The MFA and admin-alert baseline Google and Microsoft both expect you to turn on

Google Workspace and Microsoft 365 both publish the same idea in different words: administrators should not sign in with a password alone, and someone should be notified when privileged settings change. None of this requires a new security product. It requires defaults you switch on and a channel that a human actually reads.

Google Workspace: 2-Step Verification is not optional for admins

Google requires 2-Step Verification for admin accounts on Workspace. Enforce it for the rest of the organisation with a security policy, not an email asking people to opt in. Prefer Google prompts, security keys, or passkeys over SMS. Super admins should have a hardware key and a break-glass account stored offline. In the Admin console, turn on alerts for new super admin assignment, suspicious login, and OAuth app grants.

Microsoft 365: security defaults or Conditional Access, not neither

Microsoft Entra security defaults register users for MFA and block legacy authentication. If you have Entra ID P1 or P2, replace defaults with Conditional Access so you can require phishing-resistant MFA for admins, block sign-ins from countries you do not operate in, and require compliant devices for finance roles. Number matching in Microsoft Authenticator is the current baseline; SMS should be an exception, not the plan.

• Disable mailbox forwarding rules that send mail outside the tenant unless the security team approved them.
• Alert on new Global Administrator / Privileged Role Administrator assignments, not only on failed logins.
• Review guest users and unused enterprise applications every quarter. Stale guests are a common, boring hole.

Alerts that go somewhere

Route Google Alert Center and Microsoft Entra Identity Protection (or at least the unified audit log alerts you can get on lower SKUs) to a monitored mailbox or Teams channel. A weekly digest in a shared inbox that nobody opens is not monitoring. If you outsource this, the MSP's runbook should name the first responder and the customer contact for after-hours admin lockouts.