Company workspace setup: infrastructure on the company domain from day one

A workspace on the company domain makes mail, files, and accounts property of the company; a workspace on personal accounts makes them property of whoever created them.

A company's workspace tenant, the bundle of mail, files, calendar, and identity that work runs through, is infrastructure, and infrastructure decisions are cheap once and expensive daily. Setting it up on the company domain from day one is what makes the email, the documents, and the accounts property of the company rather than of whoever created them. The order of that sentence matters.

It starts with the domain: verified as the company's in the workspace admin, so every address the company issues belongs to a system it controls. Email on the company domain is the visible half; the invisible half is that identity, access, and every file's ownership chain run through the same verification. Verify the domain first, and everything afterward has an owner of record.

Then users named after people rather than shared logins: one account per person, real name, real role. A shared login cannot be granted, reviewed, or revoked, because it belongs to nobody and everybody at once. When each person has an identity, access becomes an admin decision with a start date and an end date, instead of a password forwarded between colleagues.

Ownership of files goes to the company account: documents created in a personal drive follow the person who made them, through departures and disputes and locked phones. Files created in company-owned storage stay put when people leave, and the company can hand a document from one owner to the next without asking anyone's permission. The file's home is the org chart, not a person.

Two-step verification goes on from the start, before there is an incident to wish it on: identity is the perimeter now, and a password alone is a door with the key under the mat. Recovery methods get set while nobody needs them, because recovery arranged during a lockout is recovery negotiated under pressure, and pressure is where companies lose accounts.

The last piece is a habit rather than a setting: offboarding access the day a person leaves. The admin reviews the account, the files transfer to a company owner, the sessions end. The retrofit is the expensive path: a year of business run through personal accounts turns the departure of one person into a negotiation, and negotiations over infrastructure are lost more often than won.

The honest limit: retention, security, and transfer features differ by provider, and those specifics belong to each provider's own documentation. Where we sit is the setup: our cloud-domains work verifies the company domain, names the users, and sets ownership so the company holds what it pays for. Guidance, not guarantees: infrastructure is judged on the day someone leaves, not the day it launched.