Most Australian law firms already pay for Microsoft 365. The real questions for a Practice Manager are whether the firm is on the right plan, and whether that plan is actually protecting client files.
The short answer for a firm of up to 300 people: the licence is rarely the gap. The settings are. Business Premium already includes the controls that stop most payment redirection fraud and misdirected client files, but almost none of them are switched on by default.
This guide covers which Microsoft 365 plan a law firm needs, the five settings that matter most for legal practice, how Microsoft 365 works with your practice management system, and what to fix before anyone turns on Copilot.
Which Microsoft 365 plan does a law firm need?
For most firms of up to 300 staff, the answer is Microsoft 365 Business Premium. Microsoft designs it for businesses with up to 300 users, and it includes the security layer that Business Standard doesn’t:
- Microsoft Entra ID P1, which gives you Conditional Access: rules about who can sign in, from where, and on what device.
- Microsoft Intune, to manage and secure laptops and phones, including wiping firm data from a lost device.
- Defender for Business on every device, and Defender for Office 365 Plan 1 for email: link and attachment scanning, plus impersonation protection.
- Microsoft Purview information protection: sensitivity labels applied by staff, data loss prevention, and retention policies.
When E3 or E5 makes sense. Business plans are capped at 300 licences. Firms above that, or close to it and growing, need Microsoft 365 E3 for some or all staff. E5 adds automatic sensitivity labelling, Premium eDiscovery and more advanced identity and threat protection. Those matter for firms with large litigation or regulatory practices, or clients who audit you closely.
Mixing plans is normal. You can run Business Premium for most staff and E5 for a handful of roles, or add Microsoft’s E5 Security add-on to Business Premium. We would rather see a firm on Business Premium with every control configured than on E5 with the defaults.
We haven’t quoted prices here. Microsoft changed its commercial pricing in July 2026, and what you pay depends on your agreement and term. Ask your provider for current Australian pricing.
Five Microsoft 365 settings every law firm should switch on
Each of these is included in Business Premium. Each one maps to a risk a law firm actually carries.
1. Conditional Access and phishing-resistant MFA
Most email account takeovers start with a stolen password. Turning on multi-factor authentication helps, but Conditional Access goes further. It can block sign-ins from overseas, from unmanaged devices, or from legacy apps that skip MFA. Our guide to MFA strengths in Microsoft 365 explains how to require the stronger methods for partners and finance staff.
2. Email protection against payment redirection
Payment redirection fraud is the cyber risk that costs law firms money directly. Victoria’s professional indemnity insurer, LPLC, tells practitioners to always call and verify account details before you pay, including payment directions that appear to come from inside the firm.
The phone call is the control that matters most. Microsoft 365 reduces how often staff are put in that position. Turn on Defender for Office 365 impersonation protection for your partners and your trust account team. Flag external email clearly. Block automatic forwarding to outside addresses, which attackers use to sit quietly in a mailbox and watch for a settlement.
3. Sharing rules for clients, counsel and the other side
Lawyers share documents outside the firm every day. The SharePoint and OneDrive defaults allow links that anyone can open. Change the default to “specific people”, set links to expire, and limit who can share with external domains. This keeps the convenience of sharing a folder with counsel while removing the risk of a brief being forwarded to someone who should never see it.
4. Sensitivity labels and retention for client files
Sensitivity labels let staff mark a document or email as Confidential or Highly Confidential. The protection travels with the file, including encryption and restrictions on forwarding or printing. On Business Premium, staff apply labels themselves. Automatic labelling needs E5-level licensing.
Retention policies stop files being deleted before your firm’s retention period ends, whether by accident or on purpose. Your state’s rules and your own file management policy set the period. Microsoft 365 is how you enforce it.
5. Intune device management
Lawyers work from home, from court and from client offices. Intune makes sure every laptop and phone that opens client files is encrypted, patched and protected. If a device is lost, you can remove the firm’s data from it. Several Essential Eight controls, including application control, patching and Office macro settings, are delivered through Intune.
Is OneDrive and SharePoint secure enough for client files?
Yes, when it is configured for a law firm and not left on the defaults. Microsoft encrypts data in transit and at rest and can store Australian tenants’ core data in Australia. The protection that counts for confidentiality is the firm’s own: who can sign in, from which devices, what can be shared externally, and whether you can show who accessed a file.
Your obligation of confidentiality doesn’t change because a file is in the cloud. The Victorian Legal Services Board’s cybersecurity guidance and the Law Society of NSW’s cyber security resources both expect firms to take reasonable steps to protect client information. The five settings above are what those reasonable steps look like in Microsoft 365.
Microsoft 365 and your practice management system
Most Australian firms run a practice management system alongside Microsoft 365. LEAP, Actionstep, Smokeball, Clio and Infinitylaw each connect to Outlook and Word in their own way, and the firm’s documents may live in the practice management system, in SharePoint, or in both.
That split is where gaps open up. A document saved to a matter is protected by the practice management system’s permissions. A copy emailed, saved to a desktop or dropped in a personal OneDrive folder is not. Decide where the source of truth for client documents lives. Then configure Microsoft 365 so that copies outside it are labelled, retained and not shared by default.
We support all five of these systems for firms on our managed IT for law firms service. If you use Teams heavily for matter work, our post on Microsoft Teams for law firms covers channels, document collaboration and access controls.
Fix permissions before you turn on Copilot
Microsoft 365 Copilot can only see what the person using it can already open. In a firm where old SharePoint sites are open to everyone, that means a junior staff member can ask Copilot a question and get an answer drawn from a matter they were never meant to see.
Microsoft’s own answer is to fix oversharing first. Its SharePoint Advanced Management tools include Restricted Content Discovery, which keeps a site out of Copilot and organisation-wide search without changing who can open it. That is a useful stopgap. The lasting fix is a permissions review. We cover the governance side in Copilot won’t fix poor SharePoint foundations and who signs off on Copilot connections in a law firm.
Where to start
If your firm is already on Business Premium, start by checking which of the five settings above are actually configured. If you’re on Business Standard, the upgrade to Business Premium is usually the single best-value security decision a firm of under 300 people can make.
Microsoft 365 is one part of a wider picture. Our guide to cyber security for law firms sets out what regulators, insurers and clients now expect, with a 90-day plan the partners can own.
Book a Cyber & Compliance Maturity Assessment. We review your Microsoft 365 tenant against these controls and the Essential Eight, and give the partners a prioritised list.
Frequently asked questions
What is the best Microsoft 365 plan for a law firm?
For firms of up to 300 people, Microsoft 365 Business Premium. It includes Conditional Access, Intune, Defender for Business, Defender for Office 365 Plan 1 and sensitivity labels. Firms above 300 users need Enterprise plans (E3 or E5) for some or all staff.
Is Business Standard enough for a law firm?
Not usually. Business Standard has no Conditional Access, no Intune device management and no Defender for Office 365. Those are the controls that stop most account takeovers and payment redirection attempts.
Do we need E5 for sensitivity labels?
No. Business Premium lets staff apply sensitivity labels themselves. Automatic labelling, where Microsoft 365 detects sensitive content and labels it without the user, needs E5-level licensing.
Can lawyers store client files in OneDrive?
Yes, provided the firm controls sign-in, devices and external sharing, and keeps an audit trail. Agree as a firm where client documents should live, so files don’t scatter across personal OneDrive folders.
This article is general information, not legal advice. Speak to your legal adviser about your firm’s specific obligations. Microsoft licensing changes regularly; check current inclusions with your provider before you buy.
