Five minutes to lock down access, sharing and recovery for your team.
Security is a habit, not a setting. Start by turning on SSO and requiring it for everyone, then review who has admin access.
Set default sharing to your team, not the public web, and audit external shares regularly. Enable audit logs so nothing happens unseen.
Finally, confirm your export and recovery options — because owning your data means being able to take it with you.
SSO removes a password per service and concentrates risk in one place. That trade is usually worth making — provided the identity provider itself is protected better than the accounts behind it.
Turning on two-factor authentication is the single highest-value security change most small teams can make. Which second factor you pick decides whether it stops the attack that actually happens.
Forced ninety-day changes, three special characters, no repeats — most password rules were written from intuition and make passwords weaker. The current guidance says something close to the opposite.