Microsoft 365 Security Checklist: Law and Accounting Firms

Most small law and accounting firms in Surrey run on Microsoft 365. Email, client files in SharePoint or OneDrive, Teams calls and Outlook calendars all sit in one tenant. That makes the tenant the most valuable thing your firm owns online, and the settings inside it matter more than any firewall in the office.

This checklist covers the settings and habits we look at first in a small firm's tenant. Each item links to Microsoft's own documentation so you or your IT provider can check it.

If your firm runs on Google Workspace instead, the same ideas apply. Google recommends turning on 2-Step Verification, especially for admin accounts (Google Workspace Admin Help, 2SV for admins). It also recommends more than one super admin, each a separate person, using a separate non-admin account for daily work (Google Workspace Admin Help, admin account best practices). Review which third-party apps can reach Gmail and Drive under Security, Access and data control, API controls (Google Workspace Admin Help, third-party app access), and keep a tested backup of mail and Drive files the same way you would for Microsoft 365.

This is general information, not legal advice. Lawyers should also review their Law Society obligations, and accountants their own professional and client agreements.

1. Multifactor authentication for everyone

Microsoft says all Microsoft 365 for business plans include Microsoft Entra ID Free, which includes a feature called security defaults. Security defaults require every user to register for MFA, require MFA for admins at every sign in, and block legacy authentication such as old POP3 and IMAP email clients (Microsoft Learn, MFA for Microsoft 365).

Tenants created after October 2019 usually have security defaults on. Older tenants, or tenants where someone turned it off to fix a scanner or an old phone, often do not.

Check: in the Microsoft Entra admin center, go to Entra ID, then Overview, then Properties, then Manage security defaults (Microsoft Learn, security defaults). If it is off, find out whether Conditional Access policies replace it. If neither is in place, MFA is not being enforced.

2. Conditional Access if you have Business Premium

Microsoft 365 Business Premium includes Microsoft Entra ID P1, which adds Conditional Access (Microsoft Learn, security overview). Conditional Access lets you set rules such as requiring MFA for every sign in, or blocking sign ins from countries where nobody at the firm works.

You use either security defaults or Conditional Access, not both. If you switch to Conditional Access, rebuild the security defaults protections as policies first, so there is no gap.

3. Separate admin accounts

The partner who set up Microsoft 365 years ago is often still a Global Administrator on their everyday mailbox. If that mailbox is phished, the attacker has the keys to the whole tenant.

Check:

• Who holds the Global Administrator role? Keep it to a small number of named people.
• Do admins use a separate admin account that does not receive everyday email?
• Does the firm, not only the IT provider, have its own admin account it can use if the provider relationship ends?

4. Email protection

Every cloud mailbox in Microsoft 365 for business comes with built-in protection. Business Premium adds Microsoft Defender for Office 365 Plan 1 (Microsoft Learn, security overview), which adds protection against malicious links and attachments.

For law and accounting firms, email is where trust account and payment fraud starts: a lookalike domain, a spoofed partner, a "new banking details" message. Settings help, but so does a firm rule. Confirm any change to payment instructions by phone, using a number you already had on file.

5. Know where your client data lives

Microsoft's Product Terms commit that for tenants provisioned in Canada, Exchange Online mailbox content, SharePoint site content, OneDrive files and Teams chat messages are stored at rest in Canada (Microsoft Learn, data residency).

Microsoft says the Data Location card in the Microsoft 365 admin center shows where your tenant's data is stored (Microsoft Learn, data locations). Clients sometimes ask, and so do insurance questionnaires.

Data location is only part of the picture. Third party apps connected to the tenant, such as e-signature, practice management or tax software, may store data elsewhere. The Law Society of BC's cloud computing checklist asks lawyers to review each provider's terms, service levels, privacy commitments, security, backups and data export before moving client data in.

6. Backups you have tested

Microsoft keeps the service running. Your firm is still responsible for getting back a file someone deleted months ago, or a mailbox overwritten by ransomware on a synced laptop. The Canadian Centre for Cyber Security baseline controls list "back up and encrypt data" as one of their core controls for small and medium organizations.

Check: is there a backup of Exchange, SharePoint, OneDrive and Teams outside Microsoft's normal retention? When did someone last restore a file from it?

7. Devices that are patched and managed

Business Premium includes Microsoft Intune Plan 1 and Microsoft Defender for Business (Microsoft Learn, security overview). With those, you can require encrypted laptops, push updates and wipe firm data from a lost phone.

If your firm pays for Business Premium but has never set up Intune or Defender, you are paying for protection you are not using.

8. Offboarding the same day

When a staff member leaves, block their sign in, reset their password, remove them from shared mailboxes and Teams, and decide who gets their mailbox and OneDrive. Do it on their last day. A former employee's account left active is one of the easiest ways into a firm.

9. Staff who know what a phish looks like

The Cyber Centre baseline controls also include employee awareness training. A short session once a year, plus a clear way to report a suspicious email, does more than most people expect.

How Astro sets this up

Astro Developments is a Surrey, BC IT company. Under our Full IT agreement we work through this checklist with your firm, fix what is missing, and keep it in place each month as part of Microsoft 365 administration and cybersecurity. That includes help desk, patching, endpoint protection, backups, offboarding, and help writing your security documentation and incident response plan.

Offices that sign a 6-month Full IT agreement get a new website built at no charge. Our standard plans stay month to month for the first 3 months (pricing). Email [email protected] or book an IT assessment, and we will review your Microsoft 365 or Google Workspace setup with you.