A laptop displaying an email inbox with a new message notification icon, placed on a wooden table next to a bucket of flowers.

Microsoft 365 and Google Workspace Management: Why the Employee Lifecycle Is Where It Actually Breaks

By Jason Russell · August 7, 2026

A client came to us two years ago during a cyber insurance renewal. The carrier wanted an attestation about account offboarding. The owner was confident. Their office manager disabled logins the same day anyone resigned, and had done so for years.

We pulled the tenant report. Nineteen accounts were disabled. Fourteen of them were still fully licensed and being billed. Six still had active mail forwarding rules pointed at personal Gmail addresses that nobody remembered creating. Two had granted a document signing app standing permission to read the mailbox, and those grants were still live because disabling an account does not revoke an OAuth token. One departed employee still had a personal phone enrolled as a multifactor authentication method on a shared administrative account.

Nothing bad had happened. That is the part business owners consistently misread. Nothing bad happening is not evidence that a process worked. It is a sample size of one, over a period during which nobody happened to go looking.

The lifecycle is the least glamorous part of Microsoft 365 and Google Workspace management, and it is the part that determines whether the rest of your security spending matters.

The platform is managed. Your tenant is not.

Both Microsoft and Google run infrastructure that is enormously better defended than the Exchange server that used to sit in a closet next to the water heater. That is a real upgrade and I will not pretend otherwise. But the boundary of what they are defending is drawn explicitly, and it is drawn in their favor.

Microsoft publishes this as the shared responsibility model. Their own Azure security documentation states plainly that the customer is responsible for managing user accounts, including creating, managing, and removing user access, and separately that the customer is responsible for data classification, data protection, encryption decisions, and compliance with data governance requirements. Microsoft is responsible for the physical layer, the platform, and uptime. Everything about who has access to what, and for how long, is yours.

Google draws the line in the same place. If you delete a Workspace user and did not transfer their data first, the data is gone once the recovery window closes. That is not a bug. That is documented, intended behavior, and it is your job to know about it before you click.

The practical translation: Buying Microsoft 365 or Google Workspace buys you a secure, resilient platform. It does not buy you an administrator. If nobody in your organization owns the identity lifecycle on a schedule, the tenant is running on defaults, and defaults are tuned for the broadest possible customer base, not for your risk tolerance.

What the current data actually says

I want to be careful here, because this is where most vendor content goes wrong. The statistics below are real and they come from primary sources, but almost none of them are specific to businesses your size. I will flag that as I go rather than pretending otherwise.

The 2026 Verizon Data Breach Investigations Report, its nineteenth edition, analyzed more than 31,000 security incidents including over 22,000 confirmed breaches across 145 countries. The headline finding is a genuine shift: exploitation of software vulnerabilities became the leading initial access vector for the first time in the report history, at roughly 31 percent of breaches, overtaking credential abuse, which dropped to about 13 percent. The human element remained present in 62 percent of breaches. Third party involvement climbed to 48 percent, a 60 percent year over year increase.

That last number matters for this conversation more than the first one. Your Microsoft 365 or Google Workspace tenant is where third party access lives. Every connected application, every consented integration, every vendor with a guest account is a strand of that 48 percent. We wrote separately about the broader version of this problem in The Vendor Nobody Owns.

The DBIR also reported that unsanctioned employee use of AI tools, what the report calls shadow AI, roughly tripled to 45 percent, with associated data leakage. In a Workspace or Microsoft 365 context, that is an app consent and data governance question, not an abstract policy question.

On the financial side, the FBI Internet Crime Complaint Center recorded 1,008,597 complaints in 2025 with $20.877 billion in reported losses, a 26 percent increase over the prior year. Business email compromise accounted for $3,046,598,558 of that from 24,768 complaints. Divide those two numbers and the average reported loss per BEC complaint is roughly $123,000. BEC is, at its core, a mailbox access and identity problem.

Statistical caveats worth stating out loud. The DBIR sample skews toward organizations with incident response capability and formal reporting relationships; small businesses are underrepresented, and the report does not break out a clean SMB cohort for most findings. IC3 figures are self reported complaints, and the FBI is explicit that actual losses are higher because most incidents are never reported. Treat these as a floor, not a measurement. Neither dataset tells you your specific probability of being hit, and anyone who claims otherwise is selling something.

Onboarding: the twenty minutes that set the next three years

Most small business onboarding looks like this. Someone emails IT the day before the new hire starts. An account gets created by copying the permissions of whoever sits nearby. A license gets assigned, usually the same license everyone else has. The new person logs in, gets prompted to set up multifactor authentication, clicks skip if the tenant allows it, and starts working.

Every one of those steps creates debt that compounds.

Copying an existing user is the worst of them. Permissions accrete. The person you copied has access to the 2019 payroll folder because they covered for someone during a leave, and now your new hire does too, and neither of them knows it. Do that eight times over four years and you have an access map nobody can reconstruct.

A managed onboarding process looks different in ways that are not complicated, just deliberate:

  • Role based provisioning. Accounts are built from a documented role template, not cloned from a coworker. A new bookkeeper gets bookkeeper access, full stop.
  • Group membership, not individual grants. Access is assigned to security groups. Individual file and folder permissions are the thing that makes offboarding impossible three years later.
  • Multifactor enrolled during provisioning, not offered afterward. Enrollment happens as part of setup, with a policy that does not allow indefinite deferral.
  • License right sized on day one. A warehouse worker who needs email and Teams does not need the same SKU as your controller. This is where most of the recoverable spend lives.
  • Device enrolled and encryption verified. Company data on an unmanaged personal laptop is a data governance problem you inherit silently.
  • Credentials issued into a password manager. Shared logins that live in a spreadsheet or a sticky note survive every offboarding you will ever run. See the business case for password management.
  • Written record. What was granted, by whom, on what date, tied to the role. This is the document your insurance carrier and your auditor will ask for, and it is the document your offboarding process reads from.

The middle years: where permissions quietly rot

Nobody has a process for the middle. People change roles, cover for colleagues, join projects, connect apps, and share folders externally so a vendor can drop off a file. None of that gets unwound. This is where a tenant drifts from configured to merely occupied.

The four drift patterns I see most often in small business tenants:

Application consent

A user installs a scheduling tool, a signature app, or an AI meeting assistant and clicks Accept on a permissions screen. Microsoft calls the malicious version of this consent phishing, and documents it as a distinct attack path from credential theft. The important mechanic is that consent survives password changes and, in many configurations, survives multifactor challenges, because the application acts with its own token rather than as the user. Microsoft began enabling a managed consent policy by default in July 2025 that restricts users from consenting to third party applications accessing files and sites, which helps. It does not retroactively clean up grants made before that, and it does not cover every tenant configuration. Somebody has to go look.

External sharing sprawl

A folder shared with an outside accountant in 2022 is usually still shared today. SharePoint, OneDrive, and Google Drive all default toward convenience. Periodic review of external sharing links, with expiration dates applied going forward, takes about an hour a quarter and is one of the highest yield hours in cloud administration.

Guest and vendor accounts

Guest accounts created for a project that ended in 2023 are still valid identities in your directory. Given the DBIR finding that third party involvement now appears in nearly half of breaches, an unreviewed guest list is not a housekeeping issue.

Orphaned mail rules and forwards

Auto forwarding rules to external addresses are a signature of both business email compromise and unauthorized data exfiltration by departing employees. They are trivially easy to create and effectively invisible unless somebody runs a report. This is a useful companion to the inbound controls covered in our post on email filtering.

Offboarding: the part with hard deadlines

Offboarding is where the platforms stop being forgiving, because both of them run on timers. Miss the window and the data is not recoverable at any price. These are the specific mechanics, drawn from Microsoft and Google documentation, and they are the reason ad hoc offboarding fails.

Microsoft 365

  • When you delete a user, the account remains recoverable for approximately 30 days. After that it is permanently deleted.
  • The default retention period for a deleted user OneDrive is 30 days, configurable in the SharePoint admin center. If nobody moves the files in that window, the content is deleted.
  • By default, a deleted user OneDrive is automatically delegated to their manager. If access delegation is disabled, or if no manager and no secondary owner is set on the account, nobody gets access and nobody gets warned before deletion.
  • Retention policies and legal holds take precedence over the standard deletion process, but they must be applied before license removal or account deletion. Applying a hold after the fact does not resurrect anything.
  • Placing a mailbox on litigation hold or under a retention policy before deleting the account converts it to an inactive mailbox, which preserves contents for the duration of the hold without consuming a license.
  • An unlicensed OneDrive is automatically archived on its 93rd unlicensed day, which carries its own storage and restoration costs.
  • If your accounts sync from an on premises Active Directory, you must delete and restore in Active Directory. You cannot do it in Microsoft 365, and people discover this at the worst possible moment.

Google Workspace

  • A deleted user can be restored for up to 20 days. After 20 days the data is gone and cannot be recovered.
  • Data that is not transferred before or during deletion is deleted. Google is explicit that a deleted user’s data is unrecoverable once deleted.
  • Super administrators can transfer Gmail, Drive, and Groups data as part of the deletion workflow. Administrators without super admin rights must transfer data before deleting the user, which is a common and expensive gap in delegated setups.
  • There is a Drive folder trap. If a folder was never shared, file ownership can transfer while the folder does not, leaving the files present but unbrowseable. The new owner has to find them with a Drive search for unorganized files they own.
  • Google Calendar has no direct ownership transfer. Calendars must be shared with manage sharing rights, or exported and reimported.
  • Twenty days after deletion the email address is released, though it can be reassigned to another managed user before that window closes.
  • Suspending a user preserves data but continues to consume a standard license. The Archived User license is the middle path: sign in blocked, incoming mail rejected, data retained under Vault retention rules, standard seat freed. It requires a separate Archived User subscription.

The single most common offboarding failure: someone disables the account on the last day, intends to sort out the data later, and later never arrives. Thirty days pass in Microsoft 365 or twenty in Google Workspace, and the project files, the client correspondence, and the one spreadsheet nobody else ever had a copy of are gone. This is not a security failure. It is a calendar failure, and it is entirely preventable with a written checklist that has dates on it.

Data governance: deciding what you keep before you need it

Governance sounds like an enterprise word. In a 30 person company it reduces to four decisions that somebody has to make on purpose.

How long do you keep things? Retention policies in Microsoft Purview and retention rules in Google Vault let you set this once and stop thinking about it. Without them, retention is whatever each individual employee happens to do with their own delete key.

Can you find things? If you receive a subpoena, a records request, or an insurance claim inquiry, can you search across mailboxes and files and produce what was asked for? eDiscovery in Microsoft 365 and Google Vault both handle this, but Vault in particular is edition dependent, and preservation has to be in place before the event.

Do you have a backup? This surprises people. The Microsoft Services Agreement recommends that customers regularly back up their content using third party applications and services, and Microsoft also sells a separate paid Microsoft 365 Backup product. Native recycle bins and retention holds are recovery features with time limits, not backups. If ransomware encrypts a synced OneDrive or an administrator makes a bulk mistake, the recycle bin is a narrow window, not a safety net.

Is the tenant configured against a known standard? CISA publishes free Secure Cloud Business Applications baselines for both Microsoft 365 and Google Workspace, along with free assessment tools: ScubaGear for Microsoft 365 and ScubaGoggles for Google Workspace. These were written for federal agencies, but any organization can run them. Running the assessment costs nothing and gives you a concrete list rather than a vague feeling.

Honest tradeoffs

Here is what lifecycle management does not do, because a post that only lists benefits is marketing rather than advice.

  • It does not address the top attack vector. The 2026 DBIR put vulnerability exploitation ahead of credential abuse as the leading initial access path. Immaculate identity hygiene does not patch a firewall. Lifecycle management is one control among several, and it is not the first one you should fix if your edge devices are eighteen months behind.
  • Retention is a two sided risk. Keeping everything forever increases your discovery burden in litigation and enlarges the blast radius of any breach. There is a real argument for deleting more, not less. The right answer depends on your industry and your counsel, and anyone who tells you to just keep everything has not thought about it.
  • Tightening consent and access creates friction. Blocking user application consent generates help desk tickets. Conditional access policies will block a legitimate employee traveling somewhere unexpected. These are real costs in real annoyance, and they should be a deliberate choice rather than a surprise.
  • The CISA baselines were not written for you. They target federal civilian agencies. Several settings will break workflows in a small business. Use them as a measuring stick and a discussion list, not as a compliance mandate.
  • Archived licenses and third party backup cost money. Google Archived User licenses require a separate subscription. Third party Microsoft 365 or Workspace backup is a real recurring line item. Both are usually cheaper than the alternative, but they are not free, and any proposal that presents them as free is hiding something.
  • Automation cannot fix a broken handoff. Every offboarding process depends on someone telling IT that a person left. If HR terminates someone on Friday and nobody notifies anyone until Tuesday, no tooling in either platform closes that gap. The fix is a process agreement between owners and managers, not a product.

Where we sit, and why that should factor in

Harmony MSP sells managed Microsoft 365 and Google Workspace administration. It is part of our flat fee agreement, not an add on, which means we have a direct financial interest in you believing this work matters. You should weigh that.

So here is the version that is against my interest. Nearly everything described in this post is something you can do yourself. The admin centers are not secret and the documentation is public and free. Microsoft and Google both publish step by step guides. CISA gives away the assessment tooling.

The reason companies pay someone else is not that any individual setting is difficult. It is that there are several dozen of them, they need reviewing on a recurring schedule, the schedule is the first thing to slip when a business is busy, and the consequences of slipping do not show up for months or years. If you have someone internally who will genuinely own that calendar and keep it, you do not need us for this specific thing. Most 15 to 75 person companies do not, which is why we have a business.

Our bundled model also means we do not make more money by selling you more security products, which is worth knowing when a provider recommends something. It also means we are motivated to keep your environment quiet, since noisy environments cost us labor. That alignment is genuine, and it is also convenient for us to point out.

Questions to ask your current IT provider

These are answerable in a single meeting. Vague answers are themselves an answer.

Ask this What a good answer sounds like
Show me every licensed account in our tenant and tell me who each one belongs to. A current report produced in minutes, with no unexplained accounts and no licenses assigned to people who left.
What is our written offboarding checklist, and what are the deadlines on it? A document that names the 30 day Microsoft window or 20 day Google window explicitly, with a named owner for each step.
Which third party applications have standing access to our mail and files? A reviewed list of OAuth grants and enterprise applications, with a stated review cadence.
What are our retention policies, and when were they last reviewed? Specific retention durations tied to a business or legal rationale, not “we keep everything.”
If our tenant were compromised or a bulk deletion happened tomorrow, what is our recovery path? A described backup product or documented hold strategy, with a stated recovery point and a date it was last tested.
Have you run ScubaGear or ScubaGoggles against our tenant, and can I see the report? Either a report, or an honest explanation of which baseline items were intentionally not adopted and why.
Who is notified when an employee is terminated, and how fast does access get cut? A named trigger from HR or ownership with a defined service level, not “they usually email us.”

If any of this sounded familiar

If you read the opening story and quietly wondered what your own tenant would show, that instinct is usually correct. It is also easy to check, and checking does not obligate you to anything.

We are based in Lake Mary and work with small businesses across Orlando and Central Florida. If you would like a straight read on how your Microsoft 365 or Google Workspace environment is currently set up, including the accounts, the app grants, the sharing, and the retention posture, we are happy to walk through it with you and hand you the findings whether or not you ever become a client. Call us at (407) 720-6540.

And if you already have this handled internally, good. That puts you ahead of most companies your size.

Frequently asked questions

Is Microsoft 365 or Google Workspace more secure?

Neither, meaningfully, at the small business tier. Both platforms can be configured well or badly, and the configuration gap between a managed tenant and an unmanaged one is far larger than the gap between the two vendors. Choose based on how your team works, what your industry peers use, and what your line of business applications integrate with. Then manage whichever one you pick.

We only have twelve employees. Is this overkill?

The mechanics do not scale down. A twelve person company still loses the data if it deletes a Google account on day 21. The time investment scales down considerably, though. For a company that size, the recurring work is a monthly access review of maybe twenty minutes plus a documented offboarding checklist. What does not scale down is the consequence of getting it wrong, because smaller companies typically have fewer redundant copies of critical files.

If we disable an account instead of deleting it, are we safe?

Safer, not safe. Disabling blocks interactive sign in. It does not automatically revoke OAuth tokens granted to third party applications, remove mail forwarding rules, or reclaim the license you are paying for. In Google Workspace, a suspended account continues consuming a standard license. Disabling is a correct first step and an incorrect last step.

How much data can we actually lose in a bad offboarding?

Everything the departing employee personally owned that was never shared or copied elsewhere. In practice that is usually their mailbox, their personal cloud drive, and any files they created inside their own drive rather than in a shared team location. For a salesperson or a project manager, that can be the majority of the account history for their clients.

Do we still need backup if we have retention policies?

They solve different problems. Retention and legal hold prevent deletion of specified content for a defined period, which is a compliance control. Backup gives you a separate, point in time copy you can restore from after ransomware, a bulk administrative error, or a malicious insider. Microsoft’s own service agreement recommends customers back up their content with third party tools, which is a reasonably clear signal about how the vendor views the boundary.

What is the fastest improvement we could make this month?

Two things. First, produce a complete list of licensed accounts and reconcile it against your current payroll. Almost every small business finds something. Second, write a one page offboarding checklist with the platform deadlines on it and put it somewhere your office manager will actually find it. Neither costs anything.

Sources

A note on statistics: complaint counts and dollar figures come directly from the FBI IC3 report. DBIR percentages are as published by Verizon. Platform deletion windows and retention behavior are drawn from current Microsoft Learn and Google Workspace Admin Help documentation. We have deliberately excluded secondary source figures we could not trace to a primary report.

Our latest posts