Legal Firms on the North Shore: Email and Document Protection
Legal work lives and dies on confidentiality. If you run a practice in Chatswood or St Leonards, you need simple, repeatable controls that keep client information private, satisfy insurer and client audits, and do not slow the team down. This guide gives you a practical setup for Microsoft 365 that you can implement yourself.
The outcomes you want
- Email that resists phishing and account takeover
- Client documents protected even if they leave your tenant
- Clean evidence for insurers, clients and licensees
- Minimal friction for partners, staff, barristers and vendors
1) Secure the mailbox first
Actions this week
- Turn on MFA for 100% of users with number matching
- Use Conditional Access to block legacy protocols, require compliant devices, and step up MFA for risky sign-ins
- Separate admin accounts and enable time-bound admin access
- Enable Defender for Office 365: Safe Links, Safe Attachments, anti-phish policies
- Set SPF, DKIM and DMARC to reduce spoofing
What good looks like
Every mailbox is protected by MFA, no legacy auth, threat reports show detections being blocked, and spoofed messages are rejected or quarantined.
2) Label and encrypt sensitive content
Create a simple Sensitivity Label set that staff understand:
| Label | Use case | Enforcement |
|---|---|---|
| Public | Marketing content | No restrictions |
| Internal | Firm-only notices | Firm users only |
| Client – Standard | Most matter files and emails | Encrypt, allow firm users and named externals, watermark optional |
| Client – Restricted | High-risk matters and advice | Encrypt, firm users only by default, require approval to add externals |
| Barrister Brief | Brief packs for counsel | Encrypt, allow named chambers email domains, block download on web |
Apply the same labels to SharePoint sites and Teams so the container inherits sharing rules. Use auto-labeling for obvious patterns like TFNs or bank details to catch mistakes.
3) Build matter-centric workspaces
Move from ad-hoc folders to standard matter workspaces:
- One Team or SharePoint site per client with Channels or libraries per matter
- Pre-built folder structure:
01 Intake, 02 Correspondence, 03 Evidence, 04 Advice, 05 Court, 06 Billing - Use private channels for restricted counsel work
- Turn on versioning, check-in/out for sensitive sets, and require Sensitivity Labels at the library level
Result
Everyone files documents the same way, permissions follow the matter, and audits are easier.
4) Share securely with clients and counsel
- Share files as links with expiry from SharePoint or OneDrive, not as attachments
- For large or ongoing matters, create a readonly “data room” library for clients and experts
- Enable “Open in browser only” for restricted libraries to prevent local copies
- Require guest sign-in for external users and log activity with audit and access reviews
Quick win
Replace email attachments with labelled, time-limited links. It cuts data leakage and keeps a record of who accessed what.
5) Retention, legal hold and eDiscovery
- Create retention labels for key classes: Client Files 7–10 years, Court Docs per jurisdiction, Briefs 7 years, Finance per tax rules
- Apply labels automatically by library or folder if possible
- Use Litigation Hold on mailboxes and eDiscovery Standard/Premium for matters
- Document a simple disposal review so expired records are defensibly deleted
What good looks like
You can place a hold in minutes, search across mail and files, and prove that records are retained or disposed according to policy.
6) Protect access from the device side
- Enroll laptops in Intune with baselines: BitLocker, firewall, Windows Hello, autopatch
- Block unmanaged device download for labelled content
- Separate guest and IoT Wi-Fi from staff with VLANs in offices around Crows Nest and St Leonards
- Add 4G or 5G failover to keep meetings and filings online during NBN outages
7) People and process
- Six one-page policies: Access Control, Acceptable Use, BYOD, Backup, Incident Response, Data Retention
- Quarterly access review signed by the practice principal
- Short phishing simulations and 15-minute refreshers each quarter
- Keep a risk register with top risks and owners
A 30, 60, 90 day plan
Days 1 to 30
MFA for all, Conditional Access, Defender for Office 365, SPF DKIM DMARC. Create the label set and apply to one pilot Team.
Days 31 to 60
Roll matter workspaces to two practice groups. Turn on Microsoft 365 backup. Configure basic retention labels and a Litigation Hold process.
Days 61 to 90
Enable guest governance and data rooms. Enforce “browser only” for restricted libraries. Run the first restore test and access review. Capture everything in a simple evidence pack.
Local quick wins for Crows Nest and St Leonards
- High-rise meeting rooms often have Wi-Fi dead spots. Position access points for boardrooms and enable Teams Rooms kits for clean recordings and transcripts.
- Many firms share floors with other tenants. Lock printers and scanners to secure release and route scans to labelled SharePoint libraries.
- If you host counsel or clients onsite, set up a guest Wi-Fi that is completely isolated from staff networks.
Mini checklist
- MFA on for all users and no legacy auth
- Defender for Office 365 policies active and reporting
- Sensitivity Labels applied to emails, files and containers
- Standard matter workspaces with versioning and permissions
- External sharing via expiring links, guest sign-in required
- Retention labels, Litigation Hold and eDiscovery documented
- Intune device baselines and encrypted disks
- Quarterly access review, phishing training and evidence pack updated
FAQ
Can we keep using our current folder structure
Yes, but map it to the standard matter template and apply labels at the library level so permissions and protection are consistent.
Will encryption make collaboration harder
Not if labels are simple and applied at the container. Staff and approved externals open files normally; unapproved users see an access request.
Do we need a separate document management system
Many small and mid-sized firms run well on SharePoint and Teams with labels, retention and eDiscovery. If you adopt a DMS later, keep the same labels and retention logic.