Set sign in protection first, then app consent, then external sharing, then mail forwarding, then logging, and put the review on a calendar. Settings drift as people change them, so the cadence matters as much as the first pass. This checklist covers Microsoft 365, Google Workspace and Slack, with links to detail posts.
1. Sign in and admin accounts
- Require multifactor authentication for everyone. In Entra, security defaults or Conditional Access do this. In Google Workspace, enforce 2-Step Verification by date and by unit. See /resources/blog/entra-security-defaults-or-conditional-access and /resources/blog/enforce-2-step-verification-google-workspace-rollout.
- Block legacy authentication in Microsoft 365: /resources/blog/block-legacy-authentication-entra-report-only-rollout.
- Keep the number of top privilege admins small, give each a named account, and keep emergency access accounts for outages.
2. App consent
- Restrict user consent to verified publishers and low impact permissions, or require admin approval. See /resources/blog/entra-user-consent-settings-which-to-choose.
- Turn on a request workflow so people have a path.
- In Google Workspace, restrict Gmail and Drive through API controls and change the default for unconfigured apps: /resources/blog/google-workspace-api-controls-trusted-limited-blocked-apps.
- In Slack Enterprise, use app approval and restriction: /resources/blog/slack-app-approval-and-restricting-installs-enterprise.
3. External sharing and guests
- SharePoint and OneDrive: decide per site, with sensitive sites closed. See /resources/blog/sharepoint-onedrive-external-sharing-levels-explained.
- Google Drive: per organizational unit, with a shared drive for external work: /resources/blog/google-drive-external-sharing-settings-small-company.
- Entra guests: limit who can invite: /resources/blog/entra-guest-invite-settings-who-should-invite.
- Teams: separate external access from guest access: /resources/blog/teams-external-access-vs-guest-access-explained.
- Slack: choose between guests and Slack Connect per case: /resources/blog/slack-guests-vs-slack-connect-which-to-use.
4. Email forwarding
- Set external automatic forwarding deliberately in both suites: /resources/blog/microsoft-365-block-external-auto-forwarding and /resources/blog/gmail-automatic-forwarding-admin-setting-risk.
5. Logging and retention
- Know your audit log retention and export if it is short: /resources/blog/purview-audit-log-retention-180-days-what-to-export.
- Decide Slack retention with legal input: /resources/blog/slack-message-retention-settings-by-plan.
6. Leavers
- Transfer files, remove shares, disable accounts: /resources/blog/google-drive-ownership-transfer-when-someone-leaves and /resources/blog/saas-offboarding-checklist-departing-employee.
Make it stick
Write the chosen value, the owner and the date for each setting in one table. Every quarter, compare the live value to the table. A mismatch means someone changed it, and the question is who and why. Continuous checks beat an annual scramble.
Safeguard's asset discovery and compliance evidence automation are built around that idea of watching for change rather than checking once. The demo shows the same loop on software dependencies: baseline, watch, alert.
Try it yourself
Click through it at your own pace, or open it full screen. Look for how a change after the first scan raises a new alert.
Quick check
Which setting should come first?
Sign in protection, since a stolen password defeats most other controls.
How often should I compare live settings to the baseline?
Quarterly is a reasonable minimum, and more often for admin roles and external sharing.
Sources
Last reviewed: 19 October 2026.
