A 10-point Microsoft 365 checkup for small law firms
Most small firms set up Microsoft 365 years ago, added people and matters as they grew, and haven't looked at the settings since. That is normal. The settings that matter most for client confidentiality are not hard to check, and your IT provider can answer most of these questions in an afternoon. Here are ten worth asking about.
1. Is multifactor authentication on for everyone?
Not just partners, and not just "most people." Ask whether MFA is enforced through Microsoft's security defaults or Conditional Access policies, and whether anyone is excluded. Exclusions tend to accumulate quietly: a scanner account, a former assistant, a "temporary" exception. CISA's MFA guidance is a good plain-English starting point.
2. Are older sign-in methods blocked?
Legacy authentication (older mail protocols and clients) can't do MFA, so leaving it on can undo the protection in point 1. Microsoft's security defaults documentation explains what blocking it involves. Ask your IT provider to confirm nothing important, like a copier that emails scans, still depends on it before it's turned off.
3. How many people are Global Administrators?
The admin role can change anything in the tenant. It should belong to a small number of named people (often your IT provider), not a shared login and not every partner. Day-to-day work should happen from regular accounts, with admin accounts kept separate.
4. Is there an emergency access plan?
If the only admin account gets locked out, who can get back in? Microsoft recommends dedicated emergency access accounts that are tightly protected and rarely used. This is a short conversation with your IT provider, and one worth having before you need it.
5. Do former staff and contractors still have accounts?
Departures are easy to miss, especially for part-time staff, contract attorneys, and summer associates. Ask for a list of accounts that haven't signed in recently and a check that leavers are disabled promptly, and that their mailboxes and OneDrive files are handled under your retention policy.
6. Who outside the firm can reach your files?
SharePoint, OneDrive, and Teams make sharing with clients and co-counsel easy, which is the point. The question is whether old shares are cleaned up. Ask whether "Anyone with the link" sharing is allowed, how many guest accounts exist, and when they were last reviewed. Matter files shared with opposing counsel two years ago should not still be open.
7. Which apps have access to mail and documents?
Over time, staff click "Accept" on apps that ask to read mail, calendars, or files: scheduling tools, e-signature add-ins, PDF converters. Most are fine. Ask your IT provider for a list of apps with access to mail or files, and whether users can grant that access without an admin approving it.
8. Are mailboxes forwarding mail outside the firm?
Automatic forwarding to a personal or outside address is a quiet way for client communications to leave the firm, whether set up for convenience or by someone who shouldn't have access. Ask whether external auto-forwarding is allowed and whether any mailboxes currently use it.
9. Is audit logging on, and how long is it kept?
If something goes wrong, the audit log is how you find out what happened. Ask your IT provider to confirm auditing is turned on and how far back your current licensing lets you look. It is better to learn that answer now than during an incident.
10. Do you know which AI tools people are using?
Staff may already be using ChatGPT, Copilot, or AI features built into legal software. That isn't automatically a problem, but the firm should know which tools are in use, what client information goes into them, and what the terms say about that data. The ABA's Formal Opinion 512 is a helpful framing for the confidentiality and competence questions; check your state bar's guidance too.
What to do with the answers
You don't need to fix everything at once. Most firms find a few quick changes (MFA gaps, stale accounts, old shares) and a few things that need a plan. Write the answers down, agree on owners and dates with your IT provider, and revisit in six months.
About Switchback Cyber. If you'd like an independent second look, Switchback Cyber does fixed-scope, read-only reviews of a single Microsoft 365 tenant for small professional firms, with a prioritized plan your current IT provider can carry out. No managed-IT contract or tool purchase is involved. More at switchbackcyber.com.