What did you just give it permission to do?
When a legal system connects to Microsoft 365, someone clicks "Accept" on a permissions screen. In a lot of firms, nobody can say afterwards what was accepted, or whether the system sits inside or outside the firm’s security settings.
Know what you have allowed
Some integrations act as the signed-in user and see only what that person can see. Others act on their own, across every mailbox and file in the firm, whether anyone is signed in or not. "Read and write all mailboxes" may be exactly what an email filing service needs, but it is also access to every client email the firm has ever sent. That should be a decision, not an accident.
- Require an administrator to approve new applications, rather than letting users accept them.
- Review the applications already connected to your Microsoft 365 and what each can do.
- Where an application needs mailbox access, limit it to the mailboxes it genuinely needs.
Make sure the system sits inside your security
For most firms the front door is not the legal system; it is Microsoft 365 and the sign-in that unlocks it. Multi-factor authentication, blocking older sign-in methods, and rules about which devices can download data do much of the work, and many firms already pay for them. A legal system that supports single sign-on and respects those rules is protected by them. One with its own separate passwords sits outside them.
What to ask every vendor
- Exactly which Microsoft 365 permissions does your integration need, and why?
- Can access be limited to specific mailboxes?
- Do you support single sign-on for every user and app, and respect our device and access rules?
- Where is the data you read stored, and who at your company can access it?
Technical notes: small decisions, big consequences
Start with the overview: The details that decide the project
Accounts and finance
- Core accounting is still the gold standard
- One-way or two-way sync? Connecting your legal system to Xero
- Units or minutes? How time is recorded
- Your matter and nominal structure
- Making Tax Digital: the firm and its clients
Workflow, data and documents
- Workflow: deep, basic or none?
- Client onboarding and matter inception: portal, e-signature and ID checks working as one
- Custom data: what you rely on, and how you move it
- Precedents, merge codes and macros: your document bank in a new system
Your types of work
- Legal aid: your records, not just the Legal Aid Agency’s
- Litigation: Precedent H starts with time recording
- Family: Form E and financial disclosure
- Private client: where does the tax software fit?
Security and access
- Roles or individuals? How user permissions are set up
- Why manage security twice? Linking application security to Microsoft Entra
- How granular is the security inside the system?
- Who can see what in reporting?
- Shared platform, your data: separation, restore and erasure
- When the supplier is the target: where your data lives, who can reach it, and your real risk
Microsoft 365
- How does it connect to Outlook?
- What did you just give it permission to do? (you are here)
- What happens behind the scenes? Background integrations with Microsoft 365
- OneDrive is not a document management system
- Microsoft 365 is not a backup
Data and decisions
Official sources
Check the detail for yourself at the source. Rules and guidance change, so always use the current version.
- NCSC: small organisations guide to cyber security: Practical security steps for smaller firms.
- ICO guidance for organisations: UK GDPR guidance, including the right to erasure.
Where does your firm stand?
Our free practice management review shows how much of your current system you really use and, if you are thinking of moving, builds an independent requirements specification that takes your reasons into account. Nothing is sent to us.
Start the free review Talk to us