Turn on 2-Step Verification across your whole Google Workspace domain

As the admin, you can enforce 2-Step Verification for every user from the Admin console (Security > 2-Step Verification), which is the single biggest step to stop account takeovers, exactly as with Microsoft 365. Give staff a grace period and clear instructions before making it mandatory so nobody gets locked out on day one.

Coach's tip: encourage Google Authenticator or a security key over SMS codes — SMS can be intercepted via SIM-swap attacks.