Microsoft 365 in law firms: protecting professional secrecy

The cloud and professional secrecy – compatible, but it takes work

Email, case files, calendars and video calls have long run on Microsoft 365 in many Austrian firms. For lawyers and tax advisers, though, there is a question other businesses don’t face in quite the same way: how do you run the platform so that professional secrecy is preserved?

The short answer: Microsoft 365 is neither “suitable for law firms” nor “unsuitable” out of the box. What matters is the contract, the configuration and ongoing oversight. This article shows which settings make the difference in practice. It is not legal advice – if in doubt about whether your set-up meets your professional obligations, check with your bar association or chamber.

The legal framework in brief

Lawyers: under section 9(2) of the Austrian Lawyers’ Act (RAO), lawyers must keep confidential the matters entrusted to them; the same applies to the assistants they engage.
Tax advisers and auditors: section 80 of the WTBG 2017 obliges professionals to keep confidential the matters entrusted to them and extends this duty to, among others, their assistants.
External service providers: in 2020, the Austrian Bar (ÖRAK) revised its professional guidelines (section 40 RL-BA) in a technology-neutral way. According to the ÖRAK information sheet (in German), lawyers must select external providers carefully, data security and confidentiality must reflect the state of the art, clients must be told which categories of providers are used, and the provider must be contractually obliged – in a verifiable way – to inform the firm without delay in the event of a search of its premises.
GDPR: Microsoft processes data as a processor. That requires a contract under Article 28 GDPR, and the firm must put appropriate technical and organisational measures in place under Article 32 GDPR.

How to meet the requirement about searches in particular when dealing with a large provider is something to agree with your regional bar or with the Chamber of Tax Advisers and Auditors (KSW).

Contract and data location

Data processing: the Microsoft Products and Services Data Protection Addendum (DPA) forms part of the terms for business customers. File the current version with your records and list Microsoft in your record of processing activities.

EU Data Boundary: in February 2025, Microsoft completed the EU Data Boundary for Microsoft 365. According to Microsoft, customer data, pseudonymised personal data and support data are stored and processed within the EU and EFTA. Check the data location shown for your tenant in the admin centre – and remember that add-on services and third-party apps may follow their own rules.

The key settings

Multi-factor authentication (MFA) is a must for every account – no exceptions, including assistants and reception staff. Conditional Access (included in Business Premium, for example) lets you add rules: access only from managed devices, blocking legacy sign-in methods, no sign-ins from countries where nobody in the firm works.

Sensitivity labels and encryption

Sensitivity labels in Microsoft Purview let you classify documents and emails, for example as “Privileged”. A label can apply encryption that travels with the document, so even a forwarded file stays unreadable to anyone not authorised. Keep the scheme simple – three or four levels are enough for most firms.

SharePoint and OneDrive often allow generous sharing by default. We recommend:

Turning off “Anyone with the link” sharing and allowing only sharing with named people
Setting expiry dates for sharing links and guest access
Managing guest access in Teams deliberately: only for defined teams, reviewed regularly
Sharing per matter rather than sending individual files from personal OneDrives

Retention and backup

Retention policies in Microsoft 365 prevent premature deletion – they are not a backup. Microsoft runs the platform; protecting your data against mistakes, ransomware or a compromised account remains your responsibility. A separate Microsoft 365 backup with its own storage location and documented restore tests should therefore be part of the basics.

Device management

Microsoft Intune ensures that only encrypted, up-to-date, managed devices can access client data. If a laptop or phone goes missing, firm data can be wiped remotely. On personal phones, app protection policies can keep firm data separate from private data.

Review the logs

The audit log shows who accessed which files, created sharing links or changed mailbox rules, and when. Check that it is switched on, how long entries are kept on your plan, and set up alerts for suspicious activity – such as automatic forwarding to external addresses.

Copilot, AI and client data

According to Microsoft, Microsoft 365 Copilot only surfaces content that the user has at least view access to, and prompts and responses are not used to train the foundation models. But that also means overly broad permissions become visible through Copilot straight away. So tidy up sharing before you roll it out. Also check in the admin centre which AI models and extensions are allowed – according to Microsoft, not every additional model is covered by the EU Data Boundary.

For AI tools outside Microsoft 365, a filter in front of the model is worth considering: houdini replaces personal data with placeholders on your premises before a prompt reaches the AI model.

Checklist for your firm

File the Microsoft DPA and add Microsoft to your record of processing activities
Tell clients which categories of providers you use (e.g. in your engagement terms)
Check the data location in the admin centre
Enforce MFA for all accounts; set up Conditional Access for firm devices
Define sensitivity labels with encryption
Turn off “Anyone with the link”; set expiry dates for guests and links
Set up a separate backup and test restores
Manage devices with Intune and rehearse the lost-device scenario
Switch on the audit log and configure alerts
Enable Copilot only after a permissions review

How IT United can help

We work with law firms and tax advisers and understand what confidentiality and traceability require. Together we review your Microsoft 365 tenant, put the settings in place and document them so you can answer questions from clients and your chamber. Find out more on our page for law firms and about IT security.

Would you like to know where your tenant stands? Book a free initial consultation.