Many organizations on Google Workspace assume that Microsoft’s identity, device management and endpoint protection are only for companies that moved to Microsoft 365. That’s a myth.
Microsoft sells a suite called Enterprise Mobility + Security (EMS) that was built for exactly this. It covers identity, device management, data protection and control over cloud apps, without Office and without mailboxes. Email and documents stay in Google; the security layer moves to Microsoft.
This article explains what the suite includes, how it also protects Google Workspace itself, what a typical rollout looks like, and why it costs less than four separate products.
What EMS includes
EMS is one suite that covers four areas you would usually buy from four different vendors:
| Area | EMS component | What it does |
|---|---|---|
| Identity | Microsoft Entra ID | Single sign-on (SSO) to every app, MFA and Conditional Access |
| Device management | Microsoft Intune | Manage Windows and Mac computers and phones, compliance policies and software installs |
| Data protection | Microsoft Purview Information Protection | Classify and encrypt files by sensitivity |
| Cloud apps (E5) | Microsoft Defender for Cloud Apps | Discover shadow IT and control what people do in SaaS apps |
From 1 July 2026, Microsoft also added Intune Plan 2, Remote Help and Advanced Analytics to the suite at no extra cost. What used to be a paid add-on is now part of the base suite.
Endpoint protection: one add-on completes the picture
Worth knowing: EMS doesn’t include endpoint protection (EDR). You add it with Microsoft Defender for Endpoint, or with Defender for Business for organizations of up to 300 users.
The advantage is that it connects straight into Intune. A computer’s risk level, as Defender sees it, becomes part of the compliance policy. A compromised computer is marked non-compliant automatically, and Conditional Access blocks it from apps, including Google Workspace.
Defender supports Windows, macOS, Linux, iOS and Android, so an organization with many Macs is fully covered too.
Zero Trust for Google Workspace too
When you connect Google Workspace and your other SaaS apps to Entra ID, every sign-in goes through Conditional Access. Each time, it checks who the user is, which device they’re on and how risky the sign-in is, and only then decides whether to allow it.
Checks you can apply to every app, including Gmail and Google Drive:
- MFA: multifactor authentication on every sign-in, or only under certain conditions.
- Phishing-resistant MFA: require a FIDO2 key, a passkey or Windows Hello for Business. Even an attacker with a stolen password and code can’t get in.
- Device compliance: access only from a computer that is managed in Intune, encrypted and up to date.
- Device risk: automatically block a device where Defender found a threat.
- User and sign-in risk (E5): block, or ask for more proof, when unusual behaviour is detected, such as a sign-in from an unexpected country.
The result is one access policy for all the organization’s apps, instead of separate settings in each system.
What a rollout looks like
A project like this runs in stages, so people’s day-to-day work isn’t disrupted:
- Connect your SaaS apps to Entra ID. Set up single sign-on (SSO) for all the organization’s apps and turn on Conditional Access, in report-only mode at first.
- Move Google Workspace sign-in to Entra ID gradually. Entra becomes Google’s identity provider. The move happens by user group, from a pilot group to the whole organization.
- Enroll devices in Intune. Windows and Mac computers are enrolled, with compliance, encryption and update policies.
- Add EDR. Defender is deployed through Intune, and the device’s risk level feeds the compliance policy.
- Tighten the access policy. Move Conditional Access from report-only to enforced: phishing-resistant MFA, a compliant device and risk-based blocking.
EMS E3 or EMS E5
For most organizations, E3 is enough to start. E5 fits when you also need automatic risk detection, admin privilege management and full control over cloud apps.
| Capability | EMS E3 | EMS E5 |
|---|---|---|
| List price (per user per month) | $12 | $18 |
| Entra ID: SSO, MFA and Conditional Access | Included | Included |
| Intune, including Plan 2 and Remote Help | Included | Included |
| Data classification and encryption | Manual | Also automatic |
| Conditional Access based on user and sign-in risk | No | Included |
| PIM: time-limited, approved admin rights | No | Included |
| Defender for Cloud Apps | No | Included |
E5 also includes Defender for Identity, but it mainly protects on-premises Active Directory. In an organization that runs fully in the cloud on Google Workspace, it adds little.
One suite instead of four products
The usual alternative is four products from four vendors: one for identity, one for device management, one for endpoint protection and one for cloud apps. EMS with Defender replaces all of them. The benefits go beyond price:
- One licence instead of four contracts, four renewals and four vendors to manage.
- Systems that talk to each other. Risk that Defender detects immediately affects access in Entra. Between different vendors’ products that takes integration work, and sometimes isn’t possible at all.
- One admin console, and a team that learns one system instead of four.
- One policy for every app, including Google Workspace.
In summary
An organization on Google Workspace can get Microsoft-level security without giving up Google. EMS with Defender gives you identity, device management, endpoint protection and control over cloud apps, in one suite and one Zero Trust policy.
At OnCloud we run the whole project: fitting the licensing, connecting Google Workspace and your SaaS apps to Entra ID, enrolling devices in Intune and deploying Defender. Want to check whether it fits your organization?