Legal document management and secure sharing in Microsoft 365

1. Decide which system holds the record

Most firms of 10 to 150 people do some document work in Microsoft 365, even when a practice or document management system holds the official matter file. Trouble starts when nobody has decided which copy counts. A draft advice saved in a Teams channel, an older version in the matter system and a third copy attached to an email can each look like the real one.

Write down, on one page, where each kind of document lives:

• the matter file of record: pleadings, executed documents, final advice and file notes;
• working drafts and collaboration copies;
• documents exchanged with clients, counsel, experts and the other side;
• precedents, know-how and firm administration that belong to no single matter.

The rest of this guide is easier once that page exists. Section 6 looks at how Microsoft 365 sits beside a dedicated system.

2. Matter-based permissions

In SharePoint, people are usually given access to a whole site, and through it to everything stored there. Microsoft's guidance is to manage a team site's permissions through its Microsoft 365 group, or through the team in Teams: group owners become site owners and group members become site members. Managing the site's permissions separately from the group is possible, but Microsoft recommends against it to keep administration simple. Private and shared channels in Teams each get their own SharePoint site, with membership managed in Teams.

For a law firm, that suggests a few working patterns:

• Group by who needs access. A site per practice group suits work the whole group shares. A matter that only a few people should see is better in its own site or private channel.
• Avoid one-off exceptions on folders. Special permissions on single folders and files are hard to see and harder to review. If a matter needs different access, give it a separate space.
• Keep sensitive matters out of broad sites. When a matter has to be kept away from others in the firm, a separate site with a short membership list is easier to check, and to explain later, than a folder tucked inside a shared site.
• Change membership when people move. When a lawyer changes team or leaves, their group memberships should change the same day.

3. External sharing controls

Lawyers send documents to clients, counsel, experts and the other side every day. Microsoft 365 gives the firm several layers of control over how that happens.

Three kinds of sharing link

• Anyone links open for whoever holds the link, with no sign-in. Microsoft notes that they can be forwarded and that access through them can't be audited.
• People in your organisation links work only for signed-in members of the firm's own Microsoft 365 organisation. Guests can't use them.
• Specific people links work only for the people named when the item is shared, inside or outside the firm, and each recipient has to sign in or verify as that person.

Settings at two levels

External sharing is set once for the whole organisation and again for each site. A site can be stricter than the organisation but not looser, and where the two differ, the stricter setting applies. Microsoft notes that external sharing is switched on for the organisation by default, and that the starting setting for a new site depends on its type.

Settings worth choosing on purpose

• whether Anyone links are allowed at all and, if they are, a maximum number of days before they expire and a view-only limit;
• the default link type people see when they click Share, which can be set per site;
• an expiry for guest access, so a guest invited for one matter doesn't keep access for years;
• a list of email domains the firm will or won't share with;
• which sites may share outside the firm at all.

Microsoft's advice is to keep confidential information in a site with external sharing turned off and to create separate sites for sharing outside the organisation. For a firm, that can mean an internal matter site plus a smaller client-facing space holding only the documents meant for the client.

When a matter closes, remove guests who no longer need access and delete links that are no longer needed. Removing a guest's permissions, or deleting an Anyone link, ends that access.

4. Sensitivity labels, in general terms

A sensitivity label is a tag such as "Internal" or "Client confidential" that a person, a default or a rule applies to a document, an email or a whole site. Microsoft describes labels as a way to classify and protect information without getting in the way of collaboration. Depending on how it is set up, a label can:

• add a header, footer or watermark, so a printed or forwarded document still shows how it is classified;
• encrypt the content and limit what named people can do with it, such as view but not edit;
• apply settings to a whole team, Microsoft 365 group or SharePoint site, including its privacy, external sharing and access from unmanaged devices.

The label is stored in the file's metadata, so it stays with the document wherever it is saved. A label on a site protects the site. Microsoft notes that documents inside the site don't inherit it, so files need labels of their own if they need encryption or markings.

Microsoft's documentation also carries some cautions worth repeating. Keep the number of labels small. Making a label that encrypts the default for all documents is usually a poor choice, because it can get in the way of sharing that people legitimately need to do. Requiring a label on everything, without training, tends to produce wrong labels.

A sensible first step for many firms is three or four labels with plain names, a visible marking on the most sensitive, and encryption kept for documents that really need it. Which of these features the firm can use depends on its Microsoft 365 licences.

5. Retention, in general terms

Retention settings tell Microsoft 365 to keep content for a set period, delete it after a set period, or keep it and then delete it. They are different from the firm's retention policy, which is a document the firm writes. The settings are one way of applying that policy to mail and files in Microsoft 365.

• Retention policies apply one rule to a whole location, such as every mailbox or a group of sites.
• Retention labels apply a rule to individual items, such as a folder, document or email, and go with an item if it moves elsewhere in Microsoft 365. A label can also mark an item as a record, which restricts editing and deletion.

Content under a retention setting stays where it is, and people keep working with it as normal. If someone edits or deletes a retained file in SharePoint or OneDrive, a copy is kept in the site's Preservation Hold library, which counts toward the site's storage. Where settings overlap, keeping wins over deleting and the longest period applies.

Two limits are worth knowing. Retention labels don't stay with content once it leaves Microsoft 365, so a document exported to the matter system is governed by that system instead. And retention keeps its copies inside the same tenant, so it is a different safeguard from an independent backup held outside it.

6. Beside a practice or document management system

Where a firm uses a dedicated practice or document management system, Microsoft 365 usually carries mail, meetings, chat and work in progress, and the dedicated system holds the matter record. The two meet in a handful of places:

• Email filing. Messages are filed from Outlook to the matter. Decide whether the filed copy or the mailbox copy is the record, and whether mail is removed from the mailbox after filing.
• Drafting. Documents opened from the matter system into Word should be saved back there. Copies left in OneDrive or on a desktop drift out of date.
• Sharing. If the matter system has its own client portal, decide when lawyers use it and when they use a SharePoint link, so documents don't leave by two routes with different controls.
• Retention. Microsoft 365 retention settings shouldn't quietly keep, or delete, copies the matter system is meant to govern. Line the two up when the policy is written.

The detail of add-ins, sign-in, updates and testing is in our guide to practice systems and Microsoft 365.

7. Questions to settle before anything is configured

1. 7.1
   Which system holds the record for each kind of document? Write it down and tell staff where to save.
2. 7.2
   Who can see each matter? Start from the practice group, with separate spaces for matters that need tighter access.
3. 7.3
   How do documents reach clients and counsel? Choose one or two approved routes, with expiry set for links and for guest access.
4. 7.4
   Does the firm need labels yet? If it does, begin with a few, named in plain language.
5. 7.5
   What does the retention policy say? The firm writes it. The settings follow it, including for the mailboxes of people who leave.
6. 7.6
   Who reviews access, and how often? Someone should look at site membership and external sharing on a regular cycle, such as each quarter.

8. Where we fit

Setting up and managing Microsoft 365, including SharePoint, OneDrive and Teams, is part of our $150 per user, per month. We configure sites, sharing and retention to match the decisions your firm makes, record each change in your documentation register, and back up Microsoft 365 outside the tenant with scheduled restore tests. We don't set retention periods or give legal advice about confidentiality or privilege.

For the security controls that protect client information, see cyber security for law firms and Microsoft 365 for law firms.

9. Sources

The Microsoft features described in this guide were checked against these Microsoft Learn pages. Anything we could not confirm there has been left out.

• Sharing and permissions in the SharePoint modern experience Microsoft Learn
• How shareable links work in OneDrive and SharePoint in Microsoft 365 Microsoft Learn
• Overview of external sharing in SharePoint and OneDrive in Microsoft 365 Microsoft Learn
• Manage sharing settings for SharePoint and OneDrive in Microsoft 365 Microsoft Learn
• Change the sharing settings for a site Microsoft Learn
• Learn about sensitivity labels Microsoft Learn
• Use sensitivity labels to protect collaborative workspaces (groups and sites) Microsoft Learn
• Learn about retention policies and retention labels Microsoft Learn