Free tool

Is Your Microsoft 365 or Google Workspace Actually Configured Securely?

Buying Microsoft 365 or Google Workspace doesn't make you secure, and it doesn't make you compliant. Both are sold under a shared responsibility model: the vendor secures the platform, and every setting that decides who gets in, from where, and what they can reach afterward belongs to you.

That's not a footnote. It's most of your attack surface, and it's configured in an admin console nobody signed for it.

Below are twelve settings that decide whether a stolen password becomes a breach. Check what's already true in your tenant. It takes about five minutes, it's free, and no email is required to see your results.

One correction worth making up front: your license tier does not determine whether you can sign a Business Associate Agreement. Microsoft makes its BAA available by default to covered entities on all plans, and Google's HIPAA implementation guide imposes no edition restriction. What the lower tiers lack is the controls - Conditional Access, device management, DLP, data retention - that a defensible risk analysis will look for. Buy the tier that gives you controls, not the tier you were told was 'the compliant one.'

You checked 0 of 12.

Your results

You checked 0 of 12.

Your tenant is running on defaults.

Default settings are built to get a business working on day one, not to survive an attacker with a valid password. Nothing here is expensive or slow - most of these are settings changes, and several take under an hour. The reason they don't get made is that nobody owns the console.

What to do next: start with MFA enforcement, admin account separation, and third-party app access. Those three decide whether a stolen password stays a stolen password or becomes a breach.

Start My Cyber Risk & Compliance Gap Assessment

Email me my results

What happens next: we send this results page to your inbox - your answers, your open items, and the console screen where each one lives. No obligation.

Email delivery activating soon

Not sure which frameworks apply to you? The Compliance Finder answers that in five questions.

Get the clarity you need to manage risk with confidence.

Your journey starts with understanding your gaps. We'll walk you through what matters, what's required, and what's next - so you can make confident decisions that protect your business.

Start My Cyber Risk & Compliance Gap Assessment

No pressure. No jargon. Just clear insights and your best next steps.

FAQ

Common questions

Do I need to enter my email to see my results?

No. Your results appear on this page as you check items. Email is only for sending yourself a copy, and that option appears after your results - never before.

Does Microsoft 365 or Google Workspace make me HIPAA compliant?

Neither one, on its own. Both will sign a Business Associate Agreement, and both publish a list of which services that agreement covers - but the agreement covers the vendor's obligations, not your configuration. HIPAA holds you responsible for how the platform is set up and who can reach what. That's what this checklist looks at.

Which license do I actually need?

There is no compliance license. Neither vendor gates the BAA by edition. What the tiers change is which controls you get - conditional access, device management, data loss prevention, audit retention - and which controls you need depends on which frameworks apply to you. The Compliance Finder answers that half.

We have an IT provider. Shouldn't they have done this?

Often they have. This checklist is how you find out, and every item names the exact console screen where the answer lives, so the conversation starts with a specific setting rather than a general worry.

The information provided here is for educational purposes only and should not be considered legal advice. Requirements change and applicability depends on your specific circumstances - for specific compliance concerns, consult a qualified legal professional.