Penetration testing explained for UAE businesses
What a penetration test is, how it differs from a scan, what belongs in the scope, and why UAE law makes written authorisation essential.
Read the articleIT Services · Google Workspace
Choosing an edition, moving mail and files without losing them, the security controls worth configuring, and an honest comparison with Microsoft 365.
Google Workspace in Dubai is often the thing a company already uses without having decided to. Someone set up a free Gmail account for the business years ago, the team grew, and now a dozen people share documents from personal accounts with no administrative control over any of it.
The other common situation is a properly licensed Workspace that was configured in an hour and never revisited, with sharing defaults that let anyone publish a document to the open web and no record of who holds administrator access.
This page covers both: choosing an edition, migrating into Workspace without losing anything, the admin console settings that matter, and an honest comparison with Microsoft 365 rather than an argument for one.
Editions
Fewer tiers than the Microsoft equivalent, which makes this a shorter decision.
Choosing a Google Workspace edition in Dubai starts with published figures. Google publishes its current edition comparison and the specifics move, so what follows is the set of questions that decide it rather than a recommendation that will date.
How much storage per user? The entry edition is modest and teams working with video or large design files reach the ceiling faster than expected. Storage is pooled across the organisation on most editions, which helps, but it is still the variable that most often forces an upgrade.
Do you need meeting recording? Not available on the entry edition. For companies that record client calls or training, this alone determines the tier.
Do you need advanced security and device management? Higher editions add controls like data loss prevention, context aware access and stronger endpoint management. Worth understanding before dismissing, particularly where staff read company mail on personal phones.
Do you need a data region setting? Available on some editions only. If where data sits at rest matters to you, this is a reason to look above the entry tier, and it is covered below.
Is there a seat limit? The entry business editions cap at a stated number of users, above which you move to Enterprise. Growing companies meet this without anticipating it.
As with any subscription, the audit worth running is assigned licences against actual use. Accounts for departed staff, duplicate accounts and seats on a tier nobody needs are the usual findings.
The variable that most often forces an upgrade. Teams handling video or large files reach the entry ceiling sooner than planning assumes.
Absent from the entry edition. For companies recording client calls or training sessions this single feature settles the tier choice.
Data loss prevention, context aware access and stronger device management sit higher up. Relevant where personal phones carry company mail.
Only on some editions. If where data rests matters for your sector, this is the reason to look above the entry tier.
Getting off personal accounts
This is the most common Google Workspace project in Dubai and it is less about technology than about recovering control of things the business does not currently own.
The problem with running on personal accounts is not that it fails. It is that the company owns nothing. Documents belong to whoever created them, and leave when that person does. There is no administrator who can reset a password or recover a file. Nobody can see what is shared publicly. And the address on business cards is a gmail.com one, which in this market affects how a counterparty reads you.
The move has a specific order. Set up the Workspace on your real domain and verify it. Create the accounts. Then use Google’s transfer tooling so individuals can move their own documents into the company account, which matters because an administrator cannot reach into a personal account and take files out.
That last point is the one that catches companies out. Transfer requires the cooperation of the person holding the files. If someone has already left and is not responding, those documents may be genuinely unrecoverable, which is an argument for doing this before a departure rather than after one.
Afterwards, decide what happens to the personal accounts. Usually they keep existing for personal use and simply stop being used for work, with mail forwarding for a transition period and then not.
Admin console
Defaults are built for convenience, and several are more open than a business would choose.
The Google Workspace admin console in Dubai is comprehensive and most of it is never opened. A small number of settings account for most of the risk on a Workspace that was set up quickly.
Two step verification, enforced. Available by default and not enforced by default. Google’s guidance covers rolling it out, and the sequence that works is announce, allow a grace period, then enforce. Super administrators first.
Sharing defaults. The setting that decides whether a document can be made public with a link. Many organisations are comfortable with link sharing inside the company and not outside it, and that is a configuration choice rather than the default.
Shared drives rather than personal drives. A file in someone’s My Drive belongs to them. A file in a shared drive belongs to the organisation and survives their departure. This single structural decision prevents the most common data loss we see.
Super administrator count. How many exist, and whether any belong to a former supplier or a consultant. Most Workspaces have more than necessary.
Third party app access. Which external applications staff have connected to company data. This accumulates quietly as people try tools, and reviewing it periodically is worthwhile.
Where the Workspace holds personal data about customers or staff, the UAE’s personal data protection framework places obligations around securing it, so these settings sit alongside your wider security posture and carry a compliance dimension as well as a technical one.
Available by default, enforced by default nowhere. Announce, grace period, then enforce, with super administrators going first.
Files in a personal drive leave with the person. Files in a shared drive belong to the company. The structural decision that prevents most data loss.
Whether documents can be made public with a link, and which third party apps reach company data. Both drift open without review.
Honestly compared
We deploy both, and on Google Workspace against Microsoft in Dubai the honest position is that for most companies either works, and the deciding factors are rarely the ones argued about.
What your team already knows matters more than any feature table. A finance team living in Excel will resist Sheets, and the resistance is legitimate rather than stubborn. A young team already working in Gmail and Docs will find Outlook a step backwards.
What your counterparties send you. In Dubai a great deal of business correspondence arrives as Word and Excel attachments, frequently with formatting that matters. Workspace handles these well and not perfectly, and complex spreadsheets with macros are where the gap shows. Test your own worst file rather than taking anyone’s word.
Desktop applications. Microsoft gives you installed Office apps at the right tier. Google is browser first, with offline capability but a different working model. For people who live in a spreadsheet all day this is a real difference.
Administration. Google Workspace in Dubai is simpler to administer than the Microsoft equivalent; its console is less granular. Microsoft offers more control. Which is an advantage depends entirely on whether you have someone to use it, which is a question about your wider cloud setup rather than about either product.
Price. Broadly comparable at equivalent tiers, and close enough that it should not be the deciding factor on its own.
Where we would steer: if your work depends on heavy Excel or specific Microsoft applications, Microsoft 365. If your team is browser based, collaborates in real time and has no Office dependency, Google Workspace. If neither applies strongly, pick the one your staff already use and spend the saved effort on configuring it properly.
Data location
Available, limited, and worth understanding precisely rather than approximately.
Data residency for Google Workspace in Dubai is partly configurable. Some editions allow a data region to be selected, which covers data at rest for core services. The scope has stated limits: it applies to covered data at rest, not to every service, not to data in transit, and not to all metadata.
That precision matters for a Dubai business with a regulatory requirement, because the useful question is never whether a region setting exists but whether what it covers satisfies your specific obligation. That is a compliance question rather than a technical one, and your adviser should answer it before migration rather than after.
The setting can be applied to the organisation or to particular groups, which allows a mixed arrangement where one department has a requirement the rest of the business does not.
Two further points. Data moving between regions after a change takes time and is not instant, so this is a decision to make early. And residency is a different question from access: who inside your organisation can reach what is governed by your own configuration, not by geography, and that is usually the more immediate risk.
If a residency requirement is genuinely binding on your sector, establish it first, because it may determine the edition and therefore the cost before anything else is decided.
Deliverability
As with any mail migration, the complaint that follows a move to Google Workspace in Dubai is usually that mail is landing in junk, and the cause is almost always authentication records.
SPF must authorise Google to send for your domain, and must still list everything else that legitimately sends as you: website forms, a CRM, invoicing software, a marketing platform. Replacing the record with Google alone breaks those silently, and nobody notices until a customer says they never received something.
DKIM is not enabled by default for a custom domain in Workspace. It has to be generated in the admin console and published in DNS. This is the single most commonly skipped step.
DMARC should start at monitoring, not enforcement. Read the reports for a few weeks, find the legitimate senders nobody remembered, then tighten. Google documents the sequence, and going straight to strict enforcement is how a company stops delivering its own invoices.
There is also a routing consideration specific to businesses running a website on separate hosting. Mail sent by the website, such as a contact form notification, does not go through Workspace unless configured to, and it is frequently the mail that fails while everything from a mailbox works fine.
Test from outside. Send to an address at a different provider and check whether it arrives in the inbox or the spam folder, in both directions, before declaring a migration finished.
Day to day
Modest work, and the reason tenants decay is that nobody owns it.
Accounts suspended the day someone leaves, their files transferred to a shared drive or a manager, the licence released. The most common gap we find.
Quarterly. Assigned against used, and whether the edition still matches what the business needs. Storage pressure usually drives this.
What is shared publicly, and with whom outside the company. This drifts open steadily as people share things and never revisit them.
Google protects against its own failures, not against someone deleting a shared drive. Whether you need separate backup is a conscious decision.
The leaver process in Google Workspace for Dubai teams deserves emphasis, because it works differently from Microsoft. Suspending an account preserves the data and stops access, and files in a personal drive still belong to that suspended account until they are transferred. Deleting the account without transferring first is how companies lose documents permanently, and it is irreversible after the recovery window.
Shared drives largely solve this, which is why the structural decision described earlier matters more than any single setting on this page.
Working with us
For an existing Google Workspace in Dubai we audit before touching anything: accounts and super administrators, licensing against use, sharing defaults and what is currently public, third party app access, and whether company files sit in personal drives. You get a written document and a prioritised list.
For a new deployment or a move off personal Gmail accounts, we settle the structural questions first. Domain and verification, edition, shared drive structure, sharing policy, and whether a data region requirement applies. Then build, then migrate.
Migrations copy before switching, in that order, and we test sending and receiving with an outside provider before calling it finished. Where people hold company files in personal accounts, we run the transfers while those people are still reachable, because afterwards it may not be possible.
Ownership stays yours throughout. The Workspace is yours, the super administrator account is yours, and we work as an additional administrator you can remove. We will not hold ownership of a client’s Workspace.
Google Workspace in Dubai works as a defined project or with ongoing support alongside our IT support. You get a fixed written quote within 45 minutes during business hours.
The apps
Bought for mail, and most of the rest goes unexamined.
Google Workspace in Dubai is almost always purchased for business email on a real domain. What comes with it covers a surprising amount of what companies buy separately.
Drive and shared drives. The file layer, and the distinction matters more than any other setting discussed here. A shared drive belongs to the organisation; a personal drive belongs to a person. Deciding this on day one prevents the data loss that follows a departure.
Docs, Sheets and Slides. Real time collaboration is genuinely better than the Microsoft equivalent, which is the main reason teams who have used both prefer them. The trade off is handling complex Office files, discussed above.
Meet. Video conferencing included at every edition, with recording only on higher ones. Companies paying separately for another conferencing subscription alongside Workspace are paying twice.
Forms. Underused and genuinely capable. Internal requests, event registrations, simple surveys feeding straight into a sheet. A lot of Dubai businesses pay for a separate form tool that does what this already does.
Groups. The equivalent of shared mailboxes. A single address like accounts or sales that routes to several people, with history that survives staff changes. Underused for exactly the same reason it is underused on Microsoft: nobody knew it was there.
Vault, on higher editions. Retention and legal hold. Relevant if your sector has record keeping obligations, and worth checking against those obligations rather than assuming it is handled.
The exercise worth doing is listing every tool you pay for monthly and checking the overlap. It usually funds the Workspace subscription outright.
Organisation owned files that survive departures. The single most important structural decision in a Workspace, and it belongs on day one.
Included at every edition. Companies running a separate conferencing subscription alongside Workspace are paying for the same thing twice.
A team address with history that outlives individuals. The equivalent of a shared mailbox and just as overlooked.
Internal requests, registrations and surveys feeding a sheet directly. Replaces a separate subscription in most Dubai businesses that have one.
Bilingual and regional
Google Workspace in Dubai has a few settings worth handling during rollout rather than fielding as complaints afterwards.
Interface language per user. Each person sets their own, independently of the organisation default, and telling staff this during rollout prevents a run of support questions from people who assumed otherwise.
Right to left editing. Docs supports it and the editing language needs enabling per account. Without it, anyone composing in Arabic spends their time fighting the text direction.
Time zone. Set the organisation to Gulf Standard Time at creation. Workspaces provisioned by an overseas supplier commonly default elsewhere, and the symptom is calendar invitations landing at the wrong hour for months before anyone traces it.
The working week. Calendar defaults assume a Monday to Friday week. Where that does not match your organisation, it is adjustable per user, and leaving it wrong means the scheduling suggestions are quietly useless.
Holiday calendars. UAE public holidays can be subscribed to, and because several follow the Hijri calendar and are confirmed close to the date, this needs occasional manual attention rather than running itself.
These cost nothing and they are the difference between a rollout people accept and one they complain about for a quarter.
Common faults
The same findings recur, and several take minutes to correct.
An audit of Google Workspace in Dubai turns up a predictable list. None of it indicates incompetence; it indicates that the Workspace was configured once and nobody has opened the admin console since.
Company files in personal drives. The most consequential finding. Years of documents owned by individuals, several of whom have left, with no transfer having been run before their accounts were touched.
Documents shared publicly with a link. Usually shared years ago for one purpose and never revoked. Occasionally these contain things that should not be on the open web, and nobody has looked because the console does not surface it unprompted.
Two step verification optional. Available, announced, and never enforced, so adoption sits somewhere under half the company including at least one super administrator.
Suspended accounts never resolved. People who left, accounts suspended, files never transferred, licences sometimes still billing. Suspension is the right first step and it is not the last one.
Third party applications nobody authorised centrally. Staff connecting tools to company data over several years. Most are harmless and the list is always longer than anyone expects.
Super administrators who should not be. A previous supplier, a consultant from one project, or three people who all got the role because it was simpler than configuring delegated access.
No documentation. No record of what was configured, by whom, or why. The finding that makes every other finding slower to fix.
Suspend and resolve departed accounts, transfer their files, remove unexplained super administrators, enforce two step verification.
Review what is publicly shared and revoke what should not be. Audit connected third party applications. Both drift open on their own.
Move company files out of personal drives into shared drives, set the sharing policy deliberately, and write down what you configured.
Cost
Google Workspace pricing in Dubai is published per user per month and it is not the whole picture, which is where budgets go wrong in the same way they do on any platform.
Licences vary by edition, usually with a discount for an annual commitment. Google lists current pricing and it changes, so work from today’s published figure rather than a number carried forward from an old proposal.
Setup and migration is a one off, and the cost is driven almost entirely by where you are coming from. Moving a handful of people off personal Gmail is a short exercise. Moving eighty mailboxes with years of archives from another platform is not.
Ongoing administration is the line most often omitted. Joiners, leavers, file transfers, sharing reviews, someone to answer when a password breaks. Internal time or a support arrangement, but not zero.
Backup, if you decide you need it, is separate. Google protects against its own failures, not against a person deleting a shared drive or ransomware reaching synced files. Worth deciding knowingly.
Additional storage where a team exceeds the pooled allowance. This is the cost that arrives unannounced in companies working with video or large design files, and it is worth modelling before choosing the entry edition.
Against that, list what Workspace replaces. Conferencing, file sharing, form tools and sometimes a separate mail host. For most Dubai businesses that offset is larger than expected.
Rolling it out
The deployment is straightforward. Changing how people work is not.
A Google Workspace rollout in Dubai can be configured perfectly and still leave people emailing attachments to each other, which is the behaviour it was supposed to replace.
Attachments are the habit to break. The whole value of the file layer is that there is one document and everyone works on it. A team that keeps sending copies has the subscription and none of the benefit. This is worth naming explicitly during rollout rather than hoping it is inferred.
Set up shared drives before anyone uploads. A structure agreed in advance, with a naming convention. Letting the structure emerge produces forty drives with overlapping names within a year, and reorganising afterwards breaks every link people have saved.
Move mail first, files second. Mail has to move anyway and everyone notices it. Files are the harder behavioural change and benefit from the system already feeling normal.
Name someone internally. Not an administrator, just a confident user colleagues will ask. Most questions are small and never become tickets.
Train on the real workflow. Walking a department through how they will now do their actual weekly task beats generic feature training, and takes less time.
Where people resist, listen before overruling. Someone defending their own spreadsheet usually has a requirement nobody asked about, and discovering it during rollout costs far less than discovering it after.
One document, worked on together. A team still mailing copies has the subscription and none of the value, and this needs saying aloud.
Shared drives and a naming convention agreed first. Letting it emerge produces sprawl, and reorganising later breaks every saved link.
A confident user rather than an expert. Colleagues ask the person beside them long before they raise a ticket with anyone.
Inheriting one
Common here, and the order of operations matters.
Businesses reach us because whoever set up their Google Workspace in Dubai has stopped responding, raised prices, or closed. What is recoverable depends on who holds what, and the answer is usually better than people fear.
The domain decides everything. Workspace ownership is proven through control of the domain. If the domain is registered to your company, you can recover super administrator access through Google with proof, even without the supplier. If the supplier holds the domain, that becomes the negotiation rather than the Workspace itself.
Check the billing relationship. A Workspace billed directly to your company differs from one resold through a partner agreement. The second needs the subscription transferring rather than a password changing.
Audit before changing. Which accounts exist, who holds super administrator, what is shared externally, whether files sit in personal drives, and what retention is configured. Document the inherited state first, because afterwards you cannot distinguish what was theirs from what is yours.
Then remove, in order. Secure your own super administrator access first. Only then remove the supplier’s accounts, any partner relationship you did not agree, and accounts for departed staff.
The preventative version is free and we set every engagement up this way: your domain, your Workspace, your super administrator account, suppliers given access rather than ownership. A supplier who insists on holding ownership of a client’s Workspace is worth declining.
It is what proves ownership of the Workspace. Registered to your company means recovery is slow but certain, with or without the supplier.
Accounts, administrators, external sharing, personal drives, retention. Capture the inherited state while you can still tell what it was.
Your own super administrator account before removing anyone else’s. Doing it in the other order can lock you out of your own Workspace.
In short
Five things that cost nothing at the start and are awkward afterwards.
If you take one thing from this page on Google Workspace in Dubai, make it these. Each is a decision rather than a task, and each is far harder to revisit once a year of files and habits has accumulated on top of it.
Shared drives, not personal drives, for anything the company owns. This single choice prevents the data loss that otherwise follows every departure, and retrofitting it means moving thousands of files and breaking the links people saved.
The domain in your company’s name, because it is what proves ownership of the Workspace and determines whether you can ever leave a supplier without a negotiation.
Two step verification enforced from the start, because adding it later means asking everybody to change something at once, which is how it ends up switched off again.
The sharing policy set deliberately, rather than discovering two years in that anyone can publish a document to the open web and several people already have.
A named owner afterwards. Every finding in the audit section of this page exists because a project ended and nobody inherited the responsibility.
If the Workspace already exists and none of these were settled, that is the normal situation and all five remain correctable. It is simply more work than it would have been, which is the argument for an audit now rather than at the next crisis.
The one that genuinely cannot be undone is a file held in a personal account belonging to someone who has already left and will not respond. Google will not hand an administrator the contents of a personal account, and that is the correct policy even when it is inconvenient. Everything else on this list is recoverable with effort; that one is not, which is why the shared drive decision sits at the top rather than the bottom. Run the transfers while people are still employed, and the problem never arises.
Company files owned by the organisation, not by whoever made them. The decision that prevents the most expensive failure.
Ownership in the company’s name, suppliers given access instead. Free at the start, a negotiation later.
Enforced at the beginning, when it is simply how things are, rather than imposed later on people already settled.
An hour a month and somebody whose job it is. The absence of this is why audits find the same list everywhere.
Google Workspace in Dubai is the wrong choice if your work depends on complex Excel models, heavy Word formatting or a specific Microsoft application, Microsoft 365 is the better fit and nobody is served by arguing otherwise.
If you already run Workspace and it works, you need an audit and a maintenance routine rather than a migration. Suppliers propose moves because moves are projects.
If industry software your business depends on integrates with one platform and not the other, that usually settles it regardless of preference. Check before deciding rather than after.
And if the real problem is that nobody administers what you have, changing platform does not fix it. An unmanaged Workspace and an unmanaged Microsoft tenant decay identically.
One more case worth naming. If you are a very small team and everything genuinely works on free personal accounts, the honest answer is that the licensing cost buys you ownership, administrative control and a professional address rather than new capability. Those are worth paying for, and they are worth paying for knowingly rather than because a supplier said you needed a subscription. If you are two people and nothing is at risk, it can wait until the third person joins.
If you are unsure which applies, tell us what you run today and what is going wrong, and we will say plainly, including when the answer is to stay where you are. Our team works with businesses across Dubai and the wider UAE in Arabic and English, and a fixed written proposal follows within 45 minutes during business hours with no obligation.
From the blog

What a penetration test is, how it differs from a scan, what belongs in the scope, and why UAE law makes written authorisation essential.
Read the article
The Microsoft 365 settings a small UAE business should check first, based on Microsoft's own guidance, with what each one does.
Read the articleStraight answers
It depends on storage per user, whether you need advanced security and device management, and whether you require features like meeting recording or data regions. Google publishes a current edition comparison and the detail changes, so check it before committing rather than relying on a figure in a proposal.
Yes. Google provides migration tooling that copies mail, calendars and contacts before any routing change. The same rule applies as with any mail move: migrate first, change DNS second. Doing it the other way round is what causes gaps.
Some editions allow a data region to be set, which covers data at rest for core services with stated limits. Whether that satisfies a specific regulatory requirement is a question for your compliance adviser, and it should be settled before migration rather than after.
Yes. Docs, Sheets and Slides open and export Office formats, and files can be kept in their original format. Complex spreadsheets with heavy macros are where conversion problems appear, so test your own worst file before committing a finance team.
Yes, starting with an audit rather than changes: which accounts exist, who holds super administrator access, what sharing defaults are set, and whether licensing matches actual use. You get that as a written document whether or not anything follows.
Sources
Fixed price, in writing
Got it. Your quote is being written now.
In business hours you will have it within 45 minutes. Check your inbox for the confirmation.