The 3 settings every Anchorage law firm should change in Microsoft 365 today

Most Microsoft 365 tenants are set up to work, not set up to be secure. The default configuration gets email flowing and documents accessible, and it stops there. For a general small business that gap matters. For a law firm, it matters substantially more.

Law firms carry privileged communications that opponents, opposing parties, and bad actors have real motivation to access. They handle trust account transactions that wire-fraud actors specifically target. They have bar obligations around client data that create legal exposure if a breach occurs and reasonable safeguards were not in place. And the pattern we see when we review law firm tenants in Anchorage is that most of them are configured the same way a two-person consultancy or a neighborhood shop would configure Microsoft 365 out of the box.

These three settings are the highest-impact changes I can point a law firm toward in a single hour. All three are free. All three are already in your existing Microsoft 365 subscription. None of them require a new product or vendor.

1. Enforce multi-factor authentication and block legacy authentication protocols

If there is a single change that matters most for any Microsoft 365 tenant, this is it. Multi-factor authentication (MFA) requires a second verification step beyond a password before a login succeeds. Even if an attacker obtains a user’s password (through phishing, a credential database breach, or a reused password from another site), they cannot log in without the second factor.

For law firms the stakes are specific. A partner’s email account contains years of privileged client communications. If one is compromised, the attacker can monitor ongoing matters, intercept wire transfer instructions, or impersonate the attorney in correspondence with clients, opposing counsel, or courts. Wire fraud targeting law firms during real estate closings and case settlements is a documented attack pattern. The initial compromise almost always starts with an account takeover that MFA would have blocked.

The fastest way to enable MFA across your entire tenant is through Security Defaults in the Entra ID portal. Go to Microsoft 365 Admin Center, then Identity, then Overview, then Properties, then Manage Security Defaults. Security Defaults are one toggle. They enforce MFA for all users, block legacy authentication protocols, and require the Microsoft Authenticator app or a compatible TOTP app for sign-in. It takes about two minutes to enable and it is the single most impactful security change available to a business on any Microsoft 365 plan.

The “block legacy authentication protocols” piece is important and often skipped. Legacy protocols like IMAP, POP3, and SMTP AUTH bypass the modern authentication stack entirely, which means they bypass MFA. Some older email clients still use them. An account protected by MFA is still vulnerable through a legacy protocol connection if legacy auth is not explicitly blocked. Security Defaults handle this automatically.

If your firm is on Microsoft 365 Business Premium or E3, you have Conditional Access policies available in addition to Security Defaults. Conditional Access gives you more granular control (MFA required when signing in outside the office network, for example, with trusted locations bypassing the prompt for staff signing in from the office). That is worth configuring if you have the licensing. But Security Defaults on a Business Basic or Standard tenant is dramatically better than what most unmanaged tenants have, which is nothing.

2. Add external sender warnings and configure basic sensitivity labels

The second category is about helping your staff recognize when something looks wrong before they act on it.

External sender warnings display a banner or prepend a tag on any email arriving from outside your organization. The configuration is in the Exchange Admin Center under Mail Flow > Rules. You create a transport rule that either prepends [EXTERNAL] to the subject line or adds a warning banner in the message body for any email where the sender domain is outside your organization. This is free, it is a five-minute setup, and it makes spoofing attempts visible. An attacker impersonating a partner’s email address from an outside domain is immediately flagged. A fraudulent invoice arriving from a look-alike domain gets tagged before anyone clicks the payment link.

For law firms this matters because impersonation attempts are specific and motivated. Criminals impersonate title companies, opposing counsel, financial institutions, and clients. The goal is usually to redirect a wire transfer or extract information under false pretenses. An [EXTERNAL] tag does not stop a sophisticated attack, but it trains staff to pause before acting on any email that is asking them to transfer funds or share sensitive documents, which is where most of these attacks succeed.

Sensitivity labels and basic DLP are available in the Microsoft Purview compliance portal for Business Premium and E3 tenants. The minimum worth configuring for a law firm is: a sensitivity label for privileged materials (something like “Confidential - Attorney-Client Privilege”), a basic data loss prevention policy that flags or blocks emails containing Social Security numbers and financial account numbers being sent externally, and an alert for when a user forwards an unusual volume of email to an external address. None of this replaces a complete compliance program, but the default state (no labels, no DLP policies, no alerts) is genuinely worse than having the basics in place.

For firms handling real estate transactions, trust account matters, or cases involving financial information, even a simple DLP policy that notifies an administrator when an email containing a bank account number goes to an external recipient can be the difference between catching a misdirected wire before it clears and discovering it afterward.

More on how we configure Microsoft 365 security for Anchorage clients is on the Microsoft 365 services page.

3. Audit mailbox forwarding rules and turn on the unified audit log

This is the most commonly missed setting and arguably the most important for post-incident response, bar compliance, and proving what happened.

Mailbox forwarding rules allow incoming email to be silently copied to an external address. This is the most common persistence technique attackers use after compromising a Microsoft 365 account. They log in, create a forwarding rule, and leave. From that point forward every email the victim receives is also going to the attacker. No additional logins required. No emails sent. Just a quiet forwarding rule that drains the inbox to an external address for as long as nobody looks.

For law firms this is a specific risk around trust account matters and case settlements. The attacker monitors correspondence for weeks or months, learns the transaction details, and at the right moment injects fake wire instructions that appear to come from a trusted party. The forwarding rule is often in place for the entire monitoring period.

Check your forwarding rules in the Exchange Admin Center under Recipients > Mailboxes. Select each user’s mailbox and look for forwarding address configuration. Also check inbox rules for each user: the Exchange Admin Center shows mailbox rules, and any rule that forwards or redirects incoming mail to an external address that the user did not intentionally set up is a compromise indicator worth investigating immediately.

The unified audit log is how you demonstrate what happened after an incident. It records user logins (including failed attempts from unexpected locations), mailbox access (who read which emails), file access in SharePoint and OneDrive, admin configuration changes, and more. For a law firm facing a bar complaint, a malpractice claim, or a client inquiry about whether their matter files were accessed, the audit log is the evidence chain.

The problem is that it is not enabled by default on all tenants. It must be turned on manually. In the Microsoft Purview compliance portal, go to Audit and check whether auditing is on. If it is not, turn it on now. Audit data begins accumulating from the moment you enable it. You cannot retroactively capture what happened before enablement. If you wait until after an incident to check, you will have no log to review.

Microsoft 365 Business and Business Premium plans include 90 days of audit log retention. Microsoft 365 E3 and the Microsoft 365 Audit add-on extend that to one year. For firms under regulatory review or in active litigation, one-year retention is the more defensible posture and the cost is reasonable relative to the risk it addresses.

What we typically find

When we run the free IT Health Check for a law firm in Anchorage, the same gaps come up repeatedly: Security Defaults not enabled (or enabled but with legacy auth still allowed for specific service accounts), no external sender warning on the tenant, and the unified audit log either off entirely or on but with retention at the default 90 days that nobody is monitoring. Sometimes two of the three gaps, sometimes all three.

These are not exotic misconfigurations. They are the default state of a Microsoft 365 tenant that was set up to work and then left alone. Fixing all three takes less than two hours of configuration work in the admin portals your subscription already includes.

If your firm works with clients on trust account transactions, real estate closings, or matters involving personal financial information, the three settings above are the starting point. They do not replace a complete security review, but they close the most commonly exploited gaps with no additional cost.

The fuller picture of what a Microsoft 365 security configuration looks like for a law firm is in the law firms services page. The free IT Health Check is where we start that conversation for new clients.