Nobody hired you for this.
You were the office administrator, or the associate pastor, or the one person who was comfortable with computers when the church moved its email over four years ago. The consultant set it up, handed you a login, and left. Since then you’ve added staff accounts, reset a few passwords, and hoped.
Somewhere in that system are a dozen switches that would meaningfully protect your organization, and nobody ever told you they existed. They’re not hidden. They’re just off, because that’s how they shipped.
Here are ten of them, in the order I’d do them, with an honest note on each about what it might break. That last part is the bit usually left out — and it’s the reason people abandon this halfway through, when a change nobody warned them about breaks the newsletter on a Friday afternoon.
A note on menus, and on the word “admin”
Both platforms redesign their admin console regularly. So this article describes each setting by what it does, not by which menu it’s under. Search the admin console’s own help for the concept name and you’ll find it faster than any screenshot from last year would have taken you.
And to be plain about the word: an administrator account is the login that can create and delete other people’s accounts, read their mail, and change any setting here. In most churches, one or two people have that power and don’t think of themselves as having it. If your everyday account is also the administrator account, every phishing email you receive is aimed at the keys to the whole building.
Start here: the two that carry the whole afternoon
1. Multi-factor authentication for every single person. Multi-factor authentication — MFA, or 2-Step Verification in Google’s language — is the extra step after your password: a prompt on your phone, a code, a tap. Microsoft’s own research puts it at blocking more than 99.2% of account compromise attacks. Everything else in this article is a rounding error next to it.
Do the administrator account first, and carefully. Microsoft now requires MFA to sign in to its admin portals at all, having rolled that out through 2024 and 2025, so this may already be forced on you. Set it up while you are sitting at a computer you control, with the phone in your hand, and confirm you can sign out and back in again before you touch anyone else’s account.
Time: fifteen minutes for the admin account, then a few minutes per person.
What it might break: older mail apps and desk devices that only know how to send a password — a copier that scans to email, a legacy accounting tool, a spouse’s ancient phone mail app. Make a list of those before you enforce it organization-wide, because they will fail silently and you’ll spend an afternoon chasing why the scanner stopped working.
2. A second administrator account, so one lost phone doesn’t lock everyone out. This is the step people skip, and it’s the one that produces the worst days. If exactly one person is the administrator and their phone goes in a lake, nobody can add a staff member, reset a password, or recover a mailbox until a support process that takes days is finished.
Create a second administrator account. Give it to a second trusted person, or keep it as a rarely-used emergency account with its credentials sealed in the safe where the church keeps its other important documents. Note that Microsoft requires MFA on emergency accounts too and suggests a passkey or a certificate rather than a phone, precisely so the emergency account doesn’t depend on the same phone as everything else.
Time: ten minutes.
What it might break: nothing — but a forgotten emergency account with a stale password is worse than none, because you’ll rely on it. Sign into it once a quarter.
Mail: make impersonation and quiet theft harder
3. Warning banners on mail from outside the organization. Both platforms can mark messages that came from outside your own domain, so a note claiming to be from your senior pastor visibly isn’t. Microsoft calls this external sender identification; it’s an organization-wide setting an administrator controls, and in most tenants it has to be switched on rather than being on already — check yours rather than assuming either way. Google has equivalent external-sender warnings.
This is the cheapest defence there is against display-name impersonation — the trick where an attacker sets the friendly name on their account to “Pastor Dave” and your phone shows only that name.
Time: ten minutes, though on Microsoft the tag can take a day or two to start appearing.
What it might break: very little, but expect confusion in week one. Tell staff in advance, and tell them what the banner means: not this is dangerous, but this did not come from inside our organization. Some legitimate senders — your denominational office, a mailing service you use — will be tagged, and that’s correct behaviour.
4. Block or alert on automatic forwarding to outside addresses. This is how theft goes unnoticed. An attacker who gets into a mailbox often sets a rule that quietly copies every message to an address they control, then leaves. They may never send anything from your account at all; they simply read your mail for months, learn your vendors and your payment cycle, and strike once.
On Microsoft, automatic external forwarding is now blocked by default under the outbound spam policy — but confirm it, because a previous administrator or consultant may have switched it on. Google has an administrator setting that removes the automatic forwarding option from users entirely.
Time: ten minutes.
What it might break: real forwards people rely on. The retiring treasurer forwarding church mail to a personal address. A shared role account feeding someone’s personal inbox. Under Microsoft’s block, those messages bounce back to the sender with a message about external forwarding not being allowed — which is confusing if you weren’t expecting it. Find the legitimate forwards first, replace them with a proper shared mailbox or a group, then turn the block on.
5. Audit the mail rules that already exist. Blocking new forwarding doesn’t remove what’s already there. In each staff mailbox — especially anyone who touches money — look at the rules and filters. You’re looking for anything the person doesn’t remember creating, and in particular for rules that file messages containing words like invoice, payroll, deposit, or bank into an unread folder or straight into deleted items. That’s a rule an attacker writes so the victim never sees the confirmation of what’s being done in their name.
Time: five minutes per mailbox, and worth doing for everyone once.
What it might break: nothing, if you ask before you delete. Some people have genuinely elaborate filing rules. Ask, don’t assume.
Apps and evidence
6. Review which third-party apps have been granted access. Over the years, staff have clicked “Allow” on things — a scheduling tool, a PDF signer, a survey app, something that promised to make Sunday easier. Each grant can carry standing permission to read mail or files, and it survives a password change. It also survives the departure of the person who granted it, and the closure of the company that built it.
Both platforms list these. Microsoft shows the applications with permissions in your tenant; Google’s app access control lets you see connected apps and mark them trusted, limited, or blocked. Look for anything you don’t recognize or no longer use, and remove it.
Time: twenty minutes, and genuinely interesting the first time.
What it might break: a tool someone actively uses. Revoke, then tell people to speak up if something stops working — that’s a faster route to an accurate inventory than trying to research each one.
7. Turn on audit logging before you need it. Audit logs record who signed in, from where, what they changed, what they downloaded. You will not care about this until the morning you need to answer “what exactly did they get into?” — and at that point, if logging was off, the answer is permanently unavailable. There is no way to go back and collect it.
Here’s a detail worth knowing: Microsoft turns auditing on by default for most organizations, but not for the small-business licenses most churches actually hold — Business Basic, Business Standard, and Business Premium. On those, an administrator has to enable it. Once on, activity is retained for 180 days by default. Google Workspace keeps admin and login audit logs available in the admin console.
Time: ten minutes.
What it might break: nothing at all. This is the purest cost-free item on the list.
Files and accounts
8. Fix the sharing defaults on the shared drive. Both platforms let you choose what happens by default when someone shares a file: a link anyone on the internet can open, a link anyone inside the organization can open, or access granted to named people only. Many organizations are still on a permissive default, which means well-meaning staff have been generating public links for years without realizing it — for budgets, board minutes, and membership lists.
Change the default so sharing requires naming a person. Then spend ten minutes looking at what is currently shared broadly.
Time: thirty minutes including the review.
What it might break: this is the item most likely to cause friction. Volunteers who open a bulletin template through a link may lose access. Anything you publish deliberately — a public calendar, a sermon archive — needs to be re-shared correctly. Do this one on a Monday, not a Saturday.
9. Remove dormant accounts. The youth intern from two summers ago. The bookkeeper who left in 2021. The volunteer who set up your website and hasn’t been seen since. Each is a live door with a password that has never been changed and no MFA on it.
Don’t delete immediately — on both platforms, deleting a user can take their files and mail with them. Suspend or block sign-in first, keep the account for a defined period, tell anyone who might need something from it, then remove it.
Time: twenty minutes.
What it might break: access to files owned by that person that other people still use. That’s exactly why you suspend before you delete.
10. Know where “sign out everywhere” is — before the emergency. Changing a password does not always eject someone who is already signed in; active sessions can persist. Both platforms have a control that terminates every session for a user and forces a fresh sign-in — Microsoft describes it as revoking sessions, Google as signing the user out and resetting sign-in cookies.
You are not turning anything on here. You are finding the button now, while it’s calm, and writing down where it is. The day you need it, you’ll need it in the next ninety seconds.
Time: five minutes.
What it might break: when used, it signs that person out of everything and they’ll have to log back in. That’s the point.
What to do this week
Block out ninety minutes and do items one and two: multi-factor authentication on the administrator account, done carefully, and a second administrator account created and written down where the church keeps its important papers.
Then turn on audit logging, because it takes ten minutes, costs nothing, breaks nothing, and can only be done in advance.
That’s the honest scope of this article: it’s an afternoon, not a project. And the first item alone is most of the benefit — if you only ever get one thing done, get MFA on every account and treat the rest as a bonus.
MissionDefend’s free assessment covers exactly this ground in plain English — how your email, donations, member data and accounts are actually set up — and hands back a ranked list, so you know which of these ten to spend your one available afternoon on.
No spam and no sales calls — just one email when it’s live.
Related reading
- turning on the report button and the culture behind it
- the machine in the office that still has one login
- where these settings sit among the other priorities
MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.
Sources: Microsoft, mandatory multifactor authentication guidance; Microsoft, Set-ExternalInOutlook (external sender identification); Microsoft, manage emergency access admin accounts; Microsoft, configure external email forwarding controls; Microsoft, turn auditing on or off; Microsoft, revoke user access in an emergency; Microsoft, manage sharing settings for SharePoint and OneDrive; Google, protect your organization with 2-Step Verification; Google, let users automatically forward their own Gmail; Google, control which apps access Google Workspace data; Google, manage external sharing for your organization; Google, administrator privilege definitions.