You\u2019re paying for Microsoft 365. You\u2019re probably not getting what you paid for.<\/p>\n
Most Chicago law firms are running Microsoft 365. It\u2019s become the default platform for email, calendars, Teams, document storage, and collaboration. For firms that migrated from on-premise Exchange or legacy systems, the improvements were immediate and noticeable.<\/p>\n
What\u2019s less visible is what the out-of-the-box configuration doesn\u2019t provide.<\/p>\n
Microsoft 365, in its default state, is a productivity platform. It is not automatically a compliance solution, a data protection system, or a complete security architecture. The capabilities that make it those things \u2014 Data Loss Prevention (DLP), retention policies, conditional access, audit logging, and advanced security controls \u2014 exist within the platform, but they must be configured properly.<\/p>\n
In our experience assessing Chicago law firms, these features are rarely configured correctly.<\/p>\n
What most firms have is a Microsoft 365 environment that sends and receives email, stores files in OneDrive, and hosts Teams meetings. What most firms believe they have is a secure and compliant legal technology environment. The gap between those two realities is significant.<\/p>\n
A standard Microsoft 365 deployment includes:<\/p>\n
What it does not<\/b><\/span> provide by default includes:<\/p>\n For law firms, these missing configurations create risks that translate directly into confidentiality concerns, compliance exposure, and potential malpractice liability.<\/p>\n Email DLP policies allow firms to control what information can leave the organization.<\/p>\n A properly configured policy can identify and block messages containing client file numbers, Social Security numbers, financial account information, or other sensitive data before they are sent externally.<\/p>\n Without DLP, there is no automated safeguard preventing an attorney or staff member from accidentally sending confidential information to the wrong recipient.<\/p>\n Many attorneys save client files to their personal OneDrive because it is convenient.<\/p>\n The problem is that personal storage creates long-term management issues. If an attorney leaves the firm, retires, or becomes unavailable, access to those files can become difficult or impossible.<\/p>\n SharePoint provides better governance, stronger access controls, version history, and centralized management. Yet many firms continue to rely heavily on individual OneDrive accounts for client data.<\/p>\n Microsoft 365 supports MFA, but support and enforcement are not the same thing.<\/p>\n In many environments, MFA is optional or applied only to certain users. That leaves individual accounts vulnerable to phishing attacks and credential theft.<\/p>\n One compromised attorney account can provide access to email, documents, Teams conversations, and client information across the firm.<\/p>\n Microsoft Teams makes collaboration easy, but without proper controls it can also create unnecessary risk.<\/p>\n By default, users can invite external guests and share files outside the organization. Without approval workflows and restrictions, sensitive information can be shared unintentionally with the wrong people.<\/p>\n For law firms handling confidential matters, unmanaged external sharing introduces avoidable exposure.<\/p>\n Many firms have never formally answered a basic question:<\/p>\n How long should client communications be retained?<\/p>\n Without retention policies, the answer often becomes whatever individual attorneys decide to do with their inboxes.<\/p>\n A defensible retention strategy ensures that communications and documents are preserved appropriately, remain discoverable when necessary, and are managed consistently across the organization.<\/p>\n A properly configured legal Microsoft 365 environment typically includes:<\/p>\n These controls work together to create an environment that supports both productivity and compliance.<\/p>\n Importantly, this is not a one-time project.<\/p>\n Microsoft 365 evolves continuously, firm requirements change, and new security threats emerge. Maintaining a secure environment requires ongoing management and periodic review.<\/p>\n ABA Model Rule 1.6(c) requires attorneys to make reasonable efforts to prevent unauthorized disclosure of client information.<\/p>\n The rule specifically considers factors such as:<\/p>\n A properly configured Microsoft 365 environment demonstrates reasonable effort through documented security controls, access management, auditing, and data protection policies.<\/p>\n As cyber insurance carriers, clients, and regulators increasingly evaluate technology practices, these controls become more than best practices \u2014 they become evidence of due diligence.<\/p>\n CMIT Chicago provides Microsoft 365 assessment, configuration, security management, and ongoing support for Chicago law firms.<\/p>\n We begin with a comprehensive Microsoft 365 review that evaluates your current environment against a legal-industry security baseline. From there, we help implement the controls that matter most for your firm, practice areas, and compliance requirements.<\/p>\n More importantly, we continue managing the environment as Microsoft evolves and your firm\u2019s needs change.<\/p>\n Because Microsoft 365 security is not a one-time project.<\/p>\n It\u2019s an ongoing commitment to protecting client information, supporting compliance, and maintaining a technology environment your attorneys can trust.<\/p>\n","protected":false},"excerpt":{"rendered":" You\u2019re paying for Microsoft 365. You\u2019re probably not getting what you paid…<\/p>\n","protected":false},"author":1076,"featured_media":841,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-840","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-local-it"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n
The Five Most Common Microsoft 365 Gaps We Find in Chicago Law Firms<\/b><\/span><\/h3>\n
No Data Loss Prevention on Email<\/b><\/span><\/h3>\n
Client Files Stored in Personal OneDrive Accounts<\/b><\/span><\/h3>\n
Multi-Factor Authentication Is Not Enforced<\/b><\/span><\/h3>\n
No Controls on Teams External Sharing<\/b><\/span><\/h3>\n
No Retention Policy for Client Communications<\/b><\/span><\/h3>\n
What Proper Microsoft 365 Configuration Looks Like for a Law Firm<\/b><\/span><\/h3>\n
\n
How Microsoft 365 Supports Legal Compliance<\/b><\/span><\/h3>\n
\n
How CMIT Chicago Helps Law Firms Secure Microsoft 365<\/b><\/span><\/h3>\n