Microsoft 365 migration
Move to Microsoft 365 Without Losing Control of Access
Many law firm migrations move the files but lose track of who should be allowed to see them. Content from an old file server can land in Microsoft 365 with permissions that were already too broad or did not transfer cleanly.
The migration is often declared complete because the documents open. That is when firms may discover that the wrong people can see the wrong files, or that no one can prove a screen still works.
If your IT provider is handling infrastructure, we act as an independent legal-risk advisor focused on confidentiality boundaries, defensibility, and client-facing evidence.
If Copilot is already on your roadmap, read our Copilot permissions article first. If you only need one specific remediation, see our fixed-price one-time services and we will scope the narrow fix instead of a full migration. The full services overview is on the services page.
The problem
Moving the files is easy. Making sure the right people can see them takes more care.
Many migrations move content in bulk and copy the old access rules. The firm gets working cloud storage, but not a clear record of who should see each type of matter. The problem may appear later when search is enabled, Microsoft Copilot is turned on, or a client asks for proof.
Screens deserve particular attention. A screen implemented on a file server does not automatically survive migration into SharePoint or Teams, and firms rarely re-check them afterward. A matter workspace that was once controlled by a folder path can become a broad team site with shared links, inherited permissions, and content copied into personal storage.
Migrating correctly the first time costs less than remediating later because permission cleanup after the fact means untangling changes made by people who have since left. The longer a broken structure lives in the tenant, the harder it is to prove what should and should not be visible.
What we do
Four steps that protect confidentiality while the files move.
Step 1
Plan
We inventory content, map current permissions, identify active screens and matter-level restrictions, and review any client security obligations that constrain where data may live.
This is the stage that tells us what must be rebuilt, what can be migrated as-is, and what needs to be contained before anything moves.
Step 2
Build
Microsoft 365 is configured with safer defaults from day one: stronger sign-in, restricted sharing, clear labels for sensitive files, activity logging, and limited external sharing.
That gives the migration a secure destination instead of a clean-up project after the fact.
Step 3
Migrate
Content is moved with clear access rules rather than copied old rules. Screens are rebuilt and checked, and retention settings are applied where needed.
The point is not to copy the old server into the cloud. The point is to land in a tenant the firm can explain to a client.
Step 4
Verify
We test permissions against the designed model, test the screens, and produce a before-and-after evidence pack with documented handoff.
If a screen does not hold in testing, it gets fixed before the firm lives with it.
What you receive
Documentation the firm can use after the migration is done.
- Content and permission inventory of the source environment
- A designed permission model, documented
- Microsoft 365 tenant configured with security defaults
- Screens rebuilt and verified in the new environment
- Evidence pack suitable for client questionnaires and insurance applications
- Written documentation and handoff for the firm's IT provider
Who this is for
Use this when the firm cares about what people can actually reach.
This is a good fit if
- You are moving from a file server, Dropbox, Google Workspace, or a flat SharePoint structure.
- You have active matters, screens, or client-imposed restrictions that need to survive the move.
- You want a fixed price before work begins instead of a vague migration estimate.
- You need evidence that a partner can show a client or insurer.
This is not the right service if
- You only need one isolated permission repair or one mailbox fix.
- You are not moving content and only want to harden email or a single tenant setting.
- You want the migration done with no permission review at all.
Pricing and timeline
Scoped individually, with the price confirmed before work begins.
Most firms of 1 to 25 users complete in 4 to 8 weeks. The source environment, data volume, and number of active matter restrictions are the main drivers of duration.
Pricing is quoted individually. We confirm a fixed price before work begins so the firm knows the scope, the window, and the delivery point.
If the project turns out to be a narrow remediation instead of a full migration, we will tell you that up front and point you to the fixed-price one-time service that fits better.
Frequently asked questions
The questions partners ask before moving anything.
Many providers migrate competently. The gap is usually that a general IT migration optimizes for files opening afterward, not for whether the resulting permission model is defensible. A law firm has obligations a general business does not: ethical walls, client-imposed restrictions, and a confidentiality duty covering all information relating to a representation. Those requirements have to be designed into the migration, not added afterward.
Screens implemented on a file server do not automatically translate to SharePoint or Teams. They have to be rebuilt deliberately in the new environment and then tested. We identify every active screen during planning and verify each one before handoff.
No. Content is migrated in full. What changes is who can reach what, and that change is by design rather than by accident.
Yes. The source environment affects the plan and the timeline, not whether the migration is possible.
Most firms of 1 to 25 users complete in 4 to 8 weeks. Data volume and the number of active matter restrictions are the two factors that move that estimate most.
No. Migrations are staged so the firm keeps operating. There is typically one short cutover window, scheduled around the firm's calendar.
Microsoft 365 is capable of meeting a law firm's confidentiality obligations, but not in its default configuration. The security posture is a function of how the tenant is configured, not of the platform itself. That configuration is the substance of this engagement.
Related services
These pages are the usual next step.
Planning a move?
Free Zero-Access Exposure Review™
2 minutes. No internal access. No passwords.
Even before migration, the review shows what the public internet already knows about your domain and email security.