Contents
Short answer
The office cloud bundles email, files and calendars – and thus much of the business. The key steps are usually possible without extra products: MFA for everyone, separate admin accounts, controlled sharing and clean offboarding. Exactly which features are available depends on your plan.
Why does this matter for small businesses?
A compromised cloud account opens the mailbox, files and often other connected services. Meanwhile sharing grows unnoticed over time: publicly accessible links or former partners with access.
What does it include?
MFA for all accounts
Mandatory for all users, not only admins. Turn off legacy sign-in without MFA where possible.
Basic
Separate admin accounts
Administration via dedicated accounts without daily email, with a strong second factor; at least two admins for emergencies.
Basic
Sharing and permissions
Rules for external sharing, regular review of open links and group rights.
Basic
Session protection and phishing
Alerts on unusual sign-ins, end sessions after incidents, monitor forwarding rules.
Useful as IT grows
Logs
Turn on sign-in and activity logs and know the retention – partly plan-dependent.
Useful as IT grows
Backup context
Provider retention and recycle bins are not a complete substitute for an independent backup.
Useful as IT grows
Offboarding
Block the account, transfer data, end sessions and app access, remove the licence only afterwards.
Basic
What does it protect against?
- Account takeover through password theft
- Unintended public sharing
- Access by former staff and partners
What does it not protect against?
- Staff deceived on genuine sign-in pages into granting consent
- Data loss without your own backup
- Misconfigurations nobody reviews
Which basic measures are often enough?
- 01MFA for all accounts, admin accounts separate
- 02Restrict and regularly review external sharing
- 03Block or monitor automatic forwarding to external addresses
- 04Document the offboarding process
When does a more advanced solution make sense?
Conditional access (only from managed devices or certain regions), extended logging, data loss prevention and independent cloud backups make sense with sensitive data, many employees or compliance requirements. These features are often only included in higher plans.
Common mistakes
- Admin rights on the daily work account
- Only one admin, who may be ill or have left
- Public links for customer data
- Deleting a licence before data is secured
Checklist
- MFA enforced for all accounts
- At least two separate admin accounts
- External sharing reviewed
- Sign-in alerts on
- Offboarding list exists
- Backup needs for cloud data clarified
Frequently asked questions
Are these features in every plan?
No. Basics such as MFA are widely available; advanced access control, logging or retention are partly plan-dependent. Check your provider's current documentation.
Who should be an admin?
As few trusted people as possible, with dedicated admin accounts. An external provider can supplement but should not be the only admin.
Sensible next step
Check in the admin console whether MFA is enforced for all accounts and who holds admin rights.
Sources
- Bundesamt für Sicherheit in der Informationstechnik (BSI)
- CISA – Cybersecurity and Infrastructure Security Agency
- ENISA – European Union Agency for Cybersecurity
Checked on 6 Oct 2026.
General orientation – does not replace an individual security review, legal or data-protection advice.