How a 40-person business moved off Google Workspace and put every account behind managed identity

Google Workspace itself ran fine — Gmail’s filtering was genuinely good. The gap was configuration, and the fact that nobody was watching the console: 2-Step Verification was available but optional, a permissive link-sharing policy let staff share folders with anyone holding the URL, and the Windows laptops had no directory behind them at all. Then a cyber-insurance renewal asked how the business enforced MFA, protected endpoints, and encrypted disks. Nobody could attest to any of the three.

Every account now sits behind enforced MFA on a managed, encrypted device, and mail, files, and endpoints answer to one directory instead of none. Per-seat licensing costs more than the Google tier they left, and the business accepted that knowingly — device management, EDR, and conditional access were controls it had just been asked to evidence and would otherwise have bought separately. Complex spreadsheets still needed hand-checking after conversion, and external share links had to be reissued.