Business email connects your people, customers, invoices, and shared files. That makes it a useful place to start when reviewing security. Whether your Tulsa business uses Microsoft 365 or Google Workspace, a few focused checks can reveal gaps before they become a difficult interruption.
Use these five questions in your next conversation with your IT provider. They are practical starting points for a review, with changes planned around the way your staff works.
1. Is stronger sign-in protection actually required?
Multifactor authentication, or MFA, adds verification beyond a password. Ask your provider to check that it is required for the right accounts and that users have completed enrollment. An available setting and an enforced policy are different things.
Where your systems support them, consider phishing-resistant methods such as FIDO2 security keys or passkeys. Choose an approach that fits your applications and devices, then help employees enroll. Roll it out with recovery arrangements in place so a lost phone does not leave someone without a way to work.
2. Who has administrator access?
Administrator accounts can change settings and grant access across the business. Review who holds those permissions and whether each person still needs them. Give people the permissions their responsibilities require.
Use a separate ordinary account for everyday email and browsing. Microsoft specifically recommends keeping routine work separate from administrator activity. Include your outside IT provider in this review so you understand how administrative access is assigned and protected.
3. Could you recover an account without improvising?
A replacement phone or lost security key should have a clear recovery process. Confirm that authorized staff know whom to contact, how their identity will be checked, and where approved recovery information is stored.
Google recommends maintaining administrator recovery information and securely storing backup codes where applicable. Keep recovery material protected, and review it when staff or devices change. Ask your provider how the business would regain administrative access if its usual administrator were unavailable.
4. Do people know how to verify a suspicious request?
An urgent message asking for a payment, password, or account change deserves a pause—even when the name looks familiar. Contact the person through a number or channel you already trust, rather than the contact details inside the message.
Make reporting simple. Tell employees where to send concerns and whom to call if they clicked a link, entered credentials, or approved an unexpected sign-in. Encourage quick reporting so your IT provider can investigate. Clear writing and familiar branding alone do not establish that a message is legitimate.
5. Who keeps the protection current?
Security needs ongoing attention as employees, software, and work habits change. Assign an owner for reviewing sign-in protection, administrator access, recovery arrangements, and available email protections.
Keep browsers and applications updated, review file-sharing settings, and check the protections available in your Microsoft or Google subscription. Discuss the useful improvements for your business and put them into a manageable plan.
Start with one clear next step
Ask for a short account-security review and leave with named actions and owners. TechSavvy can help connect these checks with your everyday IT support, employee needs, and plans for growth. The goal is practical protection your business can maintain.