A practice manager asks a reasonable question: “Can we connect Copilot to our practice management system, so partners can just ask what’s outstanding on a matter?”
Twelve months ago, the honest answer was “not really”. Copilot could summarise your inbox and your Teams chats, but your matters, your trust ledger and your precedents sat in systems it couldn’t see.
Today, the answer is increasingly “yes, and faster than you’d think”.
That’s the opportunity. It’s also the problem. Because the technical setup is rarely the hard part. The hard part is that nobody at partner level has decided what Copilot should be allowed to see, and what it should be allowed to do.
What changed: Copilot can now plug into your other systems
The change has a slightly awkward name: the Model Context Protocol, or MCP. Put simply, MCP is an open standard that lets an AI assistant connect to another system through a defined set of tools. It can ask that system for information, and it can act inside it.
Microsoft has been building on it steadily. MCP became generally available in Microsoft Copilot Studio in May 2025, and Microsoft now documents how to build Microsoft 365 Copilot agents from MCP servers. Legal software vendors are following. In September 2026, NetDocuments announced it connects to Microsoft Copilot through MCP, so Copilot can answer from a firm’s matter history and precedents without documents being exported.
For a law firm, that shifts Copilot from a helpful writing assistant to something much closer to a colleague who knows the file:
- Matter status — “What’s outstanding on this matter, and who’s waiting on us?” answered from the practice management system, the document system and the email trail together.
- Precedent and knowledge — drafting that starts from the firm’s own approved precedents, not a generic template.
- Partner reporting — WIP, aged debt and file activity pulled into a single answer, rather than an afternoon of exports.
- Routine actions — a draft file note, a task, a time entry prepared for a fee earner to check and commit.
The value is real. So is the shift in risk.
The real change isn’t intelligence. It’s authority.
Most of the conversation about AI in law firms is still about the model: is it accurate, does it hallucinate, can it be trusted with legal reasoning? Those are fair questions.
MCP moves the risk somewhere else.
In September 2026, the Australian Signals Directorate published Agentic AI Harnesses, and its central point is one every Managing Partner should hear. Many of the most significant security and risk considerations don’t come from the language model. They come from the harness: the software layer that connects AI to an organisation’s data, tools and systems. MCP connections are exactly that layer.
Microsoft is equally clear about who carries the risk. When you connect Copilot Studio to a non-Microsoft MCP server, you’re responsible for the tools and resources you access. Using someone else’s MCP server doesn’t transfer operational responsibility to them either.
The reframe I’d offer any leadership team is simple.
Every MCP connection is a delegation of authority.
You’re deciding that a piece of software may read client information, and possibly act on it, on behalf of your people. In any other context, that’s a decision a firm takes seriously. We vet new staff. We set their file access. We supervise their work until we trust it. A connection to your practice management system deserves the same discipline.
Why this is a partner decision, not an IT setting
In a law firm, the obligations don’t sit with the IT team.
The Queensland Law Society’s Guidance Statement No. 37 on AI in legal practice is direct on three points that MCP brings to the surface:
- Confidentiality — firms should take reasonable steps so an AI tool doesn’t misuse or widely expose confidential data, including knowing where data is processed and stored and who can access it.
- Supervision — AI supports professional judgement rather than replacing it, and principals remain accountable for AI-assisted work.
- Approval — firms should approve AI use and set the conditions for approved tools.
An MCP connection touches all three at once. If a connected agent can see across matters, do your ethical walls still hold? If it drafts a file note or a time entry, who reviews it? If it can update a record, who approved that?
There’s a privacy dimension as well. From 10 December 2026, the Privacy Act’s automated decision-making transparency obligations commence. Organisations covered by the Act must explain in their privacy policy where a computer program uses personal information to make, or do something substantially and directly related to making, decisions that could significantly affect individuals. Most firms’ first Copilot connections won’t come near that line. But once agents start acting rather than answering, someone should be checking.
None of this is a reason to hold back. It’s a reason to decide deliberately.
A simple way to decide: Read, Draft, Act
The firms I see getting this right don’t start with “what can we connect?”. They start with “how much authority are we comfortable giving?”. A simple three-rung ladder helps leadership teams make that call for each system.
1. Read. Copilot can search and summarise from the connected system, under each user’s own permissions. Nothing is created or changed. This is where every connection should start, and where many should stay.
2. Draft. Copilot can prepare something (a file note, a task, a time entry, a letter) but a person reviews it and commits it. The productivity gain is still significant, and supervision stays where QLS expects it to be.
3. Act. Copilot can create, update or send without a human step. Reserve this for low-impact, reversible actions, with logging that someone actually reviews. ASD’s guidance specifically calls for human oversight of high-impact actions.
Then, before any connection goes live, capture one page that a partner signs:
- The system and the data — what it connects to, and whether it can reach client confidential or personal information.
- The rung — Read, Draft or Act, and why.
- Whose permissions it uses — each user’s own access (preferred), or a shared service account that may see more than any one person should.
- Who supervises — the named person who reviews outputs and audit logs, and how often.
- How we switch it off — who can disable it, and how quickly.
It’s not complicated. But it turns an IT setup task into a governance decision with a name against it, which is exactly what insurers, clients and regulators increasingly expect to see.
Microsoft is building the controls to support this. Microsoft Agent 365, generally available since May 2026, is designed to observe, govern and secure agents across the organisation. The tooling helps. It can’t decide your risk appetite for you.
Getting the foundations right first
One more thing, because we see it often. MCP doesn’t fix messy data. It reaches it faster.
If matter permissions are inconsistent, if documents are duplicated across systems, or if ethical walls rely on people “just knowing”, a connected Copilot will surface those gaps quickly. I’ve written before about how Copilot won’t fix poor SharePoint foundations. The same applies to every system you connect it to.
This is where a structured approach pays off. Through our Innovation & Automation Advisory, we help leadership teams pick the first connections worth making, set the rung for each, and put the sign-off and supervision in place before anything goes live. As an ISO 27001:2022 certified organisation, we bring the same information security discipline to that advice.
Copilot’s intelligence is the part everyone talks about. Its connections are the part that decides whether it’s safe.
If your firm is weighing up which systems to connect to Copilot, and how far to let it go, my team and I would welcome a conversation.
Frequently asked questions
What is an MCP server?
An MCP server is a connector that makes another system (a document system, practice management platform or database) available to an AI assistant through a defined set of tools. Each tool lets the assistant read information or take an action in that system.
Does Microsoft Copilot support MCP?
Yes. MCP is generally available in Microsoft Copilot Studio, and Microsoft documents how to build Microsoft 365 Copilot agents from MCP servers. Several legal software vendors now offer MCP connections to Copilot.
Is it safe to connect Copilot to our practice management system?
It can be, if each connection is approved deliberately. Start read-only under each user’s own permissions, confirm that matter restrictions and ethical walls carry through, name a person to supervise outputs and audit logs, and only allow actions without a human check where they are low-impact and reversible.
Who should approve an MCP connection in a law firm?
A partner or the leadership team, not only IT. Professional obligations around confidentiality and supervision sit with the firm’s principals, so the decision about what Copilot can see and do should too.
