Microsoft 365 for Law Firms: Settings to Turn On First

Most law firms we take over are already on Microsoft 365. The licenses are paid, email works, and SharePoint holds a decade of matter files. What is almost never done is the configuration work after the migration. Microsoft ships the platform in a state designed to not break anyone’s workflow on day one, which is a different goal from protecting privileged client information.

The list below is the order we work through on a new firm. None of it requires buying anything beyond the business plan most firms already have, and most of it can be done in an afternoon if you know where the switches are. It is not everything. It is the set that closes the doors attackers actually walk through.

Require multi-factor authentication for every account

If your tenant was created in the last few years, Security Defaults are probably on, which forces MFA registration for everyone and blocks the oldest sign-in methods. That is a reasonable floor for a very small firm.

Firms running Microsoft 365 Business Premium or an enterprise plan have Conditional Access available, and that is what we use instead. Conditional Access lets you require MFA on every sign-in while making it stricter where it counts: require a compliant device for access to SharePoint, require phishing-resistant methods for partners and administrators, block sign-ins from countries where nobody at the firm works. Security Defaults and Conditional Access cannot both be on, so pick one deliberately.

Whichever you choose, go into the Entra admin center afterward and look at the list of users who have not registered MFA. There are always a few: a retired of-counsel, the copier’s scanning account, a shared “reception” login. Each one either registers, gets converted to a shared mailbox with no sign-in, or gets disabled.

Block legacy authentication

Older protocols like POP, IMAP, and basic SMTP authentication do not support MFA, which makes them the way around it. Microsoft disabled basic authentication for most of Exchange Online in 2022, but SMTP AUTH can still be on per mailbox, and a Conditional Access policy that blocks legacy authentication clients closes the rest. Before you enable it, run the policy in report-only mode for a week and check the sign-in logs. The thing that breaks is usually a multifunction printer or a case management system sending notification email, and both have a modern fix.

Limit external sharing in SharePoint and OneDrive

Out of the box, users can create “Anyone” links: a URL that opens the file for whoever holds it, no sign-in required. For a firm that shares discovery productions, draft agreements, and settlement statements, that default is wrong.

In the SharePoint admin center, set the organization-level sharing to “New and existing guests” at most, which forces the recipient to verify their identity. Set the default link type to “Specific people” so a user has to choose to make something broader. Turn on link expiration for guest links and require that anyone links, if you keep them anywhere, expire in days rather than never. You can set tighter limits on specific sites, which is useful for a site holding trust accounting or personnel files.

While you are there, check who can create Microsoft 365 Groups and Teams. If every attorney can spin up a Team and invite outside parties, you will have forty of them in a year and nobody tracking the guests.

Sensitivity labels for client matter files

Sensitivity labels, part of Microsoft Purview Information Protection, let you mark a document or email as, for example, “Client Confidential” and attach behavior to that mark: encryption so only named people can open it, a watermark, a block on forwarding. The label travels with the file when it leaves SharePoint.

Firms that try to build a ten-label taxonomy on day one stall out. Start with three: Public, Internal, and Client Confidential, with Client Confidential encrypting the content and restricting it to your tenant plus explicitly added recipients. Train staff to apply it to anything leaving the firm. Auto-labeling rules can come later once the habit exists.

Turn on auditing and know how long it keeps records

Mailbox auditing is on by default in Exchange Online now, so you have a record of who read, moved, or forwarded what. The gap is usually retention. Standard audit retention on most business plans is measured in months, and a business email compromise is often discovered after the attacker has been reading mail for a while. Check how long your plan keeps the log, and if you are in a regulated practice area or hold funds, consider the longer retention Microsoft offers on higher tiers or export the logs on a schedule.

Also turn on alerts. The Defender portal can notify you when a mailbox gains a new forwarding rule, when an inbox rule starts deleting messages, or when a user signs in from an impossible location. Forwarding rules that quietly copy mail to an outside address are one of the most common signs an account has been taken over, and the alert is free.

Retention and litigation hold, enough to not lose data

Two different needs get confused here. Retention policies keep content for a set period even if a user deletes it, and delete it when the period ends. Litigation Hold freezes a specific mailbox or site so nothing in it can be permanently removed while a matter is pending.

Every firm should have a baseline retention policy on mail and SharePoint so that a departing associate’s deleted items are still recoverable, and so a mistaken deletion of a matter folder is reversible. Litigation Hold is a mailbox feature available on the business and enterprise plans most firms run; confirm it is available on yours before the day you need it, and have a written procedure for who places a hold and when. If your ethics counsel or malpractice carrier has guidance on retention periods, the policy should follow that, not Microsoft’s defaults.

Review guest access on a schedule

Guests are the outside users you have invited into Teams, SharePoint sites, and shared files: co-counsel, experts, clients, the vendor who helped with a migration two years ago. They accumulate. The Entra admin center lists them all, with the last sign-in date. Every quarter someone should go through that list and remove the guests whose matters are closed. Microsoft offers automated access reviews on higher license tiers, but a calendar reminder and a spreadsheet work for most firms.

Phones and laptops that touch client data

An attorney reading privileged email on a personal phone with no passcode is a confidentiality problem that no SharePoint setting fixes. Intune, included with Business Premium, handles this two ways.

For firm-owned laptops, enroll them and require disk encryption, a screen lock, and current updates before they are allowed to reach company data. For personal phones, you do not need to manage the whole device. App protection policies apply just to Outlook, Teams, and the Office apps: require a PIN to open them, block copying firm data into personal apps, and allow the firm to wipe its data from the phone when someone leaves without touching their photos. Attorneys accept the second approach far more readily than the first, and it covers the actual risk.

Doing it in the right order

If you only get through part of this list, do the first three. MFA with legacy authentication blocked and external sharing limited removes most of the ways a law firm tenant gets compromised. Labels, auditing, holds, and device rules make the firm defensible when something does go wrong, which is the position your bar and your carrier will expect you to be in.

Expect some friction. Someone will be annoyed by the MFA prompt, someone’s shared link will stop working, and the printer will need attention. That is the configuration doing its job. Make the changes on a quiet Friday with someone available Monday morning, announce them in advance, and give people a person to call.

Firms that would rather have this done for them, and kept that way as Microsoft moves the switches around, can start on our law firm IT services page. We manage Microsoft 365 tenants for firms across Central Florida and beyond, and this list is the first thing we do on every one of them.