Microsoft 365 for Law Firms: Confidentiality, Security and Setup

Microsoft 365 can be a sound platform for a law firm, provided it is configured with client confidentiality in mind. Texas lawyers must protect confidential client information and, under the comment to the competence rule, understand the benefits and risks of relevant technology. Ethics guidance generally permits email and cloud services when the firm makes reasonable efforts to protect client information. In Microsoft 365, that means strong sign-in security, controlled sharing, encryption where it is warranted and a plan for retention and incidents.

This article is general information, not legal or ethics advice. For questions about your obligations, consult the rules themselves, ethics counsel or the State Bar of Texas ethics resources.

The professional duties behind the technology

Confidentiality: Texas Rule 1.05

Rule 1.05 of the Texas Disciplinary Rules of Professional Conduct governs confidential information. Texas defines it broadly to include both privileged information and unprivileged client information, meaning information relating to a client that the lawyer acquires during the representation. Much of what sits in a firm's mailboxes and document folders falls in that category.

Technology competence: comment 8 to Rule 1.01

In February 2019, the Supreme Court of Texas amended comment 8 to Rule 1.01 so that maintaining competence includes understanding the benefits and risks associated with relevant technology. In practice, that means firm leaders should understand, at a working level, how their systems protect client information, even if an IT provider does the configuration.

Email: Texas Ethics Opinion 648

In Opinion 648 (2015), the Professional Ethics Committee concluded that, given current technology and email use, Texas lawyers may generally communicate confidential information by email. It also described situations where a lawyer should consider encryption or another method, such as highly sensitive information, shared or third-party-accessible accounts, a client's work email in an employment matter, and public or unsecured devices and networks.

ABA guidance

ABA Formal Opinion 477R (2017) says lawyers may generally transmit client information over the internet when they make reasonable efforts to prevent unauthorized access, and that enhanced security may be required for highly sensitive information or by client agreement or law. ABA Formal Opinion 483 (2018) addresses breaches: monitoring for intrusions, acting promptly to stop a breach and restore systems, determining what happened and informing current clients when material confidential information is involved. ABA opinions are not binding in Texas but are widely consulted.

Practical Microsoft 365 controls for law firms

Several of these depend on your Microsoft 365 plan. Check Microsoft's current documentation before relying on any feature.

Practice management and document management systems

Many firms use a practice management system for matters, time and billing, and some use a dedicated document management system. These usually sit alongside Microsoft 365 rather than replacing it: email, calendars, Teams and Office apps stay in Microsoft 365, while the legal system organizes matters and documents.

When evaluating how they fit together, ask where the authoritative copy of each document lives, how the system signs users in (ideally through your Microsoft 365 accounts with MFA), how client files are shared externally, what the vendor's security and retention commitments are, and how you would export your data if you leave. ABA Opinion 477R also encourages vetting technology vendors and checking on them over time.

A scenario

Take a hypothetical six-lawyer family law firm in Fort Worth. Staff email financial affidavits to clients as attachments, some clients use email accounts their spouses may access, and the firm's document folders are shared through a single anonymous link. A practical plan: enforce MFA on every account, replace attachments with sharing links limited to the specific client, use encryption for highly sensitive messages, discuss with each client at intake how they prefer to communicate, remove the anonymous link, and agree retention settings with the partners.

Common mistakes

How NexJen can help

Our fixed-fee Microsoft 365 Assessment and Optimization engagement takes a read-only look at your tenant and delivers written, risk-rated findings, a roadmap and a readout call. Our Security Posture and Compliance Assessment benchmarks your setup against the CIS Benchmark and Microsoft Secure Score; it is not a certification or an ethics opinion. Consulting makes no changes to your tenant; implementation is quoted separately. Firms that want ongoing support can use NexJen Essentials, our managed IT plan.

Common questions