A Microsoft 365 Security Baseline for the Small Law Firm

Microsoft 365 is where many small law firms keep their email, calendars, documents, and increasingly their Teams conversations. It is also a common starting point for account takeovers. A compromised mailbox gives an attacker client correspondence, the ability to send convincing messages to clients, and often a path to everything else the firm stores.

The good news is that Microsoft 365 includes most of the controls a small firm needs. The problem is that many tenants were set up quickly, by a vendor long gone, and never revisited. The federal Cybersecurity and Infrastructure Security Agency publishes secure configuration baselines for Microsoft 365 through its SCuBA project. What follows is a shorter, small firm version of that idea.

Multifactor authentication on every account

Every account that can sign in should require multifactor authentication, with no exceptions for the managing partner, the shared front desk mailbox, or the account that only receives scanner email. Prefer an authenticator app or a phishing-resistant method such as a passkey or security key over text message codes where users can manage it. Then check that it is actually enforced. A tenant where MFA is available but optional is a tenant without MFA.

Turn off legacy authentication

Older email protocols and clients that use basic authentication cannot do MFA, which makes them an easy way around it. Microsoft has retired basic authentication for most Exchange Online protocols, but tenants can still carry app passwords, legacy SMTP settings for scanners and line-of-business apps, and exceptions someone added years ago. Find them, replace them with modern authentication or a properly configured relay, and block what remains.

Conditional access basics

Conditional access lets the tenant make sign-in decisions based on who is signing in, from where, and on what device. For a small firm the useful starting set is short: require MFA for all users, block legacy authentication, require stronger checks for administrator roles, and consider blocking sign-ins from countries where the firm has no staff or clients. Use report-only mode to see the effect of a policy before enforcing it, and keep a break-glass emergency administrator account excluded and stored securely so a misconfigured policy cannot lock everyone out.

Separate administrator accounts

The account an attorney uses to read email every day should not also be a global administrator. Create dedicated admin accounts, use them only for administration, protect them with the strongest MFA method available, and keep the number of global administrators to the minimum needed. When an employee or vendor leaves, removing their admin rights should be on the same checklist as removing their mailbox.

Auditing, retention, and external sharing

Confirm that audit logging and mailbox auditing are on and that someone knows how to search them. After a suspected compromise, the first questions are which mailbox rules were created, which messages were accessed, and what was forwarded, and the audit log is where the answers live. Check for mailbox forwarding rules to outside addresses, a classic sign of compromise, and block automatic external forwarding unless there is a documented reason for it.

Retention policies let the firm decide how long email and documents are kept and protect them from deletion during that period, which supports file retention practices and investigations alike. External sharing in SharePoint and OneDrive deserves the same attention: decide whether anonymous "anyone with the link" sharing should exist at all, set expiration on external links, and review what is currently shared outside the firm.

Microsoft 365 is not a backup

Microsoft keeps the service running, but deleted items, overwritten files, and ransomware-encrypted documents are the firm's problem once retention and recycle bin windows pass. A separate backup of Exchange, SharePoint, OneDrive, and Teams, stored outside the tenant and tested by actually restoring something, is what lets the firm recover from a bad week rather than just survive it. Untested backups are a hope, not a plan.

Train people with realistic practice

Technical controls reduce risk, but many attacks still begin with a person clicking, approving, or replying. Periodic phishing simulations, followed by short, specific training for those who click, help staff recognize the messages that matter most to a law firm: fake e-filing notices, document share invitations, invoice and wire changes, and MFA approval prompts the user did not initiate. Simulations should teach, not shame. The goal is a culture where reporting a suspicious message is quick and normal.

Where to start

If you only do three things this month, enforce MFA everywhere, block legacy authentication, and check for external forwarding rules. LexAIAdvisors reviews Microsoft 365 tenants for small Florida firms against a baseline like this one as part of its M365 modern work service and delivers a prioritized fix list. Request an audit at /audit to see where your tenant stands.