Protecting Confidential Client Information in Microsoft 365

Your clients trust you with more than documents

A professional services firm sells judgment, and that judgment is built on information clients hand over in confidence: contracts, financial statements, strategy, personal details, the facts of a dispute. For firms that use Microsoft 365, much of it lives there, in mailboxes, shared libraries and chat. A single compromised account or an overly open folder can expose a great deal of it.

Clients, engagement letters and professional obligations often expect firms to protect that information. The specifics vary by profession and by contract, so we do not describe them here. The practical question is the same everywhere: can you show that the people who can see a client's information are the people who should?

Where client confidences commonly leak

• Compromised accounts. A stolen password or an approved sign-in prompt can give an outsider the same view of client email and files as the employee.
• Sharing that goes too far. A link meant for one client can be forwarded, or a folder shared with "anyone with the link" can stay open long after the engagement ends.
• Access that is never removed. Staff and contractors move between matters or leave, and their permissions can stay behind.
• Mail rules and forwarding. An automatic rule can send copies of client email outside the firm without anyone noticing.
• Broad internal access. If every employee can open every client folder, one mistake or one stolen account reaches everything.
• Unmanaged devices. Client files synced to a personal laptop or phone sit outside your control.

Protections worth reviewing

Microsoft 365 includes many controls that help, though some depend on your license level. Settings differ between organizations, so these are areas to check rather than a list of switches to flip.

1. Strong sign-in. Require multifactor authentication for everyone, including partners, administrators and shared or service accounts. Consider which methods people use, since some are harder to trick than others.
2. Conditional Access. Where your license includes it, these policies can require more proof of identity, or a managed device, in riskier situations. Conditional Access requires Microsoft Entra ID P1 or higher.
3. Least privilege. Limit administrator roles to those who need them and keep them separate from everyday accounts. Give staff access to the client matters they work on, not the whole firm's files.
4. Careful external sharing. Decide who may share outside the firm, with whom, and for how long. Prefer links limited to named people, and review them when an engagement closes.
5. Sensitivity labels and data loss prevention. Where available, these let you mark confidential material and limit how it is shared or sent. They need planning, but they can add a second layer of protection.
6. Mailbox protections. Restrict or monitor automatic forwarding to outside addresses, and turn on alerts for new forwarding rules.
7. Audit logging and retention. Know what activity is recorded and for how long, so you can answer questions about who opened what if a client asks.
8. Offboarding discipline. Remove access for departing staff and contractors promptly, and review who still has access to closed matters.

Defaults are a starting point

Microsoft publishes security guidance for its products, and newer organizations may have some protections on by default. Older environments may not. Even where defaults help, they are designed for a wide range of customers, not for the confidentiality expectations of your clients. Someone needs to review how the settings fit your firm, and to do it again as you grow.

Questions to ask this week

• Is MFA required for every account, and can we show that it is?
• Who can share client files outside the firm, and do we know what is currently shared?
• Who still has access to matters that closed last year?
• Would we notice a new forwarding rule on a partner's mailbox?
• If a client asked who had accessed their documents, could we answer?

Take the next step

Our free Microsoft 365 security assessment asks five quick questions about sign-in, email, sharing, devices and backup, and shows where a firm like yours can start. It is a short check, not a full review of your settings.

Related reading

• Is Microsoft 365 Secure Out of the Box?
• Could a Compromised Email Account Expose Your Clients?
• Who Still Has Access to Former Client Files?