Securing Business Email: Microsoft 365 vs Google Workspace

Business email compromise remains one of the most common and most expensive attack vectors facing Canadian small and medium businesses, and the platform you run — Microsoft 365 or Google Workspace — is only ever part of the equation. Both platforms are built by companies with enormous security engineering resources, and both offer genuinely strong protection when properly configured. The uncomfortable truth most vendors don't lead with is that a large share of real-world email compromises happen not because the platform failed, but because a feature the platform already offered — MFA, DMARC enforcement, a DLP rule — was never turned on, or was configured just loosely enough to leave a gap.

This guide sets aside the marketing-driven "which one is better" framing and instead walks through what each platform actually does natively for security, tier by tier: anti-phishing and malware defenses, the DKIM/SPF/DMARC trio that authenticates your domain, multi-factor authentication and conditional access, data loss prevention, admin visibility and audit logs, email encryption, and pricing. We'll close with a practical framework for choosing between them based on what your business already runs, not an abstract security scorecard.

Native Anti-Phishing and Malware Defenses

Both platforms filter incoming mail for spam, malware, and phishing before it ever reaches an inbox, and both layer additional protection on top at higher tiers. The difference is less about whether protection exists and more about how deep and how configurable it gets as you move up the pricing ladder.

Microsoft Defender for Office 365

Exchange Online Protection (EOP) — the baseline spam, malware, and basic phishing filter — is included in every Microsoft 365 business tier, including Business Basic. Where Microsoft's protection meaningfully deepens is with Microsoft Defender for Office 365, sold in two plans. Defender for Office 365 Plan 1, bundled into Business Premium, adds Safe Links (rewriting URLs in email and scanning the destination at click-time, not just at delivery-time) and Safe Attachments (detonating attachments in an isolated sandbox before delivery to catch malware that static scanning would miss). Defender for Office 365 Plan 2, generally sold as an add-on or bundled into Microsoft 365 E5, layers on automated investigation and response (AIR), attack simulation training for staff, and threat trackers that show emerging campaign patterns relevant to your organization.

The practical implication: a business on Business Basic or Business Standard gets solid baseline filtering but not the click-time URL rescanning or sandboxed attachment detonation that catches more sophisticated, delayed-activation attacks — those specifically require Business Premium or a Defender add-on.

Google Workspace's built-in defenses

Gmail's phishing and malware defenses are, by most independent measurements, some of the strongest spam filtering in the industry at the baseline level, and this baseline applies across every Workspace tier, including Business Starter. Google's security relies heavily on machine-learning models trained across its enormous mail volume, plus built-in protections against spoofing, suspicious attachment types, and known malicious link patterns. Where Google's protection deepens at higher tiers is through the security center (from Business Plus and Enterprise) and advanced phishing and malware protection settings in the Admin console — including options to sandbox attachments before delivery (comparable in concept to Safe Attachments), flag emails from external senders more visibly, and apply stricter treatment to messages with encoded or unusual attachment types.

Unlike Microsoft, Google does not split this into as sharply defined named add-on tiers — much of Gmail's advanced protection is a configuration toggle available from Business Standard/Plus rather than a separately licensed product, which some administrators find simpler to reason about and others find less granular to control precisely.

DKIM, SPF, and DMARC, Explained in Plain Language

These three DNS records together form the backbone of email authentication — the mechanism that lets a receiving mail server tell whether an email claiming to be from your domain actually came from a system you authorized. Nearly every serious phishing and business email compromise attempt relies, at some level, on domain spoofing that these three records are specifically designed to stop. Yet in our experience auditing small business email setups, a large share of Canadian SMBs on both platforms have SPF configured loosely, DKIM half-set-up, and no DMARC record at all — or a DMARC record stuck permanently at the weakest setting.

SPF (Sender Policy Framework)

SPF is a DNS TXT record listing every mail server and service authorized to send email on behalf of your domain. When a receiving server gets a message claiming to be from yourdomain.com, it checks the SPF record to see whether the sending server's IP address is on the authorized list. If it isn't, the message fails SPF. The common real-world gap: businesses set up SPF once when they first configure email, then add a new marketing platform, invoicing tool, or CRM that also sends mail as their domain — and never update the SPF record, meaning that legitimate tool now fails authentication, or worse, the SPF record is left overly permissive ("+all") specifically to avoid dealing with this, which defeats its purpose entirely.

DKIM (DomainKeys Identified Mail)

DKIM attaches a cryptographic signature to outgoing email, generated using a private key held by your email platform and verifiable using a public key published in your DNS. If any part of the message is altered in transit, the signature no longer validates, which both confirms the message wasn't tampered with and confirms it actually originated from a system holding your domain's private key. Both Microsoft 365 and Google Workspace handle DKIM signing automatically for mail sent through their infrastructure — but in both cases, DKIM has to be explicitly enabled and the resulting public key record published in your DNS; it is not always on by default the moment you set up a new tenant.

DMARC (Domain-based Message Authentication, Reporting and Conformance)

DMARC ties SPF and DKIM together and tells receiving mail servers what to do when a message fails both — and, critically, gives you visibility into who is sending mail as your domain, legitimately or otherwise, through aggregate reports. A DMARC record has three meaningful enforcement levels:

• p=none — monitor only. No mail is blocked or redirected based on DMARC; you simply receive reporting data. This is the correct, safe starting point, not a finish line.
• p=quarantine — mail that fails DMARC alignment is routed to the recipient's spam folder rather than delivered normally.
• p=reject — mail that fails DMARC alignment is refused outright by the receiving server. This is the level that actually stops an attacker from successfully spoofing your exact domain in a phishing attempt.

The single most common mistake we see across both platforms: a business publishes a DMARC record at p=none — often because a compliance checklist or insurance questionnaire asked "do you have DMARC?" — and never moves past it. A p=none record provides visibility but zero actual anti-spoofing protection. Real protection only exists at p=quarantine or p=reject.

How to Roll Out DMARC Enforcement Without Breaking Legitimate Mail

The following staged method applies identically whether your mail runs on Microsoft 365 or Google Workspace, since SPF, DKIM, and DMARC are DNS-level standards independent of which platform hosts your mailboxes.

A realistic timeline for a business with a handful of sending sources: 4-8 weeks from a cold start to full p=reject enforcement, done carefully. Businesses with many third-party sending tools (common for marketing-heavy or e-commerce businesses) should budget longer for the monitoring phase. Our two-factor authentication guide covers the MFA side of account security in more depth, which pairs directly with the authentication work described here.

Multi-Factor Authentication: Entra ID Conditional Access vs 2-Step Verification

A stolen or guessed password should never, by itself, be enough to reach a business email account. Both platforms have moved well beyond simple MFA toward risk-aware, context-sensitive access policies — but they implement this differently, and the depth of control available differs by tier.

Microsoft Entra ID Conditional Access

Microsoft's approach centers on Entra ID (formerly Azure AD) Conditional Access, which evaluates a set of signals — user location, device compliance status, sign-in risk level, application being accessed — and applies policy accordingly. A well-built Conditional Access policy set might require MFA only when a sign-in originates from an unfamiliar country, block legacy authentication protocols entirely (a common way attackers bypass MFA by using an older protocol that doesn't support it), and require the device itself to be compliant (encrypted, patched, enrolled in management) before granting access to email. Conditional Access in its fuller form is available from Microsoft 365 Business Premium and above, or as an Entra ID P1/P2 add-on for lower tiers. Business Basic and Business Standard include simpler "Security Defaults," which enforce baseline MFA but without the granular, risk-based logic Conditional Access provides.

Google Workspace 2-Step Verification and context-aware access

Google Workspace's core MFA is 2-Step Verification (2SV), supporting security keys, the Google Authenticator app, and phone-based prompts, enforceable at the organizational unit level from every tier including Business Starter. Google also strongly pushes phishing-resistant methods — particularly physical security keys and passkeys — which are increasingly considered best practice over SMS or app-based codes precisely because they can't be phished the same way. Context-aware access, Google's analog to conditional access, restricts access to Google services based on user identity, device security status, IP address, and geographic location, and is available from Business Standard, with the fuller policy engine at Business Plus and Enterprise. It covers the core use cases — blocking access from unmanaged devices or unexpected locations — solidly, though it generally offers less granular, rule-by-rule conditional logic than Entra ID's full Conditional Access engine at its most advanced tier.

Data Loss Prevention (DLP): Which Tiers Actually Include It

DLP scans outgoing (and sometimes internal) email and file content for patterns matching sensitive data — credit card numbers, SIN numbers, banking details, health information — and can block, warn, quarantine, or encrypt a message before it leaves the organization, or before it's shared inappropriately. This is one of the more meaningfully tier-gated features on both platforms.

Microsoft 365 DLP

DLP for Exchange Online (and more broadly across SharePoint, OneDrive, and Teams) is included starting at Business Premium. Business Basic and Business Standard do not include native DLP policy creation — a business on those tiers wanting DLP typically needs to either upgrade to Business Premium or license a Microsoft 365 E5 Compliance or Purview add-on for the specific users who need it. Once available, Microsoft's DLP engine is quite mature, with built-in sensitive information type templates aligned to categories relevant in Canada (including patterns for Canadian SIN numbers and financial account formats), customizable detection rules, and policy tips that warn a user in real time before they send a message that trips a rule.

Google Workspace DLP

Google Workspace DLP for Gmail (and Drive) becomes available starting at Business Standard for a more limited rule set, with the fuller DLP engine — more granular content detection, custom detectors, and broader coverage across Drive and Chat — available from Business Plus and more extensively in Enterprise tiers. Google's DLP similarly supports predefined and custom detectors, and can be configured to warn, block, or quarantine content matching sensitive data patterns.

Feature	Microsoft 365 Business Basic	Microsoft 365 Business Standard	Microsoft 365 Business Premium	Google Workspace Business Starter	Google Workspace Business Standard	Google Workspace Business Plus
Built-in anti-phishing/malware	Baseline (EOP)	Baseline (EOP)	Advanced (Defender for O365 P1)	Baseline (strong default filtering)	Baseline + enhanced settings	Advanced (security center access)
Safe Links / Safe Attachments (sandboxing)	No	No	Yes	No	Partial (advanced settings)	Yes (fuller controls)
Data Loss Prevention (DLP)	No	No	Yes	No	Basic	Yes (fuller rule engine)
MFA / conditional access	Security Defaults only	Security Defaults only	Full Conditional Access	2-Step Verification	2SV + context-aware access	2SV + fuller context-aware access
Email encryption	Basic (Office Message Encryption)	Basic (OME)	Purview Message Encryption (full)	S/MIME (manual setup)	S/MIME + confidential mode	S/MIME + confidential mode + more controls
Admin audit logs	Basic (limited retention)	Basic (limited retention)	Extended (90+ days, full unified audit log)	Basic	Extended	Extended + Vault eDiscovery
Approx. price per user / month (CAD)	~$8.60	~$17.00	~$31.90	~$9.60	~$14.40	~$21.60

Pricing shown is approximate CAD list pricing for annual commitment as of mid-2026 and is subject to change by Microsoft and Google; confirm current rates before purchasing. Feature availability also shifts periodically as both vendors update their plans.

Admin Console, Audit Logs, and eDiscovery

When something goes wrong — a suspicious sign-in, a departing employee, a possible data exposure — the quality of your admin visibility determines whether you can answer "what actually happened" with confidence or with a guess.

Microsoft's unified audit log and Purview

Microsoft 365's unified audit log, accessible through the Microsoft Purview compliance portal, captures a very wide range of user and admin activity across Exchange, SharePoint, OneDrive, and Teams. Retention and search capability scale with licensing — Business Basic/Standard retain a more limited audit trail, while Business Premium and E5/Purview add-ons extend retention significantly and add eDiscovery (the ability to search, hold, and export content across mailboxes and files for legal or investigative purposes) and Content Search tools. For businesses with any litigation exposure, HR investigation needs, or regulatory retention obligations, this eDiscovery depth is often the deciding factor in tier selection, independent of the anti-phishing feature set.

Google's Admin console and Vault

The Google Workspace Admin console provides a centralized view of security alerts, sign-in activity, and (from Business Plus and Enterprise) the security center's investigation tool, which lets an administrator search across users and time ranges for specific activity patterns. Google Vault, Google's eDiscovery and retention tool, is included from Business Plus and provides similar core functionality to Microsoft's eDiscovery tools — legal holds, content search across Gmail and Drive, and export for investigation or litigation purposes. Business Starter and Standard do not include Vault natively.

Email Encryption: Purview Message Encryption vs Confidential Mode and S/MIME

Encryption is where the two platforms diverge most in naming and where confusion is most common — particularly around what Gmail's "confidential mode" actually does and doesn't do.

Microsoft Purview Message Encryption

Purview Message Encryption (formerly Office 365 Message Encryption, or OME) lets a sender apply encryption and usage restrictions — such as "do not forward" or "encrypt only" — to an outgoing email, with the recipient able to open it through a web portal even if they don't use Microsoft 365 themselves. A basic version is available from Business Basic; the fuller policy-driven version, where encryption can be automatically applied based on DLP rule matches (for example, any email containing a detected SIN number gets encrypted automatically without the sender needing to remember to do it), is tied to the same Business Premium/Purview licensing as DLP itself.

Gmail confidential mode and S/MIME

This is the point worth stating clearly: Gmail confidential mode is not end-to-end encryption. It restricts forwarding, copying, downloading, and printing, and can apply an expiry date and an SMS passcode requirement — genuinely useful controls for casual data handling — but Google can still access the message content on its servers, and nothing stops a recipient from simply taking a screenshot. For actual cryptographic encryption with a real security guarantee, both platforms support S/MIME (Secure/Multipurpose Internet Mail Extensions), which requires each user to have a digital certificate and both sender and recipient to support S/MIME for it to work seamlessly — a heavier setup lift than either platform's built-in policy-based encryption, but the gold standard where it matters most, such as legal or highly regulated communications.

Ransomware and Malicious Attachment Scanning

Attachment-borne malware and ransomware droppers remain a major infection vector, and both platforms scan attachments — but with meaningfully different depth depending on tier. Microsoft's Safe Attachments (Defender for Office 365 Plan 1, from Business Premium) actually detonates attachments in an isolated sandbox environment before delivery, catching malware designed to evade static signature-based scanning by only activating after a delay or under specific conditions. Below Business Premium, Microsoft 365 relies on more conventional signature and heuristic-based scanning through EOP, which catches known malware effectively but is more easily evaded by novel or delayed-activation threats.

Google Workspace applies broad attachment-type restrictions and scanning at every tier — blocking or flagging executable files and other high-risk formats by default — and adds more advanced sandboxing-style protection through the security center's advanced settings from Business Plus. Google has also historically been aggressive about default-blocking certain risky attachment types (executables, certain script files) across all tiers, which meaningfully narrows the practical attack surface even before any admin configuration.

For businesses in sectors that routinely receive attachments from external parties — professional services firms receiving client documents, accounting practices receiving tax files, real estate firms receiving signed documents and wire instructions — the sandboxed detonation available at Microsoft's Business Premium tier or Google's Business Plus tier represents a meaningful step up over entry-level scanning, and is worth the tier upgrade specifically for that risk profile.

Business Email Security Hardening Checklist

Real-World Scenarios: How This Plays Out at Businesses Like Yours

The following scenarios are illustrative composites based on common patterns seen across small and mid-sized Canadian businesses — not accounts of specific named clients — but they reflect the kinds of gaps and remediation paths that show up repeatedly in practice.

Case study 1: A real estate brokerage in London, Ontario

A 12-agent real estate brokerage in London, Ontario ran Microsoft 365 Business Standard with no DMARC record published at all — SPF existed but was outdated, and DKIM had never been enabled. An attacker registered a domain visually similar to the brokerage's own and sent a spoofed email, appearing to come from the brokerage's own managing broker, instructing a closing coordinator to redirect a deposit wire to a new account "due to a banking update." Because no DMARC enforcement existed, and because the spoofed domain was close enough that a rushed reader didn't catch the difference, the coordinator processed the wire. The brokerage's insurance and banking recovery process ultimately clawed back a portion of the funds, but the firm still absorbed a direct loss of approximately $38,500 CAD, plus the cost of client relationship damage on the affected transaction. Remediation included immediate DMARC rollout to full p=reject enforcement, mandatory MFA firm-wide, and a new internal policy requiring phone verification (using a previously known number, not one provided in the email) for any wire instruction change, regardless of how legitimate the email appeared.

Case study 2: A nonprofit organization in Gatineau, Quebec

A community-services nonprofit in Gatineau, Quebec, running on Google Workspace Business Starter for cost reasons, experienced a near-miss when a staff member nearly entered their credentials into a convincing fake Google sign-in page linked from a phishing email that had bypassed baseline filtering. The staff member noticed the URL looked wrong at the last moment and did not proceed, but the organization's board, reviewing the incident, discovered they had no DLP capability at their current tier, no advanced phishing protection, and 2-Step Verification was available but not enforced for two of fourteen staff accounts, including one shared program-intake mailbox handling donor financial information. Following the near-miss, the organization upgraded to Google Workspace Business Plus, enabled 2SV enforcement organization-wide with no exceptions, configured DLP rules for donor payment card and banking data, and enabled Vault for the retention requirements tied to their provincial nonprofit reporting obligations. The all-in cost increase was modest — roughly $9 CAD per user per month — relative to what a successful compromise of donor financial data would have cost in remediation and reputational damage for an organization dependent on public trust.

Case study 3: A logistics company in Saskatoon, Saskatchewan

A 45-employee logistics and freight-brokerage company in Saskatoon, Saskatchewan, running Microsoft 365 Business Premium with Defender for Office 365 Plan 1 properly configured, was targeted by a business email compromise attempt in which an attacker, having done reconnaissance on the company's public LinkedIn presence, impersonated the CFO in an email to the accounts payable clerk requesting an urgent, unusual vendor payment. Safe Links flagged the embedded "invoice" link as leading to a credential-harvesting page at click-time and blocked it before the clerk could reach the fake login page; separately, Conditional Access flagged a suspicious sign-in attempt from an unfamiliar location on an unrelated account the same week and required additional verification, which the attacker could not complete. The company's IT lead credited the combination of Safe Links click-time rescanning and Conditional Access — both specifically gated behind the Business Premium tier the company had chosen over the cheaper Standard tier the previous year — with preventing what internal estimates suggested could have been a payment loss in the range of $60,000 to $90,000 CAD had the fraudulent invoice been processed. The incident was treated as validation of the tier decision rather than triggering further changes, though the company did add a mandatory phone-verification step for any new or changed vendor banking details as an additional non-technical control.

Budget and Pricing: What This Actually Costs a Canadian Business

Licensing costs vary by commitment term, promotional pricing, and currency fluctuation, but the following ranges reflect realistic mid-2026 Canadian pricing for planning purposes.

Item	Typical Cost Range (CAD)	Notes
Microsoft 365 Business Basic	~$8.60 / user / month	Web/mobile Office apps only; baseline security
Microsoft 365 Business Standard	~$17.00 / user / month	Adds desktop Office apps; still baseline security tier
Microsoft 365 Business Premium	~$31.90 / user / month	Adds Defender for O365 P1, Conditional Access, DLP, Intune device management
Google Workspace Business Starter	~$9.60 / user / month	30GB storage; baseline security only
Google Workspace Business Standard	~$14.40 / user / month	2TB storage; basic DLP, context-aware access
Google Workspace Business Plus	~$21.60 / user / month	5TB storage; fuller DLP, Vault eDiscovery, advanced endpoint management
Email security hardening project (DKIM/SPF/DMARC + MFA + baseline DLP)	$800 – $3,500	One-time project; scales with number of sending sources to inventory
Full platform migration (M365 ↔ Workspace)	$2,000 – $10,000+	Depends on user count, mailbox size, and third-party integrations
Ongoing managed email security & monitoring	$5 – $15 / user / month	DMARC report review, DLP rule tuning, audit log review, policy updates

Put together, a 20-person business moving from an entry-level tier on either platform to a properly hardened, security-tier configuration typically sees a licensing cost increase in the range of $150 to $350 CAD per month total (roughly $8 to $18 per user), plus a one-time hardening project. Compared against even a single mid-sized business email compromise incident — routinely tens of thousands of dollars in direct loss before considering recovery time and reputational cost, as illustrated in the case studies above — this upgrade cost is, in nearly every real scenario we've assessed, a straightforward return on investment.

Canadian Government Resources

Several federal resources are available at no cost and worth bookmarking as your business builds out its email security baseline:

• Canadian Centre for Cyber Security (cyber.gc.ca) — Canada's federal cybersecurity authority, publishing baseline security control guidance directly applicable to business email, including specific recommendations on email authentication (SPF/DKIM/DMARC), MFA, and phishing awareness for organizations of every size.
• Office of the Privacy Commissioner of Canada (priv.gc.ca) — the federal privacy regulator, relevant whenever an email compromise involves personal information, with guidance on breach reporting obligations under PIPEDA.
• Innovation, Science and Economic Development Canada (ISED) — publishes broader digital economy and cybersecurity policy guidance, and administers the CyberSecure Canada certification program relevant to SMBs looking to formally demonstrate baseline security practices, including email authentication.
• Business Development Bank of Canada (BDC) — offers digital advisory services and financing options for SMEs investing in technology and security upgrades, including email platform licensing and security hardening projects.

Alongside these resources, the Canadian Centre for Cyber Security's "Baseline Cyber Security Controls for Small and Medium Organizations" specifically names email authentication and MFA among its top-priority controls — useful as an independent, non-vendor reference point when deciding how much to invest in hardening either platform.

Frequently Asked Questions