Microsoft 365 can contain client correspondence, calendars, documents, shared mailboxes and internal collaboration. For a law firm, these configuration choices directly affect confidentiality and continuity. The right review focuses on a handful of consequential decisions.
Confirm account ownership and privileged access
Ask for a current list of users, external guests, administrators and privileged service accounts. Verify appropriate multifactor authentication, staff offboarding and review of third-party application permissions. Separate routine daily work from privileged administration and clarify who approves exceptions.
Review how the firm shares client files
Map common workflows with clients, co-counsel, experts and vendors. Understand the default settings for external sharing links, guest access and site creation. Evaluate whether confidential matters are separated appropriately and whether access can be revoked when a matter closes or a relationship ends.
Treat email compromise as a workflow issue
Technical controls reduce risk, but partners also need policies for payment changes, confidential attachments and suspicious requests. Review mailbox forwarding, suspicious sign-in monitoring, administrative changes and escalation procedures. Staff should verify sensitive requests over a known independent channel.
Understand retention and recovery separately
Retention, legal preservation, version history, Microsoft service availability and tested backups are not identical concepts. Ask which information is preserved, who can restore it, how long recovery might take and how test results are documented. Coordinate retention requirements with responsible legal counsel.
Make AI and Copilot an intentional choice
Before expanding AI features, confirm data access, sharing permissions, approved use cases and the conditions for client information. Tools can surface information a user already has access to; poor permissions remain a business risk even when the AI technology itself works correctly.
Action for managing partners: request a one-page Microsoft 365 security and resilience briefing from your provider. It should identify the top material gaps, evidence of current controls, accountable owners and a realistic priority list.
Bring the issue to Cyber Virtues
Learn about law firm IT and cybersecurity advisory, or discuss a specific concern.