Microsoft 365 Security Checklist for Small Law Firms
A practical Microsoft 365 security checklist for small law firms: ask for evidence of sign-in protection, access, sharing, forwarding, logs, and recovery.
Use this practical checklist to ask your IT provider what protects your law firm's Microsoft 365 accounts, mail, and client files. For a cross-system starting point, use the law firm cybersecurity checklist for office managers. Buying Microsoft 365 or enabling a feature is not evidence that every safeguard is configured, in scope, or operating as intended. A tenant can be a strong platform and still need an authorized review.
This checklist is a decision aid, not a claim about your tenant and not a substitute for current Microsoft documentation. Licensing, configuration, third-party services, retention, and scope change what can be checked.
Verify the outcomes that matter
Protect sign-ins
Why leadership should care: a stolen password should not be enough to reach client work. For a focused guide, see how to verify MFA enforcement and account coverage.
Device code phishing: a real Microsoft login can still hand over the mailbox
Device code sign-in is legitimate, but an attacker can start a request and persuade an employee to enter the attacker's code on Microsoft's genuine sign-in page. Approval can authorize the attacker's session without revealing the employee's password, so a familiar web address is not proof that a request is safe.
Treat an unexpected code request as suspicious, especially when it arrives with an urgent message about a client file, account problem, or sign-in that the employee did not start. Staff should not enter the code or approve the prompt. They should verify the request through a saved IT contact and report it. Ask your provider whether any device or application needs this sign-in method, whether it can be blocked for others, and how exceptions are reviewed. A report-only policy does not block sign-ins.
If someone has already entered a code, contact IT using a known number. Ask the provider to investigate sign-ins, revoke active sessions, and review authentication methods, application permissions, and mailbox rules; a password reset alone may not be enough.
Limit administrative access
Why: excessive privilege increases the impact of one compromised account. Evidence: administrator inventory, role assignments, emergency-access documentation, and review dates. Limitation: role evidence is a point-in-time view and depends on complete tenant scope.
Remove former-user access
Why: departures create avoidable access and data-retention risk. Evidence: joiner/leaver procedure, recent revocation record, session/token handling, and mailbox or file ownership review. Limitation: off-platform copies and personal devices require separate scope.
Use the law firm employee offboarding checklist, with a free printable PDF and editable CSV worksheet, to assign access-removal tasks, preserve client records, and record completion.
Review sharing of matter files
Why: a convenient external link can expose confidential work beyond the intended audience. Evidence: SharePoint/OneDrive sharing settings, representative site permissions, guest access, and review records. Limitation: a sample cannot represent every matter site unless the scope says it does. Use the client-file sharing checklist to review recipients, link scope, expiry, and downloaded copies.
Identify forwarding and mailbox risks
Why: unauthorized forwarding can quietly disclose mail. Evidence: mailbox rules, external forwarding configuration, transport rules, and alerting. Limitation: this requires authorized access and does not prove that a legitimate account has not been misused in another way. For payments, pair mailbox checks with the wire instruction verification checklist; it gives staff an independent callback process even when a request comes from a real mailbox.
Retain useful logs
Why: an incident response starts with what the firm can reconstruct. Evidence: audit-log settings, retention period, alert ownership, and a recent retrieval example. Limitation: licensing and retention choices affect history and availability.
Establish recovery evidence
Why: recovery plans matter only when the firm can restore what it needs. Evidence: backup scope, recovery objectives, dated restoration test, and ownership. Limitation: Microsoft 365 retention or recycle features are not automatically a complete backup strategy.
Verification table
Use this table to turn each safeguard into a specific request. A policy setting shows intent or configuration; a representative test shows one observed outcome; neither proves firm-wide coverage unless the reviewed scope supports that conclusion. An unreviewed area remains not verified.
| Safeguard | What to ask the administrator to demonstrate | Evidence or result to record |
|---|---|---|
| Sign-in protection | Show the active MFA or sign-in policies, scope, exclusions, and a representative test | Policy state, users/apps included, test result, exceptions, and whether firm-wide coverage was verified |
| Administrative access | Show the administrator inventory, role assignments, and emergency-access design | Current privileged-account list, role evidence, recovery safeguards, and review date |
| Former-user access | Demonstrate a recent joiner/leaver change and session or token handling | Procedure, dated revocation record, affected systems, and remaining limitations |
| Matter-file sharing | Show representative SharePoint/OneDrive permissions, guest access, and sharing settings | Sites or groups reviewed, external-sharing result, and whether all matter sites were in scope |
| Mailbox forwarding | Show external forwarding, inbox rules, transport rules, and alert ownership | Settings reviewed, test or sample result, and any unreviewed mailboxes |
| Logging | Demonstrate the audit-log settings, retention, alert ownership, and a recent retrieval | Configuration, retention period, retrieved event, and coverage limitations |
| Recovery | Demonstrate backup scope, recovery objectives, ownership, and a dated restoration test | Systems covered, restoration result, recovery owner, and unresolved gaps |
An illustrative finding layout
| Field | Example |
|---|---|
| Observation | External sharing is allowed for selected matter sites |
| Supporting evidence | Setting, affected site scope, and review date |
| Affected scope | Three sites reviewed; firm-wide coverage not established |
| Priority | High because client files are shared externally |
| Recommended action | Confirm approved sharing model and review guest access |
| Verification status | Partially verified |
This format separates an observation from a conclusion. It gives leadership and an IT provider something specific to act on without presenting invented tenant results.
What an authorized review can cover
The Law Firm Security Baseline reviews agreed Microsoft 365 identity, access, email, and evidence areas. Email & Microsoft 365 Security can address scoped mailbox and domain work. Broader permissions redesign, DLP, sensitivity labels, ethical walls, recovery engineering, and implementation may need separate scope.
The service uses authorized access or evidence. The Free Zero-Access Exposure Review™ is a public check only; it is not a Microsoft 365 configuration audit.
A small-firm review sequence
Start with the business event: a departed employee, unexpected external sharing, a mailbox-forwarding concern, a client questionnaire, or a planned migration. Then:
- Identify the users, systems, tenant, domains, licenses, and third-party services in scope.
- Review privileged access and former-user access first.
- Examine sign-in protection and mailbox-forwarding controls.
- Assign the remaining sharing, logging, and recovery checks.
- Request evidence, classify what was observed, and agree which changes need an implementation proposal.
Microsoft’s current documentation should be checked before relying on a named feature or license-dependent control. Avoid treating a portal screenshot as proof that the control operates across the whole firm.
Choose the right next step
For a small law firm ready to test these checks against its actual tenant, request an authorized Security Baseline assessment. For a public starting point, use the exposure review. For configuration changes, state the desired outcome and tenant scope so the work can be priced and authorized accurately.
This article is for informational purposes only and does not constitute legal, compliance, or insurance advice.