with anyone who has the link. - Licence costs grow while some licences sit unused. - A migration from another mail system or tenant is due. What is included: - Tenant setup and hardening: Secure defaults, conditional access, multifactor authentication and audit logging. - Migrations: Mail, files and chat moved from other platforms or tenants in planned waves. - Identity: Entra ID or Google identity, single sign-on and lifecycle management. - Collaboration governance: Teams, SharePoint and Drive structures, sharing policies and retention. - Licence management: Licences matched to roles and usage, and reviewed regularly. - Administration: Day to day changes, user management and platform updates. Where it sits: The productivity platform sits in the run layer of the managed IT architecture: mail, files, chat and identity for your people, administered by us and supported through the service desk. Decisions to settle early: - Harden now or migrate first. If a migration is coming, hardening the old tenant may be wasted effort; if not, it should happen at once. We sequence the two. - How open sharing should be. Open sharing helps collaboration and leaks data. The default is set to your risk appetite, with exceptions by request. - Which licences people need. Premium licences bundle security features some roles need and others do not. Roles decide the mix. How the work runs: Assess, Configuration, security and licensing. Harden, Identity, sharing and audit settings. Migrate, Mail, files and chat in waves. Administer, Ongoing changes and reviews. How it is bought: - A fixed-fee assessment: We review the tenant's identity, sharing, mail and audit settings against current guidance, and compare licences with actual use. You receive ranked findings and a fixed price for hardening or migration. - A fixed-price build: Hardening, governance policies, licence changes and any migration in scope, delivered at a fixed price with every setting documented. - Running it afterwards: Administration then runs monthly: changes, user management, licence reviews and platform updates, each recorded. Worked example, a tenant nobody had reviewed in years. Say an architecture practice set up its Microsoft tenant quickly when staff began working from home. Files are shared by open links, some accounts have no multifactor authentication, and the licence bill keeps rising. - Assess: We review identity, mail, sharing and audit settings against current guidance, and compare licences with how each person actually works. - Harden: Multifactor authentication and conditional access are enforced, legacy sign in methods are blocked, and audit logging is switched on. - Govern: Sharing defaults change to named people, project sites get owners and retention rules, and existing open links are reviewed with their owners. - Administer: Day to day changes run through us with a record, and licences are reviewed regularly against joiners and leavers. At the end, the tenant has a documented baseline, sharing is deliberate rather than accidental, and the licence count matches the people who need each licence. (An illustration, not a client account.) What you have at the end: - Tenant security assessment: Your tenant's settings compared with the CIS benchmark and current guidance, with each finding ranked. - Configuration baseline documentation: The approved settings for identity, mail, sharing and audit, so drift from them can be detected. - Migration plan and cutover runbooks: Mailboxes, files and chats grouped into waves, each with its cutover steps and its message to users. - Sharing and retention policies: Who can share what with whom, and how long each kind of information is kept. - Licence optimization report: Licences matched against roles and actual use, with the changes that cut cost without removing what people need. Standards and platforms worked with: Microsoft 365, Microsoft Entra ID, Exchange Online, Microsoft Teams, SharePoint, Google Workspace, Microsoft Purview, CIS Microsoft 365 Benchmark. Where it goes wrong, and what we design out: - Defaults left in place. A tenant set up quickly keeps permissive defaults for years. Sharing, sign in and audit settings are deliberately configured and documented. - Migration without coexistence. Moving mail in one weekend strands calendars and shared mailboxes. Waves are planned with coexistence, so people keep working. - Licences that follow nobody. Licences assigned once and never reviewed cost money for leavers. Licences are reviewed against joiners, leavers and roles. What it changes: - A hardened tenant. Security settings match current guidance instead of the defaults from setup day. - Controlled sharing. Information is shared on purpose, and external access is reviewed. - Licences that match use. You pay for the licences people need, at the tiers they need. How you will know it is working: - Every account signs in with multifactor authentication. - Files are shared with named people by default. - Unused licences are removed at each review. - Changes to the tenant are recorded and reviewable. Who you work with: - Platform architect. Designs the tenant configuration, identity and governance. - Migration engineers. Plan and run mail, file and chat migrations in waves. - Platform administrators. Handle changes, users and updates day to day, with every change recorded. What we need from you: - Global administrative access, or a delegated admin relationship. - Your retention and legal hold requirements from legal or compliance. - A communications contact for each migration wave. - Your current licence contract and renewal date. Common questions: Q: Can you migrate us from Google Workspace to Microsoft 365, or the reverse? A: Yes, in either direction. Mail, calendars, files and chat move in waves with coexistence between the platforms, so people keep working during the move. Q: Is the default Microsoft 365 configuration secure? A: It is a starting point, not a finished configuration. Most tenants need conditional access, stronger authentication, audit logging, sharing limits and alerting configured to match their risk. Q: Can you reduce our licensing costs? A: Often. Unused licences, premium tiers assigned where standard would do and overlapping add-ons are common. We report what is used and recommend changes, which you approve. Q: Do you manage Copilot and other AI features? A: Yes. We review data access and sharing before AI features are enabled, because an assistant can surface anything the user can already reach, including files that were overshared years ago. Q: Can we use both Microsoft 365 and Google Workspace? A: Yes, though it is worth being deliberate about it. Some organizations keep both after an acquisition or for different teams. We set up identity so one account signs in to both, decide which platform is home for each kind of work, and make sharing between them work without duplicating files. Q: How do you prepare users for a mail migration? A: Each wave is told in advance what will change, when, and what they need to do, which is usually very little. Calendars, contacts and shared mailboxes move with the mail, and the support desk knows the schedule, so the questions on the first morning are answered quickly. Q: What is conditional access? A: A set of policies that decide, at each sign in, whether to allow access, ask for more verification or block it, based on the user, the device, the location and the risk. It is how multifactor authentication and device compliance are enforced without asking for them on every request. Q: How long should we keep email and files? A: As long as the law, your contracts and your business require, and no longer. Retention policies keep what must be kept, delete what has expired and place legal holds where litigation requires them. We draft the policies with your legal or compliance lead, who decides the periods. Often paired with: Identity and Zero Trust, Backup and disaster recovery, Mergers, acquisitions and divestitures. --- Canonical page: https://www.expandware.com/services/managed-it/microsoft-365-and-google-workspace/ Site index for machines: https://www.expandware.com/llms.txt Full site text: https://www.expandware.com/llms-full.txt Expandware Private Limited. Inquiries: solutions@expandware.com, +92 (333) 32 11011.