Microsoft 365 is not a backup
Many firms assume that because their email and documents are "in the cloud", Microsoft has them backed up. Microsoft keeps the service running. Making sure your firm can get its data back after a mistake, a malicious deletion or ransomware is largely your responsibility.
Retention is not restore
Microsoft 365 includes recycle bins, version history and retention policies. They are valuable, but they are designed for governance and short-term recovery, with time limits, not for restoring a whole mailbox or document library to how it was last Tuesday. If something was deleted outside those windows, or encrypted by ransomware and then synchronised, they may not help.
Why it matters more for law firms
If your legal system stores matter documents in SharePoint or OneDrive, or files email in Exchange, your client file depends on those services. A mass deletion, a sync gone wrong or a compromised account can affect thousands of client documents at once.
Decisions to make deliberately
- Do you need a backup of Microsoft 365, either Microsoft's own backup service or a specialist one, and with what retention?
- If your legal system stores documents in its own cloud, what are its backup frequency, retention and restore times, in writing?
- When did anyone last test a restore, of one document and of a whole matter?
What to ask every vendor
- Where is each kind of our data stored: your systems, our Microsoft 365, or both?
- What is backed up, how often, for how long, and how quickly can it be restored?
- Can we restore a single matter without restoring everything?
Technical notes: small decisions, big consequences
Start with the overview: The details that decide the project
Accounts and finance
- Core accounting is still the gold standard
- One-way or two-way sync? Connecting your legal system to Xero
- Units or minutes? How time is recorded
- Your matter and nominal structure
- Making Tax Digital: the firm and its clients
Workflow, data and documents
- Workflow: deep, basic or none?
- Client onboarding and matter inception: portal, e-signature and ID checks working as one
- Custom data: what you rely on, and how you move it
- Precedents, merge codes and macros: your document bank in a new system
Your types of work
- Legal aid: your records, not just the Legal Aid Agency’s
- Litigation: Precedent H starts with time recording
- Family: Form E and financial disclosure
- Private client: where does the tax software fit?
Security and access
- Roles or individuals? How user permissions are set up
- Why manage security twice? Linking application security to Microsoft Entra
- How granular is the security inside the system?
- Who can see what in reporting?
- Shared platform, your data: separation, restore and erasure
- When the supplier is the target: where your data lives, who can reach it, and your real risk
Microsoft 365
- How does it connect to Outlook?
- What did you just give it permission to do?
- What happens behind the scenes? Background integrations with Microsoft 365
- OneDrive is not a document management system
- Microsoft 365 is not a backup (you are here)
Data and decisions
Official sources
Check the detail for yourself at the source. Rules and guidance change, so always use the current version.
- NCSC: small organisations guide to cyber security: Practical security steps for smaller firms.
- ICO: report a breach: Reporting personal data breaches, usually within 72 hours.
Where does your firm stand?
Our free practice management review shows how much of your current system you really use and, if you are thinking of moving, builds an independent requirements specification that takes your reasons into account. Nothing is sent to us.
Start the free review Talk to us