Legal · Microsoft 365 security & backup

Hardening a law firm's Microsoft 365 against phishing and closing the backup gap

Partners were being targeted with convincing phishing and business-email-compromise attempts, and the firm assumed Microsoft 365's retention was a backup. Neither assumption was safe.

Talk to our team ➔

Phishing-resistant

MFA on high-risk accounts

Independent

Backups with tested restores

Controlled

Access and offboarding

Representative engagement — A mid-sized law firm handling sensitive client matters (anonymized). Details are anonymized and illustrative of how we work; outcomes are directional, not a claim about a specific named client.

The challenge

Attackers targeted partners with credential phishing and wire-fraud attempts against client trust accounts.
The firm believed native Microsoft 365 retention was a backup — it is not — leaving mailboxes and files exposed to deletion and ransomware.
Access was over-permissioned, and offboarding left accounts and sessions lingering.

Our approach

Rolled out phishing-resistant MFA and conditional access, starting with partners and finance, plus SPF, DKIM, and DMARC enforcement.
Added true, independent Microsoft 365 backup with tested restores for mail, files, and SharePoint.
Tightened least-privilege access and put joiner-mover-leaver on a controlled, audited process.

The outcome

Credential phishing and MFA-fatigue attacks no longer grant account takeover.
Deleted or ransomed mailboxes and files can be recovered from independent, tested backups.
Wire-fraud attempts hit process controls — out-of-band verification and dual approval — not just inboxes.

Built for regulated, audited environments

We deliver the controls and evidence that make your audits possible — hardening and operating practices aligned to the frameworks your assessors and customers recognize.

SOC 2

ISO 27001

HIPAA

PCI DSS

CIS Controls

NIST CSF

GDPR

Services in this engagement

Related insights

Have a similar challenge?

Tell us your environment and priorities — we return scope, ownership, and a plan.

Contact intSignal