This 12-person business had grown up on Google Workspace. It worked, but nobody had ever tidied it. Accounts had been added over the years and never reviewed, licences were being paid for by people who had left, and shared drives were open to far more people than needed. Email authentication was patchy, with old DNS records still pointing at services nobody used, and no DMARC policy to stop anyone spoofing the company domain.
The laptops were a mix of Windows Home machines and older devices that nobody managed. There was no encryption, no way to wipe a lost laptop, and no central view of what was installed. Passwords were a bigger worry still: staff were writing them on sticky notes and in notebooks, and reusing the same few across work systems. MFA was optional, and most people had not turned it on.
WHAT WE DID
We started with an audit of the Google Workspace tenant: every user, group, shared drive, alias and third-party app connection. From that we built a clean target design in Microsoft 365 and Entra ID, so we were not just copying old mess into a new place. Leavers and unused accounts were removed, shared mailboxes replaced shared logins, and each person got a licence that matched what they actually do.
Mail, calendars and contacts were migrated in stages with a pre-sync ahead of the cutover, so the MX change happened outside working hours and staff opened Outlook on the next working day with their history in place. At the same time we cleaned the DNS zone, removing dead records and setting up SPF, DKIM and a DMARC policy that started in monitoring and moved to enforcement once we had confirmed all legitimate senders.
Shared drive content was moved into SharePoint, organised into a small number of sites with permissions based on groups rather than individuals. Staff now find files in one place, and access can be reviewed and changed in minutes.
Every laptop was upgraded to Windows Pro so it could be joined to Entra ID and managed in Intune. We applied a baseline of BitLocker encryption, screen lock, Windows Update rings and Defender for Business, so each device is encrypted, patched and visible. MFA was enforced for every account using the Microsoft Authenticator app, so a stolen password alone is no longer enough to get in.
To end the sticky notes, we rolled out a business password manager to all 12 users, with shared vaults for the accounts a team needs together. Staff now have one strong master password and MFA, and nobody needs to write a password down or reuse one.
OTHER THINGS WE ADDED ALONG THE WAY
SERVICES INVOLVED
Why this matters beyond one migration. Moving platform is the cheapest moment you will ever get to fix identity, permissions and devices together. Doing it in one project means the business is disrupted once, and you finish with every user, device and mailbox known, secured and managed, rather than just moved.
If your business is on Google Workspace and you want the same tidy-up, see our Cloud and Microsoft 365 management and Cybersecurity services.