November 13, 2026
Law firms using Microsoft 365 should protect their environment with at least five layers of security: MFA, controlled user access, advanced email protection, Microsoft 365 data backups, and continuous security monitoring.
For a law firm with 10–50 employees, these layers help protect email, accounts, and business information without requiring lawyers and staff to become cybersecurity experts.
This is particularly important for Alberta law firms. The Law Society of Alberta’s Code of Conduct connects a lawyer’s duty of competence with understanding the benefits and risks associated with relevant technology. Lawyers also have professional obligations to protect confidential client information.
Here is a practical five-layer framework for securing Microsoft 365.
1. Configure MFA for Microsoft 365 Accounts
Passwords alone aren’t enough.
A successful phishing attack can give a criminal a legitimate employee’s username and password. Multi-factor authentication (MFA) adds another verification step before an account can be accessed.
For law firms, a straightforward target is:
100% of Microsoft 365 users protected by appropriately configured MFA.
MFA isn’t a complete cybersecurity strategy, but it creates an important additional barrier when passwords are stolen.
Techwel Computers provides MFA configuration as part of its Microsoft 365 management services.
2. Control Access With Proper Onboarding and Offboarding
A firm’s Microsoft 365 security depends on knowing who has access to what.
Every new employee should receive only the access appropriate to their responsibilities. When someone changes roles or leaves the firm, their access should be reviewed or removed promptly.
A simple framework is:
Join → Change → Leave
Join: Give new employees the accounts and permissions they need.
Change: Adjust permissions when responsibilities change.
Leave: Disable unnecessary access when employment ends.
Techwel Computers manages Microsoft 365 user onboarding and offboarding for clients so account administration becomes a defined process rather than an afterthought.
3. Add Advanced Email and Phishing Protection
Law firms depend heavily on email, making the inbox an important security boundary.
Phishing messages can imitate clients, colleagues, Microsoft login pages, vendors, or other trusted contacts. Their objective may be to steal passwords, redirect payments, deliver malware, or gain access to confidential communications.
That’s why Microsoft 365 security should include more than a spam filter.
Techwel uses advanced email security and phishing filtering to add another layer between potentially malicious messages and users.
Employees still need to be cautious, but good security shouldn’t depend entirely on every person identifying every sophisticated phishing attempt.
4. Back Up Microsoft 365 Data
Microsoft 365 provides a highly capable cloud platform, but law firms should still consider how important business data will be recovered when something is deleted, corrupted, or otherwise unavailable.
Ask four questions:
- What Microsoft 365 data is being backed up?
- How frequently is it backed up?
- How long is it retained?
- How would we restore it when needed?
Techwel provides Microsoft 365 data backups as part of its approach to protecting client environments.
The simple distinction is that security tries to prevent the incident, while backup helps you recover when prevention isn’t enough. A firm needs to think about both.
5. Monitor for Security Events and Respond Quickly
Even well-protected accounts can be targeted successfully.
That’s why the fifth layer is monitoring and response.
A Techwel Computers client experienced a password-phishing attack that compromised a shared mailbox on a Sunday afternoon.
There wasn’t an employee sitting at a desk waiting to notice something unusual.
Techwel’s monitoring tools and automated security responses detected the incident. The account was locked down, active logins were expired, and the attacker was logged out before any damage was done.
This example highlights an important question for any law firm evaluating its Microsoft 365 security: What happens when an account is compromised outside regular business hours?
Prevention matters. Detection and response matter too.
What Does the Law Society of Alberta Require?
Alberta lawyers should distinguish between a specific technology recommendation and their broader professional obligations.
The Law Society of Alberta Code of Conduct addresses technological competence within a lawyer’s duty of competence. Its commentary states that lawyers should understand the benefits and risks associated with relevant technology. The Code also establishes lawyers’ obligations regarding confidential client information.
That does not mean every Alberta lawyer is required to purchase a particular Microsoft 365 product, cybersecurity package, or managed IT service.
Instead, firms should evaluate their technology risks and put appropriate safeguards in place for their particular practice.
A 5-Point Microsoft 365 Security Check
An Alberta law firm can start with five questions:
MFA: Are all appropriate Microsoft 365 accounts protected by MFA?
Access: Do we have a defined process for employee onboarding and offboarding?
Email: Do we have advanced protection against phishing and malicious email?
Backup: Is our Microsoft 365 data independently backed up and recoverable?
Monitoring: Who detects and responds to suspicious account activity?
If you’re unsure about one or more answers, you’ve identified a useful place to begin your security review.
Microsoft 365 Support for Edmonton Law Firms
Techwel Computers is a family-owned Edmonton IT company providing managed IT, cybersecurity, and Microsoft 365 support.
We help businesses manage MFA configuration, employee onboarding and offboarding, advanced email security and phishing filtering, Microsoft 365 data backups, and security monitoring and alerts.
And when a Techwel client needs help, a real person answers the phone. We provide both remote and on-site support from our local Edmonton team.
For a 10–50 employee law firm, the goal isn’t to make Microsoft 365 more complicated. It’s to make sure the technology your firm already relies on is appropriately managed, protected, monitored, and recoverable.
Book a Discovery Call with us: https://www.techwelcomputers.com/discoverycall/
