Microsoft 365 security evidence for law firms

Review who can reach matter information

Matter documents can move between a case-management system, email and shared Microsoft 365 locations. A tenant-level setting does not establish who can access every matter or whether an ethical restriction is being applied.

• Identify where matter correspondence and documents are stored and who administers each service.
• Ask for a dated access review covering support staff, locums, consultants, external guests and provider accounts where relevant.
• Have the responsible team review sharing links and access to a suitable sample of restricted matter locations.
• Record access-removal actions at staff departures or matter handovers without collecting unnecessary client documents.

Treat payment instructions as a separate control

The SRA's cybercrime resources describe fraud involving altered payment instructions. Reviewing account protection is useful, but your firm also needs to establish how staff verify instructions and escalate discrepancies.

• Ask for MFA enforcement and administrator-access evidence for the accounts used in client and finance communications.
• Request the IT provider's review of relevant forwarding rules and unusual access concerns.
• Review the procedure for confirming changed bank details using established, independently checked contact information.
• Discuss a redacted process example with the finance or compliance lead; do not use a settings score to approve a transfer.

Give partners a clear evidence discussion

Separate confirmed settings observations, evidence accepted by the firm and questions that remain open. Explain which client services could be affected and what decision the partners need to make.

• Keep the assessment scope and exclusions visible alongside the report.
• Identify any recovery evidence needed for email, document storage and the separate case-management service.
• Agree who will obtain missing records or implement changes and when the findings will be reviewed.
• Use the SRA and Law Society resources with the firm's responsible advisers when considering wider professional obligations.

How Lexcel fits risk and information management

Lexcel is the Law Society's practice-management quality mark, covering areas including risk and information management. A firm seeking or maintaining accreditation can use dated control records in its wider management review; a CyberProva assessment is not Lexcel accreditation or a blanket cyber certification.

• Ask the person responsible for Lexcel to map relevant evidence to the current standard and the firm's policies.
• Keep training, information-handling, supplier and incident-process records alongside technical observations.
• Use the accreditation process and appropriate advisers to establish what the firm needs to demonstrate.

UK GDPR security: technical and organisational measures

The ICO's security guidance links appropriate technical and organisational measures with risk, confidentiality, integrity, availability, recovery and testing. For a firm handling personal information, settings evidence is one input to that review. The ICO currently marks this guidance as under review; check its latest publication when applying it.

• Review the risks in the firm's actual processing and information flows with the responsible data-protection lead.
• Keep evidence of access reviews, staff procedures, recovery tests and follow-up improvements.
• Do not treat a tenant score as proof of UK GDPR compliance or legal professional privilege.

Client money and the SRA Accounts Rules

For firms within their scope, the SRA Accounts Rules address client-money handling and appropriately authorised and supervised withdrawals. Entra or Exchange settings alone cannot establish compliance with those requirements.

• Have the finance and compliance leads review the controls appropriate to the firm's transactions.
• Retain proportionate, redacted records of payment authorisation, independent verification and supervision.
• Separate a technical account-protection observation from a conclusion about a particular withdrawal or the firm's Accounts Rules compliance.

Where to check this in Microsoft 365

Ask your authorised administrator to inspect these areas for the accounts, services and devices in scope. These are review locations, not instructions to change settings without a plan.

What CyberProva can check automatically

Read-only observations depend on the selected plan, Microsoft licensing, consent and available data. Missing access is a gap, not a pass. Review the documented permissions and deployment limitations.

• MFA: Conditional Access or Security Defaults: Core: selected Conditional Access policy observations. Business and above advanced assessments: supported MFA registration, policy-coverage and Security Defaults observations. These are not proof that every sign-in is protected.
• Administrator access: Entra roles and PIM: Core: current directory-role assignments and Global Administrator principals. Advanced: supported standing-access observations when the required sources are available. Core counts do not resolve group membership or all eligible PIM access.
• External email forwarding: Exchange Online: CyberProva's basic Graph connection does not enumerate Exchange inbox rules, mailbox forwarding or transport rules. These are evidence-based controls, not automatic mailbox-content checks.
• External file access: SharePoint and OneDrive: Business and above advanced assessments can read selected tenant-wide sharing and link settings when permitted. They do not perform a file-by-file or matter-by-matter access audit.

What you should request from your IT provider

Keep the source, date, scope, exceptions and reviewer with each record. Submission and acceptance are separate; your organisation decides whether the evidence supports the claim.

• MFA: Conditional Access or Security Defaults: Dated policy state, targeted users/apps, exclusions, authentication strengths and registration records; representative sign-in evidence reviewed by an administrator. Report-only policies and registration alone do not establish enforcement.
• Administrator access: Entra roles and PIM: Role assignments, separate admin-account records, PIM activation and approval requirements where used, and reviewed emergency-access custody, monitoring and test records. A named role does not establish business need.
• External email forwarding: Exchange Online: A dated forwarding/rule inventory with destinations and exceptions, applicable outbound spam and mail-flow policies, and an administrator's review of suspicious or unexpected changes.
• External file access: SharePoint and OneDrive: Tenant and relevant site sharing settings, approved guest/link exceptions and sample access-review outcomes. Record who approved external access and what was removed after the review.

How CyberProva helps

CyberProva helps your firm review selected Microsoft 365 observations and request supporting records from its IT provider. The firm accepts or rejects submitted evidence; CyberProva does not independently verify every underlying fact. Free includes 3 lifetime core assessments and an on-screen summary. Business and above add board-report exports and remediation management, which can support a partner review. The firm supplies the professional context and approves any conclusions.

See what a Microsoft 365 security assessment should cover →

See exactly what CyberProva checks · Learn how CyberProva assesses security · Review Microsoft permissions

What this cannot establish

• CyberProva does not establish compliance with SRA rules, legal professional privilege, client-money controls or every confidentiality obligation. Relevant legal and professional judgements remain with the firm and its advisers.
• Selected Microsoft 365 observations do not audit a case-management system, verify a bank instruction or investigate an incident. Commission additional review where the question requires it.

Common questions