SaaSCron: Platforms

GitHub vs GitLab SaaS: hosted plans, CI minutes, security and self-managed options

Ricardo Machado — Fri, 30 Oct 2026 21:00:00 GMT

You need a home for your team’s code, and the choice has narrowed to GitHub or GitLab. Both sell a hosted service you rent per user, the model explained in What is SaaS?, and both also sell software you can run on your own servers. The price per user is only part of your bill: CI minutes, security add-ons and where your data lives decide the rest.

This comparison uses the vendors’ own pricing and documentation pages, checked in October 2026. Both companies change plans often, so recheck every figure on the linked pages before you sign.

Hosted Git in plain terms

Think of a shared workshop. Everyone keeps their projects on labeled shelves, a bench in the corner tests anything you put on it, and a guard at the door checks what comes in. You pay rent per member, plus extra when the bench runs long.

Each part has a name:

Repository hosting is the shelves: Git repositories with access control, code review (pull requests on GitHub, merge requests on GitLab) and issues.
CI/CD (continuous integration and delivery) is the bench: jobs that build, test and deploy code on every change. GitHub calls its service Actions; GitLab meters runner time in compute minutes.
Security scanning is the guard: tools that look for vulnerable dependencies, leaked secrets and unsafe code.

Hosted plans side by side

Checked October 2026	GitHub	GitLab.com
Free	$0; 2,000 Actions minutes a month; 500 MB Packages storage	$0; 400 compute minutes a month; 10 GiB storage; 5 users per top-level group (private groups)
Middle tier	Team: $4 per user/month; 3,000 minutes; 2 GB Packages storage	Premium: $29 per user/month, billed annually; 10,000 minutes; 500 GiB
Top tier	Enterprise: $21 per user/month; 50,000 minutes; 50 GB Packages storage	Ultimate: custom price; 50,000 minutes; 500 GiB
Extra CI	Linux 2-core $0.006 a minute, Windows $0.010, macOS $0.062 (standard runners)	$10 per 1,000 compute minutes, one-time purchase
AI allowance in the plan	Copilot free tier up to 2,000 completions a month	Premium includes $12 of GitLab Credits per user/month; Ultimate $24

One caution on GitHub’s prices. Its pricing page shows Team at $4 and Enterprise at $21 with the words “for the first 12 months” and an asterisk whose terms were not shown on the page when checked. Ask GitHub for the price from month 13 before you budget past year one.

GitHub’s documentation adds that Actions is free on self-hosted runners and for public repositories using standard GitHub-hosted runners. You pay for minutes only on private repositories using GitHub’s machines.

Example: 20 developers for one year

Example: a team of 20 developers whose private-repository CI uses 8,000 Linux minutes a month. The calculation assumes each GitLab compute minute equals one Linux runner minute; confirm the rate for your runner type in GitLab’s documentation.

GitHub Team, at the listed first-year price:

Seats: 20 x $4 = $80 a month.
Minutes over the allowance: 8,000 - 3,000 = 5,000. At $0.006 a minute: 5,000 x $0.006 = $30.
Monthly total: $80 + $30 = $110. Yearly: $110 x 12 = $1,320.

GitHub Enterprise, same basis:

Seats: 20 x $21 = $420 a month. The 8,000 minutes fit inside the 50,000 included.
Yearly: $420 x 12 = $5,040.

GitLab Premium:

Seats: 20 x $29 = $580 a month. The 8,000 minutes fit inside the 10,000 included.
Yearly: $580 x 12 = $6,960.

Now move half the builds to macOS, for an iOS app, and assume the included minutes go to the Linux jobs. On GitHub Team, 4,000 Linux minutes are covered by the 3,000 included plus 1,000 x $0.006 = $6, and 4,000 macOS minutes cost 4,000 x $0.062 = $248. The monthly bill becomes $80 + $6 + $248 = $334, three times the Linux-only figure. The operating system of your builds can matter more than the seat price.

The seat prices are not a like-for-like comparison of features. Read the plan tables for the three or four features you actually need, and price those.

Security scanning

GitHub: Dependabot is listed on the Free plan. GitHub Secret Protection and GitHub Code Security are sold as add-ons; the pricing page did not list their prices when checked.
GitLab: its pricing FAQ says basic static analysis (SAST), secret detection and container scanning run on all tiers, while enterprise-grade scanning and vulnerability management are in Ultimate.

If security scanning is the reason you are choosing, get a written quote for the add-on or tier that carries it, since neither company lists every security price on the main pricing page.

Data residency and self-managed editions

Option	GitHub	GitLab
Shared (multi-tenant) SaaS	GitHub.com; GitHub describes Enterprise Cloud as “a multi-tenant enterprise SaaS solution on Microsoft Azure”	GitLab.com
SaaS with data in a chosen region	Enterprise Cloud with data residency, on its own GHE.com subdomain; regions listed: EU, Australia, US and Japan	GitLab Dedicated: single-tenant SaaS “hosted and maintained by GitLab” in the AWS region you choose
Self-managed	GitHub Enterprise Server, on your own hardware or cloud account	GitLab Self-Managed; the Free tier means “bring your own storage and runners”, Premium is $29 per user/month billed annually

Self-managed editions move upgrades, backups and uptime to your team. They make sense when a rule requires the code on your own infrastructure, not merely in a given country, because both vendors now sell hosted options with regional data. For the general trade-off, see SaaS vs on-premise software.

Common mistakes

Comparing seat prices only. In the example, macOS builds tripled the GitHub Team bill while the seat line stayed at $80. Why it happens: per-user prices lead the pricing page. Instead: estimate monthly CI minutes by operating system and add them to each option.
Budgeting the first-year price for three years. GitHub labels its Team and Enterprise prices “for the first 12 months”. Why it happens: the label is small. Instead: get the year-two price in writing before you compare.
Forgetting free-tier user limits. GitLab’s Free plan allows 5 users per top-level group for private groups, so a sixth developer forces a decision. Why it happens: the limit sits in the plan details, not the headline. Instead: count everyone who needs write access, including contractors.
Self-hosting for data location when a hosted regional option exists. You take on upgrades and backups to solve a problem the vendor already sells. Why it happens: the regional options sit on separate product pages. Instead: check GitHub’s data residency regions and GitLab Dedicated first, then decide. For how per-user licenses are counted in contracts, see SaaS licensing.

Sources

GitHub, Pricing, GitHub Actions billing and About GitHub Enterprise Cloud with data residency, checked October 2026.
GitLab, Pricing and GitLab Dedicated, checked October 2026.

In three sentences

GitHub and GitLab both rent hosted Git with CI/CD per user and sell self-managed editions, but their plans bundle CI minutes, storage and security very differently. For 20 developers using 8,000 Linux minutes a month, the listed prices give $1,320 a year on GitHub Team, $5,040 on GitHub Enterprise and $6,960 on GitLab Premium. Price your real CI minutes by operating system, get the year-two price in writing and check hosted regional options before you choose to run either one yourself.

SaaS on Azure: what Microsoft's cloud offers SaaS builders and buyers

Ricardo Machado — Mon, 26 Oct 2026 21:00:00 GMT

You searched for “Azure SaaS” and found three different things: Microsoft’s own apps, guides to building software on Azure, and a marketplace full of other companies’ products. You want to know which one applies to you. Azure, Microsoft’s cloud, mostly sells infrastructure and platform services that other companies build on. “Azure SaaS” usually means a software company running its product on Azure, selling it through Microsoft Marketplace, or both.

The difference decides who secures what and who takes a cut of your revenue. This guide covers where SaaS sits in Azure’s service models, Microsoft’s four tenancy models for SaaS builders, the Marketplace fee with the arithmetic, and a short comparison with AWS. For what SaaS is, see What is SaaS?. For the line between SaaS and the platforms it runs on, see SaaS vs PaaS.

Azure and SaaS in plain terms

Think of a shared commercial kitchen. The owner rents cooking stations to independent chefs, supplies the ovens and the power, and keeps the building safe. The owner also cooks a few dishes of its own under its own brand. At the front, a counter sells the tenants’ dishes to walk-in customers and keeps a small fee per sale.

Azure is the kitchen. Microsoft’s own dishes are Microsoft 365 and Dynamics 365, which are SaaS. The independent chefs are SaaS companies that rent compute and databases and sell their own applications. The front counter is Microsoft Marketplace.

Microsoft’s shared responsibility page (updated August 24, 2026) sorts its services the same way. Infrastructure as a service (IaaS) means you manage virtual machines, operating systems and applications. Platform as a service (PaaS) means you “deploy applications without managing VMs or operating systems”, with examples such as Azure App Service, Azure Functions and Azure SQL Database. SaaS means “You use ready-made applications”, with Microsoft 365 and Dynamics 365 as examples.

Who secures what

When you build a SaaS product on Azure PaaS, Microsoft’s responsibility matrix puts the operating system, physical hosts and datacenter on Microsoft’s side. Applications and network controls are shared. Customer data, configurations and identities stay with the customer in every model. The page adds: “For all cloud deployment types, you own your data and identities.”

For a SaaS company, the customer in that matrix is you. Your tenants’ data, your access rules and the way you keep tenants apart are your job, whatever Azure runs underneath.

Four ways to arrange tenants

A tenant is one customer of your SaaS product, usually a company and its users. Microsoft’s Azure Architecture Center separates the ideas: “SaaS is a business model”, while multitenancy “is a way of architecting a solution to share components between multiple tenants”. Its tenancy models guide names four common models. The last column is a rough match to the terms AWS uses, added for readers who know both clouds.

Azure model	What tenants share	Microsoft’s stated trade-off	Closest AWS term
Automated single-tenant deployments	Nothing: each tenant gets its own infrastructure	Strong isolation; low cost efficiency	Silo
Fully multitenant	Everything	Lowest cost; a change or failure can reach every tenant	Pool
Vertically partitioned	Most tenants share; some get dedicated deployments	Shared savings plus isolation where it is paid for; code must support both	Mixed tiers (pool and silo)
Horizontally partitioned	Shared application tier, separate components such as a database per tenant	Limits noisy neighbors on the heavy component	Between bridge and silo

Microsoft puts the cost of the first model bluntly: “If a single tenant requires a specific infrastructure cost, 100 tenants probably require 100 times that cost.” For the vertically partitioned model, Microsoft suggests cheaper shared resources for customers on a trial, and a higher rate for customers who want a single-tenant deployment.

Selling through Microsoft Marketplace

Microsoft Marketplace lets Azure customers buy your SaaS product with Microsoft billing them. Microsoft’s transact capabilities page (updated August 18, 2026) sets the rules:

Fee: “Microsoft charges a 3% standard store service fee when customers purchase your transact offer.” A 50% discount on that fee can apply to private offer renewals for qualifying customers.
Requirements for SaaS: the product “Must be a multitenant solution, use Microsoft Entra ID for authentication, and integrate with the SaaS Fulfillment APIs”.
Pricing models: flat rate, per user and usage-based, with metered billing on up to 30 custom dimensions per offer.
Infrastructure: your Azure costs are billed to you, not to the buyer, so they belong inside your price.
Terms: free trials of 1 to 180 days, and contract durations of up to five years.

Example: you sell a three-year SaaS contract worth $240,000 as a private offer.

Standard fee: $240,000 x 3% = $7,200, so you receive $240,000 - $7,200 = $232,800 before your own costs.
At renewal, with the 50% fee discount: 3% x 50% = 1.5%, so $240,000 x 1.5% = $3,600.
Microsoft’s own illustration: a $100.00 monthly license pays out $97.00, with $3.00 kept by Microsoft.

Azure and AWS, briefly

The two marketplaces start at the same rate for this deal and differ at the edges. AWS figures are from its listing fees page, checked October 17, 2026, and are covered in AWS SaaS.

Item	Microsoft Marketplace	AWS Marketplace
Standard SaaS fee	3%	3% public offer; private offers 3% under $1M
Large private offers	3% standard, unless otherwise specified	2% from $1M; 1.5% from $10M
Renewals	50% discount on the fee for qualifying private offer renewals	1.5%
Identity requirement for SaaS	Microsoft Entra ID	Not part of the fee page
Tenancy guidance names	Single-tenant, fully multitenant, vertical, horizontal	Silo, bridge, pool

On a $1,200,000 private offer, the standard rates give $1,200,000 x 3% = $36,000 at Microsoft and $1,200,000 x 2% = $24,000 at AWS. Large deals can carry negotiated terms, so model your own case with the current pages.

If your buyers already run Microsoft 365, Entra ID sign-in is one less integration for them; see Microsoft 365 as SaaS.

Common mistakes

Calling a product SaaS because it runs on Azure. Software installed on the buyer’s own Azure virtual machines is still software the buyer runs. Why it happens: “cloud” covers both. Instead: ask who operates the application and whether the buyer only signs in.
Assuming Microsoft secures your tenants. Data, identities and configuration stay with you in every model. Why it happens: a large provider feels like a guarantee. Instead: write down which controls are yours and who owns each one.
Leaving Azure costs out of the Marketplace price. For SaaS offers, infrastructure is billed to you, not to the buyer. Why it happens: on other offer types the buyer pays the Azure bill. Instead: price the license to cover hosting, the 3% fee and margin.
Choosing single-tenant deployments for everyone. Cost grows with each tenant, and every deployment needs updates. Why it happens: full isolation is the easiest answer to a security questionnaire. Instead: share by default and sell dedicated deployments as a paid tier.

Sources

Microsoft Learn, Shared responsibility in the cloud, updated August 24, 2026, checked October 17, 2026.
Microsoft Learn, SaaS and multitenant solution architecture and Tenancy models for a multitenant solution, checked October 17, 2026.
Microsoft Learn, Microsoft Marketplace transact capabilities, checked October 17, 2026.
AWS, Listing fees for AWS Marketplace sellers, effective January 5, 2024, checked October 17, 2026.

In three sentences

Azure mostly sells infrastructure and platform services, and “Azure SaaS” usually means a SaaS company that runs its product on Azure, sells it through Microsoft Marketplace, or both. Microsoft describes four tenancy models, from a dedicated deployment per tenant to fully shared, and you keep responsibility for data, identities and tenant isolation in all of them. Marketplace SaaS offers pay a 3% standard fee, so a $240,000 private offer pays $7,200, and the product must be multitenant, use Entra ID and integrate the SaaS Fulfillment APIs.

AWS SaaS: what it means and how SaaS companies use AWS

Ricardo Machado — Tue, 20 Oct 2026 11:00:00 GMT

You searched for “AWS SaaS” and found three different things: SaaS products sold on AWS Marketplace, advice on building SaaS on AWS, and AWS services that sound like SaaS. You want to know which one applies to your situation. AWS (Amazon Web Services) mostly sells infrastructure and platform services: servers, storage, databases and managed building blocks that other companies run their own software on. “AWS SaaS” usually means a software company running its SaaS product on AWS, selling it through AWS Marketplace, or both.

The difference matters because it decides who is responsible for what, and who takes a cut of the revenue. This guide covers the responsibility split, the three ways SaaS companies separate customers on AWS, and the fees AWS Marketplace charges sellers. For what SaaS is, see What is SaaS?. For the line between SaaS and the platforms it runs on, see SaaS vs PaaS.

AWS and SaaS in plain terms

Think of a shopping mall. The mall owner builds the floors, supplies the power and keeps guards at the entrances. Shops rent units and sell their own goods to their own customers. The owner also runs a directory with a shared checkout, and takes a small fee on every sale made through it.

AWS is the mall owner. A SaaS company is a shop: it rents compute and storage, puts its application on top and sells subscriptions. AWS Marketplace is the directory with the checkout.

In the terms of the US National Institute of Standards and Technology (NIST), what a SaaS company rents from AWS is infrastructure or platform. With platform as a service, you “deploy onto the cloud infrastructure consumer-created or acquired applications” and keep “control over the deployed applications” (NIST SP 800-145). A SaaS company does exactly that, then sells the finished application to its own customers.

Who secures what

AWS splits security in two in its shared responsibility model. AWS is responsible for “security of the cloud”: the infrastructure “that runs all of the services offered in the AWS Cloud”, meaning hardware, software, networking and facilities. The customer is responsible for “security in the cloud”, which is “determined by the AWS Cloud services that a customer selects”.

For a SaaS company, the customer in that sentence is you. Your application, your tenant isolation, your access rules and your customers’ data are on your side of the line. Your customers hold you to account for all of it, whatever runs underneath.

Three ways to separate tenants

A SaaS product serves many customers, called tenants, from one system. AWS’s Guidance for Multi-Tenant Architectures describes three database models:

Model	What tenants share	How data is kept apart	Isolation	Cost and complexity
Silo	Nothing: each tenant gets its own application stack and database instance	Separate database instance per tenant	Strongest	Highest
Bridge	The application stack and the database instance	A dedicated schema per tenant	Middle	Middle
Pool	Everything, including the tables	Row-level security in the database	Least	Lowest

The isolation and cost columns follow AWS’s own wording: the silo model “provides the strongest tenant isolation but incurs the most cost and complexity”, and the pool model “offers the least tenant isolation but costs the least”.

You do not have to pick one model for everyone. AWS’s SaaS Architecture Fundamentals whitepaper, now marked for historical reference, describes basic-tier tenants in a shared pool and premium-tier tenants in their own stacks. It adds a condition: every silo must run the same configuration and the same software version, with no one-off customization. Without that rule, each premium customer becomes a separate product to maintain.

Selling through AWS Marketplace

AWS Marketplace is a catalog where AWS customers can buy your SaaS product, with AWS billing them. AWS lists four SaaS pricing models: subscriptions billed on hourly usage, contracts billed in advance or on a flexible schedule, contracts with an extra metered rate for usage above the contract, and free.

AWS charges sellers a listing fee on the pre-tax total contract value. The rates below have applied since January 5, 2024:

Offer type	Listing fee
SaaS public offer	3%
Server products (machine images, containers, machine learning), public offer	20%
Private offer under $1M	3%
Private offer from $1M to under $10M	2%
Private offer of $10M or more	1.5%
Private offer renewal	1.5%
Through a channel partner	0.5% added to the rate

A regional fee of 1% is added for buyers in South Korea, effective April 1, 2025.

Example: you sell a three-year SaaS contract worth $240,000 as a private offer.

Listing fee: $240,000 x 3% = $7,200, so you keep $240,000 - $7,200 = $232,800 before your own costs.
The same deal sold through a channel partner: 3% + 0.5% = 3.5%, so $240,000 x 3.5% = $8,400.
A private offer renewal at the same value: $240,000 x 1.5% = $3,600.
A $1,200,000 private offer falls in the 2% band: $1,200,000 x 2% = $24,000.

For comparison, a public SaaS listing at $100,000 of contract value pays $3,000, while a server product at the same value pays $20,000. Put the fee in your margin model before you set a price for the Marketplace.

Common mistakes

Calling a product SaaS because it runs on AWS. Software you install and operate on your own AWS servers is still software you run. Why it happens: “cloud” is used for both. Instead: ask who runs the application and whether the buyer only logs in.
Assuming AWS secures the application. AWS covers “security of the cloud”; your code, tenant isolation and data sit on your side. Why it happens: a large provider feels like a security guarantee. Instead: write down which controls are yours and who owns each one.
Choosing one tenant model for every customer. Silo for everyone multiplies cost; pool for everyone may fail a buyer’s isolation requirement. Why it happens: one model is simpler to build first. Instead: match the model to the tier, and keep every silo on the same version.
Leaving the Marketplace fee out of the price. On a $240,000 channel deal the fee is $8,400. Why it happens: the fee arrives later, on a separate listing-fee invoice, not on the price you quote. Instead: model the fee for each offer type, including the channel uplift.

If your SaaS product lets customers use their own domains, see Cloudflare for SaaS for one way to handle it. For how SaaS fits into the wider cloud models, see SaaS in cloud computing.

Sources

AWS, Shared responsibility model, checked October 2026.
AWS, Guidance for Multi-Tenant Architectures on AWS and SaaS Architecture Fundamentals: full stack silo and pool, checked October 2026.
AWS Marketplace Seller Guide, SaaS product pricing and listing fees, checked October 2026.
NIST, SP 800-145, September 2011.

In three sentences

AWS mostly sells infrastructure and platform services, and “AWS SaaS” usually means a SaaS company that runs its product on AWS, sells it through AWS Marketplace, or both. On AWS you choose how to separate tenants, from a silo per tenant (strongest isolation, highest cost) to a shared pool (least isolation, lowest cost). Marketplace sales carry a listing fee of 1.5% to 3% for SaaS offers, plus 0.5% through a channel partner, so a $240,000 private offer pays $7,200.

Microsoft 365 as SaaS: what Microsoft runs and what admins must secure

Ricardo Machado — Sat, 17 Oct 2026 11:00:00 GMT

You have just been given the admin password for your company’s Microsoft 365 account, and nobody explained what is now your job and what Microsoft does for you. The short version: Microsoft 365 is SaaS, so Microsoft runs the data centers, servers, software and network. You own the users, the settings and the data, and most problems that make the news start on your side of that line.

This guide shows the split in a table, works through the two limits that catch new admins (the 300-seat cap and the deletion windows) and ends with a ten-point checklist for your first week. For the general idea of SaaS and “who manages what”, see What is SaaS?. If your company also weighs Google’s suite, the same questions are answered for it in Google Workspace as SaaS.

Microsoft 365 in plain terms

Think of a hotel. The hotel keeps the building standing, the lights on, the lifts working and the doors locked at night. You decide who gets a key card to your room, what goes into the safe and whether you leave the door open for a friend. If you hand a key card to the wrong person, the hotel’s security guard cannot help.

Microsoft 365 is the hotel. Your organization’s space in it is called a tenant: one account that holds your users, mailboxes, files and settings, separated from every other customer on the same system. The admin (administrator) is the person who manages that tenant, and Microsoft 365’s identity service, Microsoft Entra ID, is where the key cards are issued.

What Microsoft runs and what you own

Microsoft publishes a shared responsibility matrix that names Microsoft 365 as its SaaS example. The table below takes its SaaS column and adds what each row means in a Microsoft 365 tenant.

Area	Who is responsible	What it means for your tenant
Customer data	You	What is stored, who it is shared with, how long it is kept
Configurations and settings	You	Sharing defaults, mail rules, retention, guest access
Identities and users	You	Accounts, passwords, multifactor authentication, admin roles
Client devices	Shared	Microsoft offers device management; you protect the laptops and phones
Applications	Shared	Microsoft runs the apps; you configure them and control access
Network, operating systems, hosts, data centers	Microsoft	Nothing for you to patch

Microsoft’s own wording is short: “For all cloud deployment types, you own your data and identities.” The three rows marked “You” are where an admin’s time goes.

Deleted data is the area most often misunderstood. Exchange Online keeps a deleted user’s mailbox for 30 days before permanent deletion (Microsoft Learn). SharePoint and OneDrive keep deleted items for 93 days across both recycle bins (Microsoft Learn). These are recovery windows, not backups. If you need a file from six months ago, those windows do not help.

The business plans and their limits

Microsoft sells three main business plans, from the smallest to the largest: Business Basic, Business Standard and Business Premium. The main differences, per Microsoft’s plan options page: Basic has the web versions of the apps only, and Standard adds the desktop apps. Premium adds security and device management features such as Azure Information Protection. Each step up costs more per user per month.

Prices change. Microsoft announced on December 4, 2025, that new list prices would take effect on July 1, 2026. Check Microsoft’s current price list for your country before you budget, and price each plan per user per month, paid yearly.

You can mix plans in one tenant: Premium for the people who handle money and admin rights, Standard or Basic for everyone else. The limit is the size of the whole Business family. Microsoft says the business plans “are designed for organizations with up to 300 users,” and that it may enforce “the tenant limit of 300 provisioned licenses across the Business family of plans.”

Example: your company has 220 employees on Business Standard. You want Premium for 60 of them in finance, HR and IT.

Moving 60 people from Standard to Premium changes the plan mix, not the seat count: 160 Standard + 60 Premium = 220 seats.
Room left in the Business family: 300 - 220 = 80 seats.
If you plan to hire 40 people next year, you reach 220 + 40 = 260 seats, still inside the cap.
If you plan to hire 100, you need 320 seats. That is 20 above the cap, so you plan a move to the enterprise plans, which have no user limit, before the hiring starts.

Microsoft’s own example on the same page is the shortcut: with 250 Premium seats, you can add only 50 more seats across all Business plans.

Example: the deletion windows, on a calendar. An employee leaves, and you delete their account on March 2, 2026. On the same day a colleague deletes a project folder from a SharePoint site by mistake.

The leaver’s mailbox can be restored for 30 days: until April 1, 2026.
The deleted folder can be restored for 93 days: 29 days to the end of March, 30 in April and 31 in May make 90, so until June 3, 2026.
After those dates, without a retention policy or a separate backup, the data is gone.

Checklist for your first week as admin

Microsoft’s security defaults page is the source for the first four items.

Check that security defaults are on, or that Conditional Access policies replace them. Security defaults require every user to register for multifactor authentication and block legacy authentication protocols.
Create two cloud-only emergency access accounts with the Global Administrator role, as Microsoft recommends, and store their credentials offline.
Give admins a separate admin account for admin work and a normal account for email and documents.
Count your Global Administrators. Give everyone else the narrowest admin role that does the job.
Review the external sharing setting for SharePoint and OneDrive, and choose who outside the company can receive links.
Review guest users and remove the ones who no longer work with you.
Write an offboarding procedure that saves a leaver’s mail and files before the 30-day mailbox window closes.
Decide in writing whether you need a backup beyond the recycle bins, and who owns it.
Confirm the audit log is searchable and that someone knows how to search it.
Put the renewal date, the number of licenses and the distance to the 300-seat cap on a calendar, so the plan mix is reviewed before each renewal.

Common mistakes

Assuming Microsoft backs up your data indefinitely. Microsoft keeps deleted mailboxes for 30 days and deleted SharePoint and OneDrive items for 93 days. Why it happens: “it’s in the cloud” sounds like “it’s safe forever”. Instead: decide on retention policies or a separate backup, and test a restore.
One shared admin account. If its password leaks, every setting in the tenant is exposed, and you cannot tell who did what. Why it happens: it was set up that way on day one. Instead: named admin accounts with multifactor authentication, plus the two emergency accounts.
Turning off security defaults without a replacement. Microsoft’s page says organizations that disable them “should immediately enable Conditional Access policies.” Why it happens: an old printer or app stops working. Instead: fix or replace the legacy client, or move to Conditional Access first.
Buying one plan for everybody by habit. A mix of plans can cost less with the same protection where it matters. Why it happens: one plan is simpler to buy. Instead: price the mix from Microsoft’s current price list at each renewal, and count the seats left under the 300 cap.

Sources

Microsoft, Shared responsibility in the cloud, checked October 2026.
Microsoft, Microsoft 365 and Office 365 plan options, checked October 2026.
Microsoft, Advancing Microsoft 365: new capabilities and pricing update, December 4, 2025.
Microsoft, Microsoft 365 business plans and pricing (current price list; prices not quoted here).
Microsoft, Delete or restore user mailboxes in Exchange Online and Security defaults in Microsoft Entra ID, checked October 2026.

In three sentences

Microsoft 365 is SaaS: Microsoft runs the infrastructure and the applications, and you own the data, the settings and the user accounts. Deleted mailboxes are kept for 30 days and deleted SharePoint and OneDrive items for 93 days, which are recovery windows and not backups. You can mix Basic, Standard and Premium in one tenant, but the whole Business family is capped at 300 seats, so plan the move to enterprise plans before you hire past it.

Google Workspace as SaaS: editions, admin controls and security explained

Ricardo Machado — Fri, 16 Oct 2026 15:00:00 GMT

You were made the Google Workspace admin of a 15-person company last week, and nobody told you what you are now responsible for. The short answer: Google runs the service, you run the company’s use of it, and the second job is larger than it looks. This guide shows the split, what each edition costs for your 15 users, and the ten settings to check first.

Google Workspace is the textbook case of software as a service: Gmail, Drive, Docs, Meet and Calendar run on Google’s servers, you use them in a browser, and you pay per user per month. If that model is new to you, What is SaaS? explains it with the same product as one of its examples.

The admin role in plain terms

Think of a serviced office. The landlord keeps the building standing: power, lifts, locks on the front door, cleaning at night. You decide who gets a key, which rooms are shared, what happens to a desk when someone leaves, and whether the meeting room is visible from the street. If a visitor walks out with a folder, the landlord’s locks were fine; the problem was who you gave the key to.

That is the Workspace admin role. Google is the landlord. The Admin console is your key cabinet. Almost every Workspace incident in a small company is a key problem, not a building problem: a file shared with “anyone with the link”, a leaver whose account was never closed, an admin password with no second factor.

What each edition includes, and what 15 users cost

Google sells three Business editions for organizations of up to 300 users, and Enterprise editions above that or for extra controls. The prices below are Google’s US list prices per user per month for the Annual/Fixed-Term Plan and the Flexible Plan, from Google’s billing help page, checked October 2026. The pricing page may show a time-limited introductory discount for new customers; the list prices are what applies afterward. Storage, participants and Vault from Google’s Business editions help page.

Edition	Annual plan	Flexible plan	What you get
Business Starter	$7	$8.40	30 GB pooled storage per user, Meet for up to 100 participants, Gemini app
Business Standard	$14	$16.80	2 TB pooled storage per user, Meet for up to 150 participants, Gemini in Gmail, Docs and Meet
Business Plus	$22	$26.40	5 TB pooled storage per user, Meet for up to 500 participants, Vault for retention and eDiscovery
Enterprise	Contact sales	Contact sales	Larger storage, more participants, more security and compliance controls

Example: 15 users, Annual/Fixed-Term Plan, list price, taxes excluded.

Business Starter: 15 x $7 = $105 a month, or $1,260 a year.
Business Standard: 15 x $14 = $210 a month, or $2,520 a year.
Business Plus: 15 x $22 = $330 a month, or $3,960 a year.

On the Flexible Plan the same three numbers are $126, $252 and $396 a month, which is 20% more, in exchange for adding and removing users at any time without a yearly commitment. For a 15-person company the step that matters most is Starter to Standard: $105 more a month buys 2 TB per user instead of 30 GB and larger meetings. The step to Plus is mostly about Vault, which lets you keep and search a leaver’s email and files for legal or compliance reasons.

Who is responsible for what

The table splits seven areas three ways: Google, you as admin, and the individual user. It is built from Google’s Admin Help pages linked below and from the general SaaS responsibility split in What is SaaS?.

Area	Google	You, the admin	The user
Hosting and uptime	Runs the service; commits to 99.9% monthly uptime in its SLA	Nothing	Nothing
Updates	Ships them to everyone	Reads release notes; turns new features on or off per organizational unit	Nothing
Backups	Keeps the platform recoverable	Exports or transfers data before deleting a user; sets retention in Vault (Plus and above)	Restores own files from Drive trash within 30 days
Retention after someone leaves	Keeps a deleted user’s data for 20 days, then deletes it permanently	Transfers Drive and Calendar ownership before deletion, or suspends instead of deleting	Nothing
Sharing	Provides the controls	Sets the default link access and whether files can leave the organization	Chooses who to share each file with, within your limits
Identity	Provides sign-in, 2-Step Verification, passkeys	Enforces 2-Step Verification; assigns admin roles; removes leavers	Enrolls a second factor; keeps recovery info current
Devices	Provides endpoint management	Decides which devices can access company data and whether to wipe lost ones	Keeps the device locked and updated

Three facts in that table come straight from Google’s documentation. Files in Drive trash “are deleted forever after 30 days” (Drive Help). A deleted user account can be restored “for up to 20 days”, and data owned solely by that user that was not transferred first “is permanently deleted” (Admin Help). And Google itself is enforcing 2-Step Verification for administrator accounts (Admin Help). All three checked October 2026.

Checklist

Ten settings for a company of 10 to 50 people, in the order to do them. Each one is in the Admin console; the paths are from Google’s Admin Help as of October 2026.

Make two admins, not one, and never share the login. Google’s advice and the 20-day rule both assume an admin is available. A single shared admin account is one lost phone away from a locked company.
Enforce 2-Step Verification for everyone. Security > Authentication > 2-step verification: allow it, then set Enforcement to On, with a new-user enrollment period (Google allows one day to six months) so new hires can sign in on day one. Google’s page notes that enforcement from a chosen date “will start within 24-48 hours”, so use On if you need a precise start.
Prefer phone prompts or security keys over text messages. The same page offers “Any except verification codes via text, phone call”. Warn users before you switch it on, or they can be locked out.
Set the default access for new files to named people only. In Drive’s sharing dialog this level is called “Restricted”; the organization-wide default sits next to the external sharing settings in the Admin console. Users can still open a file up; they should have to decide to.
Decide whether files can leave the organization. Apps > Google Workspace > Drive and Docs > Sharing settings. Off blocks all external sharing; “allowlisted domains” limits it to partners you name. If you allow it, turn on the external indicator so users see a warning.
Suspend leavers the day they leave, then transfer and delete within 20 days. Suspension keeps the data and the license; deletion without transfer loses the data after 20 days.
Turn on Vault if you are on Business Plus or above, and set a retention rule. Without it, a deleted email is gone when the user empties the trash.
Review third-party apps with access to company data. The Admin console lists them under its security settings (API controls). Every “Sign in with Google” an employee accepted is an app that can read something.
Set recovery options for every account and check them twice a year. The account you cannot recover is the one you will need on a Friday evening.
Read the Admin console alerts and the Drive audit log once a month. Google logs external sharing events even when the warning indicator is off; the log is where you find the folder that has been public since March.

What changed recently

A dated note for buyers. SaaSCron updates it when Google announces a change that affects what the editions include or cost.

January 15, 2025: Google included Gemini and NotebookLM Plus in the Business and Enterprise plans with no add-on, and raised Business Standard from $12 to $14 per user per month. Existing customers moved to the new prices from March 17, 2025, or at renewal for annual plans, whichever came later; very small businesses moved from July 7, 2025 (Google announcement).
February 15, 2023: Google introduced the Annual Plan as a self-serve option and raised Flexible Plan prices by 20% (Business Starter from $6 to $7.20 at the time), with subscriptions of 10 or fewer users exempt until January 2024 (Google announcement).

Common mistakes

Assuming Google keeps deleted files forever. Drive trash empties after 30 days; a deleted user’s data is gone after 20. Why it happens: “it’s in Google’s cloud” sounds like a backup. Instead: suspend rather than delete, transfer ownership before deleting, and use Vault or an export if you must keep records for years.
Leaving “anyone with the link” as the default. It is the most convenient setting and the most common leak. Why it happens: nobody changed the default. Instead: set new files to Restricted and let users widen access on purpose.
Running the company on one shared admin account. Lose the phone with its second factor and nobody can change anything. Why it happens: the person who set up Workspace was in a hurry. Instead: two named super admins with 2-Step Verification, and the day-to-day work done from a normal account.
Buying Business Plus for the storage when Vault was the reason. Standard’s 2 TB per user is more than a 15-person company typically fills. Why it happens: the edition table leads with storage. Instead: choose the edition for the control you need (retention and eDiscovery with Vault, or the larger meetings), not for the number of terabytes.

Sources

Google Admin Help: Compare Flexible and Annual/Fixed-Term payment plans; Business editions; Delete or remove a user from your organization; Deploy 2-Step Verification; Manage external sharing for your organization. All checked October 2026.
Google Drive Help, Delete and restore files in Google Drive, checked October 2026.
Google, Google Workspace Service Level Agreement, checked October 2026.
Google Workspace blog, announcements of January 15, 2025 and February 15, 2023.

In three sentences

Google runs Workspace and promises 99.9% monthly uptime, but who can see a file, who still has an account and whether the admin has a second factor are your decisions. The three Business editions cost $7, $14 and $22 per user per month on an annual plan, so 15 users pay $105, $210 or $330 a month, and the step up is about controls like Vault more than about storage. Do the ten checklist items in the first week, because Drive trash empties after 30 days, a deleted user’s data is gone after 20, and the default sharing setting is the most common leak.