Managed Google Workspace: What DACH SMEs Actually Get

Managed Google Workspace: What DACH SMEs Actually Get

Most Google Workspace tenants in the German Mittelstand were set up in one afternoon by whoever knew the most about computers that day. Then everyone went back to work. Three years later, managed Google Workspace sounds like an upgrade — but nobody is sure what it would change. This post maps the difference: what an unmanaged tenant looks like in practice, what a managed service covers, and what the numbers say for a 10 to 50 person company.

The Default State of Most Workspace Tenants

An unmanaged tenant is not broken. It works, mostly, and that is the problem — the failures are quiet.

Typical findings from tenant audits we run:

• The super admin account belongs to an employee who left 14 months ago. Nobody changed the password.
• Two-factor authentication is available but not enforced. Half the team never turned it on.
• Every user is on Business Standard because someone picked a plan once. Two people need 2 TB of storage; eighteen do not.
• Offboarding is a calendar reminder, not a process. Former employees keep Drive access for weeks.
• No Auftragsverarbeitungsvertrag (AVV) is on file for third-party Workspace add-ons installed over the years.

None of this shows up until something goes wrong: a phishing incident, a DSGVO request, a surprise storage bill. A managed Google Workspace engagement starts by making this state visible, then fixing it in a defined order.

What a Managed Service Actually Covers

“Managed” is not a password reset desk. A serious managed Google workspace service covers four areas on a standing basis.

1. Tenant architecture. Organizational units, groups, and shared drives structured so permissions are assignable in bulk instead of one user at a time. Done once, correctly, this removes most day-two admin work.

2. User lifecycle. Onboarding a new hire becomes a checklist: account, groups, Drive, signature, calendar, aliases — provisioned the same way every time. Offboarding is the mirror image, with access revoked the same day and mailbox data handed to a successor. This is the single highest-value piece for SMEs hiring or losing people regularly.

3. Security baseline. Enforced MFA, context-aware access rules, blocked less-secure apps, admin roles split so no daily user holds super admin, and recovery paths documented. The goal is that a stolen laptop password buys an attacker almost nothing.

4. Compliance and cost. Retention rules that match your obligations, an AVV set for every processor touching tenant data, audit logging turned on, and license assignments reviewed quarterly so you are not paying Business Plus rates for accounts that read email twice a week.

If your current arrangement cannot answer “what happens to a leaver’s Drive files on their last day” in one sentence, you do not have a managed tenant. You have a shared admin password.

The Numbers: Managed Service vs. In-House Admin

A full-time IT administrator in Germany costs roughly €55,000 to €70,000 per year loaded. A 25-person SME needs perhaps four to six hours of actual Workspace administration per week. Hiring full-time for that workload means paying for capacity you use at 15 percent.

The alternative spread across the market:

• Do nothing: Google license fees only (Business plans run roughly $7 to $22 per user per month), plus the unpriced risk of the audit findings above.
• Part-time internal admin: one interested employee spends a day a week on it. Cheap on paper, fragile in practice — that person takes the knowledge when they leave, and it was never their job.
• Managed service: a fixed monthly fee for a defined scope. Our managed Google Workspace tiers run €129 to €449 per month plus a per-user component, with the security baseline and lifecycle process included from the Standard tier up.

For a 25-person company, a managed tier typically lands between €600 and €1,100 per month all-in. That is roughly a fifth of a junior admin salary, with no recruiting, no vacation coverage, and no single point of failure. The detailed tier breakdown is on the managed Google Workspace service page and in our pricing.

DSGVO, NIS2, and the Audit Question

Compliance is where unmanaged tenants hurt most, because German SMEs are not exempt from the paperwork.

Two examples. A DSGVO data access request has a one-month deadline. Answering it in an unmanaged tenant means manually searching a user’s Mail, Drive, and Chat history; in a managed tenant with Vault configured, it is an export job. Second: NIS2 now reaches many Mittelstand suppliers through contractual flow-down from critical operators. If you cannot produce access logs, offboarding records, and MFA enforcement evidence on request, you fail the audit before it starts.

Managed does not mean “certified compliant” — that still depends on how you run your business. It means the Workspace-side evidence exists and is retrievable, which is the part companies consistently lose.

What a Handover Looks Like

A recent engagement, anonymized: a 24-person machine engineering firm, Workspace running since 2021, admin shared between the office manager and a developer.

The audit took half a day and found three ex-employee accounts still active, super admin held by a daily user, no enforced MFA, and 22 of 24 licenses on the same plan regardless of need. The remediation ran two weeks alongside normal work: tenant restructure into organizational units, leaver accounts closed with data transferred to successors, MFA enforced with a grace period, admin roles split, licenses right-sized. Monthly cost ended below what they had been paying for storage overage alone.

Nothing in that list required new software. It required someone whose job it was to look.

When Managed Workspace Pays Off — A Checklist

Managed Google Workspace is not for everyone. It pays off when three or more of these are true:

• More than 10 users, or hiring more than one person per quarter
• Nobody can name the person responsible for the admin console
• DSGVO, NIS2 flow-down, or customer security questionnaires appear in your sales process
• A leaver’s account has ever stayed active for more than a week
• License costs have never been reviewed since signup
• You are migrating from another mail system and want the structure right the first time

Below three items, spend an afternoon on the security basics and revisit in a year. At three or more, the audit-and-baseline path is cheaper than the status quo.

The Takeaway

Unmanaged Workspace fails quietly: orphaned accounts, unenforced MFA, and compliance evidence that does not exist. Managed Google Workspace turns that into a defined process with a fixed price. See what the managed tiers include.