MissionDefend Blog

Home Articles Get your free assessmentComing soon

Tag: multi-factor authentication

  • Locking Down Microsoft 365 or Google Workspace in an Afternoon

    Locking Down Microsoft 365 or Google Workspace in an Afternoon

    Nobody hired you for this.

    You were the office administrator, or the associate pastor, or the one person who was comfortable with computers when the church moved its email over four years ago. The consultant set it up, handed you a login, and left. Since then you’ve added staff accounts, reset a few passwords, and hoped.

    Somewhere in that system are a dozen switches that would meaningfully protect your organization, and nobody ever told you they existed. They’re not hidden. They’re just off, because that’s how they shipped.

    Here are ten of them, in the order I’d do them, with an honest note on each about what it might break. That last part is the bit usually left out — and it’s the reason people abandon this halfway through, when a change nobody warned them about breaks the newsletter on a Friday afternoon.

    A note on menus, and on the word “admin”

    Both platforms redesign their admin console regularly. So this article describes each setting by what it does, not by which menu it’s under. Search the admin console’s own help for the concept name and you’ll find it faster than any screenshot from last year would have taken you.

    And to be plain about the word: an administrator account is the login that can create and delete other people’s accounts, read their mail, and change any setting here. In most churches, one or two people have that power and don’t think of themselves as having it. If your everyday account is also the administrator account, every phishing email you receive is aimed at the keys to the whole building.

    Start here: the two that carry the whole afternoon

    1. Multi-factor authentication for every single person. Multi-factor authentication — MFA, or 2-Step Verification in Google’s language — is the extra step after your password: a prompt on your phone, a code, a tap. Microsoft’s own research puts it at blocking more than 99.2% of account compromise attacks. Everything else in this article is a rounding error next to it.

    Do the administrator account first, and carefully. Microsoft now requires MFA to sign in to its admin portals at all, having rolled that out through 2024 and 2025, so this may already be forced on you. Set it up while you are sitting at a computer you control, with the phone in your hand, and confirm you can sign out and back in again before you touch anyone else’s account.

    Time: fifteen minutes for the admin account, then a few minutes per person.
    What it might break: older mail apps and desk devices that only know how to send a password — a copier that scans to email, a legacy accounting tool, a spouse’s ancient phone mail app. Make a list of those before you enforce it organization-wide, because they will fail silently and you’ll spend an afternoon chasing why the scanner stopped working.

    2. A second administrator account, so one lost phone doesn’t lock everyone out. This is the step people skip, and it’s the one that produces the worst days. If exactly one person is the administrator and their phone goes in a lake, nobody can add a staff member, reset a password, or recover a mailbox until a support process that takes days is finished.

    Create a second administrator account. Give it to a second trusted person, or keep it as a rarely-used emergency account with its credentials sealed in the safe where the church keeps its other important documents. Note that Microsoft requires MFA on emergency accounts too and suggests a passkey or a certificate rather than a phone, precisely so the emergency account doesn’t depend on the same phone as everything else.

    Time: ten minutes.
    What it might break: nothing — but a forgotten emergency account with a stale password is worse than none, because you’ll rely on it. Sign into it once a quarter.

    Mail: make impersonation and quiet theft harder

    3. Warning banners on mail from outside the organization. Both platforms can mark messages that came from outside your own domain, so a note claiming to be from your senior pastor visibly isn’t. Microsoft calls this external sender identification; it’s an organization-wide setting an administrator controls, and in most tenants it has to be switched on rather than being on already — check yours rather than assuming either way. Google has equivalent external-sender warnings.

    This is the cheapest defence there is against display-name impersonation — the trick where an attacker sets the friendly name on their account to “Pastor Dave” and your phone shows only that name.

    Time: ten minutes, though on Microsoft the tag can take a day or two to start appearing.
    What it might break: very little, but expect confusion in week one. Tell staff in advance, and tell them what the banner means: not this is dangerous, but this did not come from inside our organization. Some legitimate senders — your denominational office, a mailing service you use — will be tagged, and that’s correct behaviour.

    4. Block or alert on automatic forwarding to outside addresses. This is how theft goes unnoticed. An attacker who gets into a mailbox often sets a rule that quietly copies every message to an address they control, then leaves. They may never send anything from your account at all; they simply read your mail for months, learn your vendors and your payment cycle, and strike once.

    On Microsoft, automatic external forwarding is now blocked by default under the outbound spam policy — but confirm it, because a previous administrator or consultant may have switched it on. Google has an administrator setting that removes the automatic forwarding option from users entirely.

    Time: ten minutes.
    What it might break: real forwards people rely on. The retiring treasurer forwarding church mail to a personal address. A shared role account feeding someone’s personal inbox. Under Microsoft’s block, those messages bounce back to the sender with a message about external forwarding not being allowed — which is confusing if you weren’t expecting it. Find the legitimate forwards first, replace them with a proper shared mailbox or a group, then turn the block on.

    5. Audit the mail rules that already exist. Blocking new forwarding doesn’t remove what’s already there. In each staff mailbox — especially anyone who touches money — look at the rules and filters. You’re looking for anything the person doesn’t remember creating, and in particular for rules that file messages containing words like invoice, payroll, deposit, or bank into an unread folder or straight into deleted items. That’s a rule an attacker writes so the victim never sees the confirmation of what’s being done in their name.

    Time: five minutes per mailbox, and worth doing for everyone once.
    What it might break: nothing, if you ask before you delete. Some people have genuinely elaborate filing rules. Ask, don’t assume.

    Apps and evidence

    6. Review which third-party apps have been granted access. Over the years, staff have clicked “Allow” on things — a scheduling tool, a PDF signer, a survey app, something that promised to make Sunday easier. Each grant can carry standing permission to read mail or files, and it survives a password change. It also survives the departure of the person who granted it, and the closure of the company that built it.

    Both platforms list these. Microsoft shows the applications with permissions in your tenant; Google’s app access control lets you see connected apps and mark them trusted, limited, or blocked. Look for anything you don’t recognize or no longer use, and remove it.

    Time: twenty minutes, and genuinely interesting the first time.
    What it might break: a tool someone actively uses. Revoke, then tell people to speak up if something stops working — that’s a faster route to an accurate inventory than trying to research each one.

    7. Turn on audit logging before you need it. Audit logs record who signed in, from where, what they changed, what they downloaded. You will not care about this until the morning you need to answer “what exactly did they get into?” — and at that point, if logging was off, the answer is permanently unavailable. There is no way to go back and collect it.

    Here’s a detail worth knowing: Microsoft turns auditing on by default for most organizations, but not for the small-business licenses most churches actually hold — Business Basic, Business Standard, and Business Premium. On those, an administrator has to enable it. Once on, activity is retained for 180 days by default. Google Workspace keeps admin and login audit logs available in the admin console.

    Time: ten minutes.
    What it might break: nothing at all. This is the purest cost-free item on the list.

    Files and accounts

    8. Fix the sharing defaults on the shared drive. Both platforms let you choose what happens by default when someone shares a file: a link anyone on the internet can open, a link anyone inside the organization can open, or access granted to named people only. Many organizations are still on a permissive default, which means well-meaning staff have been generating public links for years without realizing it — for budgets, board minutes, and membership lists.

    Change the default so sharing requires naming a person. Then spend ten minutes looking at what is currently shared broadly.

    Time: thirty minutes including the review.
    What it might break: this is the item most likely to cause friction. Volunteers who open a bulletin template through a link may lose access. Anything you publish deliberately — a public calendar, a sermon archive — needs to be re-shared correctly. Do this one on a Monday, not a Saturday.

    9. Remove dormant accounts. The youth intern from two summers ago. The bookkeeper who left in 2021. The volunteer who set up your website and hasn’t been seen since. Each is a live door with a password that has never been changed and no MFA on it.

    Don’t delete immediately — on both platforms, deleting a user can take their files and mail with them. Suspend or block sign-in first, keep the account for a defined period, tell anyone who might need something from it, then remove it.

    Time: twenty minutes.
    What it might break: access to files owned by that person that other people still use. That’s exactly why you suspend before you delete.

    10. Know where “sign out everywhere” is — before the emergency. Changing a password does not always eject someone who is already signed in; active sessions can persist. Both platforms have a control that terminates every session for a user and forces a fresh sign-in — Microsoft describes it as revoking sessions, Google as signing the user out and resetting sign-in cookies.

    You are not turning anything on here. You are finding the button now, while it’s calm, and writing down where it is. The day you need it, you’ll need it in the next ninety seconds.

    Time: five minutes.
    What it might break: when used, it signs that person out of everything and they’ll have to log back in. That’s the point.

    What to do this week

    Block out ninety minutes and do items one and two: multi-factor authentication on the administrator account, done carefully, and a second administrator account created and written down where the church keeps its important papers.

    Then turn on audit logging, because it takes ten minutes, costs nothing, breaks nothing, and can only be done in advance.

    That’s the honest scope of this article: it’s an afternoon, not a project. And the first item alone is most of the benefit — if you only ever get one thing done, get MFA on every account and treat the rest as a bonus.

    MissionDefend’s free assessment covers exactly this ground in plain English — how your email, donations, member data and accounts are actually set up — and hands back a ranked list, so you know which of these ten to spend your one available afternoon on.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: Microsoft, mandatory multifactor authentication guidance; Microsoft, Set-ExternalInOutlook (external sender identification); Microsoft, manage emergency access admin accounts; Microsoft, configure external email forwarding controls; Microsoft, turn auditing on or off; Microsoft, revoke user access in an emergency; Microsoft, manage sharing settings for SharePoint and OneDrive; Google, protect your organization with 2-Step Verification; Google, let users automatically forward their own Gmail; Google, control which apps access Google Workspace data; Google, manage external sharing for your organization; Google, administrator privilege definitions.

  • What $0, $50 and $500 a Month Actually Buy You

    What $0, $50 and $500 a Month Actually Buy You

    The finance team meets on a Tuesday evening in the fellowship hall — three people, a folding table, a printed budget, and the last of the cookies from Sunday.

    Someone read an article. The church should do something about cybersecurity. There’s a proposal on the table from a company that called last week: $600 a month, twelve-month minimum, for a bundle nobody present can fully describe.

    The treasurer asks the right question. Not is this any good? but is this the first thing?

    It almost never is. And that’s the most useful thing anyone can tell a church about security spending, because the order matters far more than the amount.

    The part nobody selling you something will say

    Most of the risk a church actually faces is closed by decisions, not purchases.

    The attacks that take money from churches arrive by email and by phone. They work by persuading a person, or by using a password that was stolen somewhere else. Neither one is stopped by a device you plug into a closet or a subscription you renew every year. They’re stopped by a second step at login and by a written rule about how money moves.

    Buying tools before doing the free work is the most common and most expensive mistake in this whole category. It’s paying for a monitored alarm while the key stays under the mat — and worse, it produces a feeling of safety that delays the actual fix by a year.

    So here are three honest tiers, in order. Do not skip a tier.

    Tier one: $0 a month

    This is where the majority of the protection lives. Every item below is free, and together they are a weekend of work at most.

    Turn on multi-factor authentication everywhere. Multi-factor authentication — MFA — is the extra step after your password: a code, a prompt on your phone, a tap. It means a stolen password by itself is not enough to get in. Microsoft’s own research finds that MFA blocks more than 99.2% of account compromise attacks. If you do one thing from this entire article, do this one, and start with email, then the bank, then the giving platform, then the church database.

    Write down the money rule. One sentence: any change to payment details is verified by voice, on a phone number you already had, before the payment goes out. Not the number in the email. Not a number the caller supplies. This single rule closes invoice fraud, payroll diversion, and most vendor impersonation at once.

    Remove access that should already be gone. The bookkeeper who left in 2021. The intern from two summers ago. The former board member who still gets the shared finance folder. Every dormant account is a door with a key still in it, and nobody is watching that door because nobody uses it.

    Give the important accounts their own passwords. You don’t need a password manager to start. You need the email account, the bank, the giving platform, and the member database to each have a password used nowhere else — because the way most passwords get stolen is a breach at some unrelated website where a staff member used the same one.

    Turn on the security features you’re already paying for. External-sender warning banners on inbound mail, controls on automatic forwarding to outside addresses, audit logging, and sane file-sharing defaults come with the Microsoft 365 and Google Workspace plans churches typically hold. Some are already on — Microsoft now blocks automatic external forwarding by default — and some are not: audit logging, for instance, is switched off out of the box on Microsoft’s small-business licenses and has to be enabled by an administrator. Either way it’s an afternoon of settings, not a purchase order.

    Apply to the nonprofit programme for your platform. Both major providers give qualifying nonprofits free or heavily discounted licensing, and a surprising number of churches are paying full commercial price without knowing.

    Google Workspace for Nonprofits is offered at no charge to qualifying organizations. New accounts can add up to 300 users and can request more through Google support, with 100 TB of storage pooled across the whole organization.

    Microsoft grants Microsoft 365 Business Basic free for up to 300 seats. Be aware of a change that caught a lot of nonprofits off guard: the free grants for Microsoft 365 Business Premium and Office 365 E1 were discontinued on July 1, 2025, and those licenses now expire at renewal rather than renewing. They remain available at nonprofit pricing instead — as of July 2026 Business Premium is listed at $5.50 per user per month on an annual commitment, against $22.00 commercially.

    Eligibility for both is broadly the same shape: recognized charitable tax-exempt status equivalent to a 501(c)(3), verified through the provider’s validation partner, plus agreement to the programme’s own terms. Read those terms before you apply rather than after — Google’s, for example, require that the organization does not discriminate in hiring and employment practices or in the administration of its programs and services, which is a question a church board should answer deliberately. Government bodies, schools, and most healthcare organizations are excluded from both programmes. Terms change; check the current page rather than trusting a summary, including this one.

    Tier two: about $50 a month

    Only once tier one is genuinely finished. Here’s a worked example for a church with six paid staff. Every price below is the US list price as published by the vendor in July 2026; check the current page before you build a budget on it.

    A password manager for everyone — roughly $24 a month. Bitwarden’s Teams plan is listed at $4 per user per month billed annually; six people is $24. The point isn’t the vault, it’s the shared vault: the Wi-Fi password, the giving platform login, and the utility account stop living on a sticky note and in one person’s memory, and when someone leaves you remove their access in one action instead of changing eleven passwords. The free personal tier is better than nothing and will share with one other person, but it doesn’t stretch to a staff team.

    Off-site backup for the things that would actually hurt to lose — roughly $17 a month. Backblaze’s computer backup is listed at $99 per year per computer; two machines is about $16.50 a month. Decide what genuinely matters: the financial files, the membership and giving records, the documents that only exist on the office desktop. And understand the distinction that catches people out — cloud sync is not backup. If a file is deleted or encrypted on the laptop, the synced copy dutifully deletes or encrypts too. Backup keeps versions you can go back to.

    Upgrade the licenses of the people who handle money and data — roughly $17 a month. You do not have to license everyone at the higher tier. Put the three people who touch banking, donations, and the member database on the paid plan that adds device protection and better admin controls — nonprofit-priced Business Premium at $5.50 each is $16.50 — and leave the rest on the free grant.

    That’s about $57 a month, all in, for a six-person staff — and every dollar of it is doing something you can name.

    Tier three: about $500 a month

    At this level you are buying human attention, which is the one thing the free tier can’t give you.

    Managed endpoint protection and monitoring. An endpoint is any device a person works on — laptop, desktop, phone. The software part is cheap: Microsoft Defender for Business is listed at $3 per user per month standalone, and is included with Business Premium. The expensive part, and the valuable part, is a company that watches the alerts at 2 a.m. and calls you. Ask any provider quoting you exactly that: who looks at an alert, how fast, and what do they do next.

    Or a few hours a month of a real IT provider’s time. For many churches this is the better buy. Rates vary enormously by region and by provider, so get three written quotes and compare like for like. Ask each one what they would do in the first month, and be encouraged rather than annoyed if the answer starts with multi-factor authentication and account cleanup — that’s a provider telling you the truth.

    Be clear-eyed about what tier three is not. It does not replace tier one. A competent provider’s first questions will be whether MFA is on and who still has accounts, and if the answer is no and everyone, you have paid $500 a month to be asked.

    What not to buy first

    A firewall appliance. Your losses are arriving as email in a cloud mailbox and as phone calls to the office. A box in the closet does not see either.

    Dark web monitoring. It tells you a password of yours appeared in a breach somewhere. The response is to change that password and turn on MFA — which you can simply do now, for free, without being told.

    Phishing simulation subscriptions, before MFA is on. Testing whether staff click is a reasonable thing to do eventually. Doing it while a single clicked link still hands over a whole mailbox is out of order.

    A cyber insurance policy as a substitute for controls. Insurance is worth having. But read your own application form before you sign it — the questions it asks about your controls are a free, well-informed checklist of what your insurer thinks matters, and answering them honestly is much easier after tier one.

    Anything with a twelve-month minimum sold on a first phone call. Sit with it a week. Nothing in this field is so urgent that it cannot survive seven days of thought.

    How to ask a board for the money

    Don’t lead with fear. Lead with arithmetic, and use one number.

    In 2025 the FBI’s Internet Crime Complaint Center logged 24,768 business email compromise complaints totalling $3,046,598,558 — an average of $123,005 per report. Set that against your annual budget and the request answers itself. Most churches are asking a board to approve a few hundred dollars a year against a category of loss that averages six figures per incident.

    Then do the thing that actually gets budgets approved: bring the completed free work with you. Here is what we did at no cost — MFA on every account, the payment verification rule in writing, eleven old accounts closed. Here is the specific $57 a month I’m asking for, and here is what each line buys. A board that can see the unpaid work already done says yes to the paid work far more readily than one being asked to fund a vague worry.

    What to do this week

    Two things, both under an hour.

    First, apply to the nonprofit programme for whichever platform you use. You’ll need your determination letter and about twenty minutes. If you’re already paying commercial rates, this pays for tier two by itself.

    Second, turn on multi-factor authentication for the two accounts that matter most — whoever handles money, and the administrator account for your email system. Not everyone yet. Just those two, properly, today.

    To find out which tier your own gaps actually sit in, MissionDefend’s free assessment asks plain-English questions about how your organization handles email, donations, member data, and accounts, then returns a baseline score and a ranked list of what to fix first — which, for most churches, turns out to be a list of free things.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: FBI Internet Crime Complaint Center, 2025 Internet Crime Report; Microsoft, mandatory multifactor authentication guidance; Microsoft, Microsoft 365 nonprofit plans and pricing; Microsoft, Microsoft 365 Business Premium; Microsoft, Microsoft for Nonprofits updates; Microsoft, nonprofit eligibility; Microsoft, turn auditing on or off; Microsoft, Defender for Business; Google, Google Workspace for Nonprofits edition; Google, Google for Nonprofits eligibility; Google, Google for Nonprofits Additional Terms of Service; Bitwarden, pricing; Bitwarden, business pricing; Backblaze, computer backup pricing.