Home › Guides

Microsoft 365 security for Sarasota law firms

By Greg Mitchell · Squared Away Tech · October 12, 2026

Small law firms in Sarasota and across the Gulf Coast run almost everything through Microsoft 365: client email, Word and PDF drafts, shared folders in OneDrive or SharePoint, and Teams calls. That makes the Microsoft 365 account the front door to the firm. If one attorney or paralegal’s password is stolen, the attacker can read client files, watch for closings and settlements, and send convincing emails from a real firm address.

I spent eight years supporting Microsoft 365 at a Tampa Bay law firm, and the same handful of problems come up again and again. Here is what I would check first at a small firm.

1. Multi-factor sign-in for everyone, including partners

Multi-factor authentication (MFA) is the single biggest protection against stolen passwords. The usual gap at small firms isn’t that MFA is off everywhere; it’s that it’s off for a few people. Often that’s a partner who found it inconvenient, a shared front-desk account, or the admin account the original IT person used.

• Turn it on for every account, with no standing exceptions.
• Prefer the Microsoft Authenticator app over text messages where you can.
• Block older sign-in methods (“legacy authentication”) that skip MFA entirely.

2. Treat any change to payment instructions as suspicious

Real estate closings, settlements and trust account transfers make law and title offices a favorite target for business email compromise. The pattern is simple: an attacker gets into a mailbox, waits for a deal, then sends “updated” wiring instructions that look exactly like the real thing.

• Set a firm-wide rule that wiring instructions are confirmed by phone, using a number you already have on file and not one from the email.
• Put that rule in your engagement letters and email signatures so clients expect it.
• Set up SPF, DKIM and DMARC on your domain so it’s much harder for scammers to send mail that looks like it came from your exact address. (What DMARC is and why it matters.)

3. Block forwarding to outside addresses

One of the first things attackers do in a stolen mailbox is create a rule that quietly forwards copies of mail to an outside address, or hides replies from certain people. Microsoft 365 can block automatic forwarding to outside domains for the whole firm. If someone has a real business need, make a narrow exception for that one mailbox instead of leaving it open for everyone.

4. Know who can see client files

Over time, SharePoint sites, OneDrive folders and Teams fill up with “anyone with the link” shares, guest users from old matters, and former co-counsel who still have access. A few practical steps:

• Limit external sharing to specific people instead of anyone with the link.
• Review guest accounts and remove ones tied to closed matters.
• Use sensitivity labels or at least clearly separated folders for the most confidential matters.

The Florida Bar expects lawyers to take reasonable steps to protect client confidentiality, including when using technology. What’s “reasonable” is a question for your own ethics counsel, but documented settings and an access review are a strong place to start.

5. Clean up accounts when people leave

Paralegals, associates and assistants come and go. When someone leaves, their account should be blocked the same day, their mailbox converted or delegated to whoever takes over their matters, and their phone and laptop removed from the firm’s systems. Former employees with working logins are one of the most common findings in a security review.

6. Protect laptops and phones

Attorneys work from court, from home and from client offices. Laptops should be encrypted with BitLocker (or FileVault on a Mac) so a stolen bag doesn’t become a confidentiality problem. Microsoft Intune can enforce encryption and a screen lock, and lets you wipe firm data from a lost phone without touching personal photos.

7. Limit admin accounts

Many small firms have three or four people with Global Administrator rights “just in case,” usually on their everyday account. Keep it to two named admin accounts, separate from day-to-day email, both protected with strong MFA.

8. Be ready to answer your cyber-insurance questionnaire

Insurers commonly ask about MFA, admin accounts, backups and email security. If you can’t answer confidently, that’s a sign the settings deserve a look. (How to prove MFA to your insurer.)

Where to start

If you’re not sure how your firm’s Microsoft 365 is set up, a Microsoft 365 Security Checkup is a read-only review of your sign-in, email, sharing, admin and device settings, with a plain-English report of what to fix first. Nothing is changed during the review. If you’d rather start smaller, the free 20-minute checkup call below checks your sign-in and email forwarding settings.

Squared Away Tech serves offices of 5 to 100 people in the Tampa Bay and Sarasota area (Bradenton, Sarasota, Tampa, Ellenton, Lakewood Ranch, St. Petersburg, Palmetto, Venice and Parrish), serving small offices across Florida, and remotely anywhere in the U.S. Mon–Fri 5–9 PM and Sat 9 AM–5 PM (Eastern Time). Daytime and Sunday appointments available on request; daytime calls get a same-evening callback. Back to the home page · More guides

This guide is general information, not legal or insurance advice. Every office’s setup is different.