Microsoft 365 and Google Workspace security
We review and strengthen the configuration of your Microsoft 365 or Google Workspace: access, email and devices.
- 1 week from administrator access
- Two-factor authentication for all users
- SPF, DKIM and DMARC
- Document recording each change
If you are looking for Microsoft 365 security in Móstoles, or for Google Workspace, we start with what you already have.
We review your platform's configuration and strengthen it: two-factor authentication, access policies, email protection and control of the devices that connect.
Read more Read less
This work is designed for companies that have not reviewed their security configuration since they first set up the platform. It is not a migration: we stay on the platform you use. We apply the changes once you approve them and leave you a written record of each change and how to maintain it.
Request a quote
To talk about Microsoft 365 and Google Workspace security, call or write to us and we'll tell you the next steps.
How we help
- One of the company's email accounts has been stolen
- Not every user has two-factor authentication switched on
- Emails arrive impersonating your domain
- Anyone can connect their personal mobile or laptop to company data
- Nobody has reviewed the configuration since the initial setup
What this service is
Microsoft 365 and Google Workspace are platforms that many companies use every day for email and documents.
They come with security options, but what they protect depends largely on how they are configured and on the licences purchased.
Our work consists of reviewing the configuration of your Microsoft 365 or Google Workspace and strengthening it. We focus on what you see in this list.
Read more Read less
We refer to Microsoft and Google as the platforms your company uses. What we review is your configuration, not the product.
- Two-factor authentication
- Access policies
- Email protection
- Control of the devices that connect
Which companies it is for
This service suits companies that work with Microsoft 365 or Google Workspace and have not reviewed their security configuration since they set it up.
This is common. When the platform is set up, the priority is usually that email works and everyone can log in.
Then new people join, others leave, mobiles and laptops appear, and the settings stay as they were.
Read more Read less
There is a simple way to check. Ask whoever handles your IT when they last reviewed who logs in, from which devices and with which checks. If nobody is clear on the answer, it is worth looking into.
Why companies usually call us
These are the usual reasons a company asks us for this review.
- One of the company's email accounts has been stolen
- Not every user has two-factor authentication switched on
- Emails arrive impersonating your domain
- Anyone can connect their personal mobile or laptop to company data
Read more Read less
Each one has its explanation. A user without two-factor authentication relies on their password alone. An email impersonating your domain can mislead a client or a supplier. A personal laptop that is connected can store company data on a device the company does not control.
Recognising one of these cases does not mean you have a serious problem. It means it is worth reviewing calmly and deciding what to change first.
How we work
We work in order and with your approval. Nothing is touched until you have seen what we are going to change.
We start by agreeing administrator access in writing. With it, we review the current configuration and prepare a plan of changes. You approve that plan before we touch anything.
Read more Read less
We then apply the changes in stages, so that nobody is locked out. We finish with a final check and the handover of the document recording everything that has been done.
How we start
- We agree administrator access in writing.
- We review the current configuration.
- We present a plan of changes, and you approve it before we touch anything.
- We apply the changes in stages, so that nobody is locked out.
- We carry out the final check and hand over the document.
What it includes
We start by comparing your current configuration with the vendor's public recommendations. From there, this is what the service covers.
SPF, DKIM and DMARC are three domain settings.
Put simply, SPF states which servers may send email in your name, DKIM adds a signature to messages and DMARC says what to do with those that fail these checks.
Read more Read less
Access policies and blocking legacy protocols depend on your licences. If an option is not available with the ones you have, we tell you.
Email protection reduces the risk from phishing and malicious attachments, but it does not eliminate all phishing. Some fake emails may still get through, so your staff should know what to do if they receive one.
- Review of the current configuration
- Two-factor authentication for all users
- Access policies and blocking of legacy protocols, depending on your licences
- Configuration of SPF, DKIM and DMARC on your domain
- Email protection against phishing and malicious attachments
- Rules for the devices that access company data
- Document setting out the changes made and how to maintain them
Price and timeframe
The timeframe is 1 week from when we have administrator access. That is why the first step is to agree that access in writing.
The price depends on the number of users and domains. To give you an indication, we need those two details.
Call us with them and we will tell you how to proceed.
The prices we quote exclude VAT (21%). When comparing proposals, it is also worth checking which tasks are included, which licences are needed and who will maintain the configuration afterwards.
1 week from administrator access
What is not included
- Microsoft or Google licences, or extending them if needed
- Email or document migrations between platforms
- Day-to-day user support
Read more Read less
We prefer to say so from the start, so you know what to ask each provider for. These tasks are not part of this service.
If your company needs any of them, it is best to bear that in mind before we start. That way you avoid counting on something that is outside the scope, and you can arrange it with whoever handles your IT.
How it is maintained afterwards
A configuration changes over time: users join, devices are replaced and new needs arise.
That is why, at the end, we deliver a document with each change and how to maintain it.
That document is for your team or your IT provider. With it, they can maintain the configuration after our work is done.
Read more Read less
Before starting, it is worth making clear who will look after this in your company. For example, who will set up new users and who will check that they have two-factor authentication switched on.
Who you will deal with
At Oteo, Aitor is responsible for management and client relations.
To make the first conversation useful, have to hand which platform your company uses, how many users and domains it has and who handles your IT today.
With that, the scope can already be discussed.
Where we work
We work remotely anywhere in Spain and on site in the Comunidad de Madrid.
Microsoft 365 and Google Workspace are administered over the internet, so this work lends itself well to remote delivery, whether your company is in Móstoles or in another province.
If you are in the Comunidad de Madrid and would rather meet, we can also work on site.
Frequently asked questions
Here are the most practical questions: what users will notice, what happens with licences, how long it takes and what the price depends on.
If your question is not here, call us and we will tell you how to proceed.
Questions about Microsoft 365 and Google Workspace security
Will users notice the changes?
Mainly two-factor authentication, which is switched on with advance notice and a simple guide. The other changes are barely noticeable in day-to-day work.
Is it worth it if we have basic licences?
Yes. What can be switched on depends on the licences. We tell you what you get with the ones you have and whether an upgrade would be worthwhile.
How long does it take?
1 week from when we have administrator access.
How much does it cost?
The price depends on the number of users and domains. Call us with those details and we will tell you how to proceed. The prices we quote exclude VAT (21%).
Can our team maintain it afterwards?
Yes. We deliver a document with each change and how to maintain it, for your team or your IT provider.
Does it include moving email from one platform to another?
No. Email or document migrations between platforms are not part of this service. We work on the configuration of the platform you already use.
Is anything changed without us knowing?
No. Before we touch anything, we present a plan of changes and you approve it. We then apply them in stages.
Will this stop phishing emails from arriving?
That cannot be promised. Email protection reduces the risk, but it does not eliminate all phishing. Some fake emails may still reach the inbox.
Exposure assessment
We review from the outside what an attacker can see of your company and give you a report for management and a prioritised plan.
Incident response
We contain the attack, find out what has happened and help you get your business running again.
Backup and continuity
Immutable backups stored off your premises and recovery tests with the time measured.
Security awareness and phishing simulation
Practical training for your staff and simulated phishing emails, with aggregated results for management.
Tell us how your platform is set up
Call us on +34 699 240 879 or write to [email protected].
Tell us whether you use Microsoft 365 or Google Workspace, how many users and domains you have and what concerns you.
With those details, we will tell you how to proceed.