Co-managed technology support for legal offices using Microsoft 365 gives you a practical middle ground between carrying every IT responsibility internally and handing over full control to an outside provider. Your firm keeps ownership of client service, legal workflows, and technology decisions. A co-managed partner adds capacity, specialized Microsoft 365 skills, security monitoring, and defined escalation coverage.
For law firms, this is not simply a help desk arrangement. Microsoft 365 contains sensitive client communications, matter documents, calendars, mobile access, and collaboration records. The support model must protect confidentiality while keeping lawyers and staff productive when deadlines cannot move.
Table Of Contents
- Key Takeaways
- Why Legal Offices Choose Co-Managed Support
- How To Split Microsoft 365 Responsibilities
- Building Security, Retention, And Recovery Into Daily Operations
- Frequently Asked Questions
- Sources
Key Takeaways
• Co-managed support works best when your firm clearly documents who owns user support, tenant administration, security response, legal hold, retention, and vendor escalation.
• Your firm remains accountable for confidential client information even when an external provider administers Microsoft 365 or monitors security tools.
• Microsoft Entra, Intune, Defender, Purview, Exchange Online, Teams, SharePoint, and OneDrive should be managed as one connected operating environment rather than separate tools.
• The strongest co-managed arrangements measure results through response times, MFA coverage, restore testing, unresolved ticket aging, access reviews, and retention-policy compliance.
• A provider should receive only the administrative access needed for its assigned work. Broad global administrator access may be convenient, but it creates unnecessary risk.
• Microsoft 365 backup, retention, and legal hold are related but different controls. Your firm should understand what each one preserves and who activates it during a matter or incident.
Why Legal Offices Choose Co-Managed Support
You Keep Control Without Carrying Every Technical Burden
Co-managed support means your internal IT resource and an outside technology provider share defined responsibilities. It is useful when you have an office administrator, IT manager, or technically capable staff member who understands the firm but cannot reasonably manage every Microsoft 365 alert, endpoint issue, security policy, and vendor case.
A real estate law office offers a simple example. The internal team may know which staff need access to a transaction workspace, which legal application affects closing day, and which workflow cannot be interrupted. A co-managed provider can handle Conditional Access policy changes, Exchange Online troubleshooting, after-hours escalation, device compliance, and Microsoft support cases.
This arrangement differs from fully managed IT because your internal team stays involved in decisions and daily priorities.
| Support Model | Internal Team Role | External Provider Role | Best Fit |
|---|---|---|---|
| Fully Managed IT | Approves business decisions and budgets | Runs most technical operations | Firms with little or no internal IT capacity |
| Co-Managed IT | Owns firm knowledge, priorities, and selected technical tasks | Adds coverage, specialist skills, monitoring, and escalation | Firms with internal IT or a capable operations lead |
| Internal IT Only | Handles all support, governance, and security | Limited outside assistance | Firms with mature internal technical capacity |
The key benefit is not simply reducing tickets. It is reducing the number of issues that depend on one person being available, familiar with every system, and able to respond immediately.
For firms considering co-managed IT services, the first question should be straightforward: Which responsibilities are currently delayed, inconsistent, or dependent on a single employee? That answer should shape the scope.
Microsoft 365 Is A Legal Operations Platform
Legal teams rely on Microsoft 365 for much more than email. Exchange Online handles client communication. Teams supports internal coordination and meetings. SharePoint and OneDrive may contain matter documents, templates, working drafts, and signed records. Mobile devices create another layer of access risk.
When these services are managed independently, gaps appear. Consider a lawyer who leaves the firm:
- Their Microsoft 365 account is disabled.
- Their mailbox delegation remains active for another user.
- A personal OneDrive folder still contains matter drafts.
- A guest user still has access to a SharePoint site.
- A phone with cached email has not been removed from management.
None of these failures is dramatic by itself. Together, they can create a confidentiality problem that is hard to explain after the fact.
A co-managed model should connect onboarding, offboarding, identity, devices, document access, and retention into one workflow. That is especially valuable when legal work crosses departments, external parties, and tight transaction timelines.
Canadian Accountability Does Not Transfer To A Provider
Using a service provider does not remove your firm’s responsibility for client information. The Office of the Privacy Commissioner of Canada’s guidance for organizations using service providers states that Canadian organizations remain accountable for personal information handled by third-party service providers.
That principle has a practical effect on co-management. You should not accept vague statements such as “the provider handles compliance.” Instead, define what the provider does, what evidence it supplies, and which decisions remain with firm leadership.
For example, a provider may configure MFA, monitor alerts, and investigate suspicious sign-ins. Your firm should still approve acceptable-use rules, decide who can access highly sensitive matters, determine when external sharing is allowed, and direct legal or regulatory notification decisions.
A co-managed provider can operate controls, but your firm still owns the duty to make sure those controls fit the sensitivity of the information and the way your practice works.
How To Split Microsoft 365 Responsibilities
Start With A Written RACI
A RACI assigns who is Responsible, Accountable, Consulted, and Informed for a task. It may sound formal, but it prevents the most common co-management failure: both parties assume the other one owns a critical action.
Use a RACI before granting tenant access, not after an incident. The table below is a starting point, not a substitute for your own operating agreement.
| Microsoft 365 Activity | Internal IT Or Operations | Co-Managed Provider | Firm Leadership |
|---|---|---|---|
| User onboarding and role requests | Responsible | Consulted | Accountable for approval rules |
| Entra roles and MFA policy | Consulted | Responsible | Accountable for risk acceptance |
| Endpoint configuration through Intune | Consulted | Responsible | Informed |
| Help desk and routine device support | Responsible or shared | Shared or after-hours responsible | Informed |
| Email phishing response | Consulted | Responsible for containment | Accountable for business decisions |
| Retention labels and legal hold requests | Responsible for matter instruction | Responsible for technical execution | Accountable for policy |
| Guest access and external sharing rules | Consulted | Responsible for configuration | Accountable for approval |
| Microsoft vendor escalation | Informed | Responsible | Informed |
The important distinction is between technical execution and legal or business authority. A provider can implement a legal hold in Microsoft Purview. It should not independently decide which matter requires preservation, how long materials must be held, or when the hold can be released.
Use Least Privilege For External Support
External support is operationally possible because Microsoft 365 can scope administration through roles and delegated access. Microsoft explains this in its Microsoft 365 admin center delegated access and role guidance. The principle is simple: access should match the work assigned.
For example, a provider that supports Intune may need endpoint administration but not unrestricted access to eDiscovery content. A provider monitoring email threats may need security-related roles but not a standing global administrator role.
A safer access model usually includes:
• Named accounts instead of shared administrator credentials
• MFA for every privileged account
• Role assignments that match a documented service scope
• Time-limited privileged access where your licensing and operating model support it
• Regular reviews of provider accounts, internal admins, mailbox delegates, and guest users
Fair warning: least privilege can make urgent work slower if the model is poorly designed. The answer is not to give everyone broad access. The answer is to define an emergency elevation process, identify who can approve it, and record what was done.
Decide What Stays Inside The Firm
Keep work inside the firm when it requires matter context, authority over client relationships, or a business judgment that an external provider cannot safely make alone.
Examples include:
• Approving access to restricted files for a specific matter
• Authorizing external sharing with a client, lender, expert, or opposing counsel
• Directing legal hold scope and release decisions
• Approving exceptions to device or remote-access policy
• Deciding whether a suspected privacy incident requires client, insurer, regulator, or law society consultation
By contrast, a provider can usually take ownership of repeatable technical work such as patching managed devices, reviewing risky sign-ins, resolving Teams issues, enforcing Intune compliance, and escalating Microsoft service incidents.
If your firm uses Business Premium licensing, this overview of Microsoft 365 Business Premium for law firms can help you evaluate whether your licensing supports the controls you expect to operate.
Building Security, Retention, And Recovery Into Daily Operations
Treat Identity As The First Security Boundary
Most Microsoft 365 incidents begin with identity: a stolen password, a successful phishing attempt, a reused credential, or an account with more access than the person needs. That is why co-management should begin with Microsoft Entra, MFA, Conditional Access, privileged roles, and account lifecycle processes.
A practical baseline for a legal office includes:
• MFA for all users, with stronger controls for administrators
• Conditional Access rules that block or challenge risky sign-ins
• Intune compliance requirements for firm-managed laptops and mobile devices
• A defined method for personal-device access, including when access should be blocked
• Regular reviews of shared mailboxes, mailbox permissions, Teams owners, SharePoint site owners, and external guests
Personal devices are an important edge case. A lawyer may need urgent access to a closing document from a phone. Blocking every personal device may disrupt legitimate work. Allowing unrestricted synchronization may expose client data if the device is lost. A balanced policy may permit browser-based access with MFA while restricting downloads or requiring a managed device for sensitive document synchronization.
Control Sharing Before It Drifts
Guest access and external sharing need deliberate rules. Teams, SharePoint, and OneDrive make collaboration convenient, but convenience can quietly extend access beyond the intended group.
A common failure pattern looks like this: someone creates a Team for a matter, adds an outside participant, copies a document link into an email, and later assumes the access ended when the transaction closed. It may not have ended. The guest account, link, or site permission can remain unless someone reviews it.
Your co-managed process should define:
- Which users can invite guests.
- Whether guests need approval before receiving access.
- Which types of sites can contain external users.
- When guest access expires or must be reviewed.
- How your firm verifies that closed matters no longer expose documents unnecessarily.
This is not an argument against collaboration. It is a reason to make collaboration auditable.
Make Retention, Legal Hold, And Backup Work Together
Retention, legal hold, and backup are often grouped together, but they answer different questions.
| Control | Primary Purpose | Typical Legal Office Use |
|---|---|---|
| Retention | Keeps or deletes information according to policy | Preserve business records and matter-related information for a set period |
| Legal Hold | Prevents relevant information from being altered or deleted | Preserve data connected to a dispute, investigation, or matter |
| Backup | Supports recovery from deletion, corruption, or disruption | Restore mailboxes, files, or configurations after an operational event |
Microsoft Purview can support retention, legal hold, and eDiscovery workflows. In a co-managed environment, the technical configuration should be repeatable, while matter decisions remain controlled by the firm.
A workable legal-hold process usually follows this sequence:
- A lawyer or authorized leader identifies the matter and preservation scope.
- The firm documents who approved the hold and which people, sites, mailboxes, or Teams are relevant.
- The provider applies the technical preservation settings in Purview, following the approved instruction.
- The firm confirms that preservation aligns with the legal requirement.
- The provider records the implementation details and limits access to collected information.
- Release occurs only after an authorized firm representative provides documented direction.
Do not rely on default retention behavior as a substitute for a matter-specific hold. Defaults may not reflect the facts of a particular dispute, transaction, or professional obligation.
Data residency also deserves a direct question. Canadian firms may prefer Canadian data residency, but Microsoft 365 workload availability and storage locations can vary. Your provider should verify the specific workloads, licensing, and service commitments that apply to your tenant instead of making broad claims that every item of data is always stored in one place.
Rehearse Security Incidents Before One Happens
A co-managed relationship is tested during an incident, not during a quarterly meeting. Your incident plan should state who can contain an account, who preserves evidence, who contacts cyber insurance, and who makes notification decisions.
For a suspected Microsoft 365 account compromise, the first hours often follow this order:
- Contain: Disable the account or revoke sessions, reset credentials, remove suspicious mailbox forwarding, and block known malicious activity.
- Preserve: Export or retain relevant logs, email evidence, sign-in details, and affected files before normal cleanup removes useful context.
- Assess: Determine what the account accessed, whether data was shared externally, and whether other accounts show related activity.
- Recover: Restore safe access, validate MFA and device status, remove persistence mechanisms, and review privileged roles.
- Decide: Firm leadership, legal counsel, privacy advisors, and insurers determine notification and reporting obligations based on the facts.
- Improve: Document the cause, close the control gap, and test the revised procedure.
The provider may lead containment and technical assessment. Your firm should lead business decisions, client communications, and legal judgment. For a fuller view of this division, review how co-managed cybersecurity works with internal IT.
Measuring Whether The Arrangement Is Working
Use Metrics That Reflect Legal Risk And Service Quality
A ticket count alone can be misleading. A low ticket count may indicate stable systems, but it can also mean users are working around problems or waiting too long for help. Your scorecard should show both service performance and control health.
Track a manageable set of measures each month:
• Time to acknowledge urgent requests
• Time to resolve high-impact incidents
• Ticket reopen rate
• Number and age of unresolved critical issues
• MFA coverage for users and privileged accounts
• Percentage of managed devices meeting compliance policy
• Frequency and outcome of restore tests
• Guest-access reviews completed on schedule
• Number of inactive accounts, stale mailbox delegates, or unnecessary administrator roles removed
• Completion rate for retention-policy and legal-hold tasks requested by the firm
A useful quarterly review asks three questions: What disrupted legal work? What control failed or nearly failed? What should change before the next high-pressure day?
Avoid The “Single Point Of Contact” Trap
A single contact can simplify communication, but it can become a bottleneck when everything must pass through one person. This is common when an office manager is expected to translate every IT issue, approve every request, and coordinate every vendor.
Instead, define service paths. Routine user issues can go to the service desk. Matters involving access to highly sensitive files can go to a named internal approver. Security alerts can follow an incident path with after-hours contact details. Vendor escalation can go directly to the provider when authorized.
The right model is narrow enough to be clear and flexible enough to handle a closing-day emergency.
Frequently Asked Questions
What Does Co-Managed Technology Support Mean For A Law Firm Using Microsoft 365?
It means your firm and an external provider share responsibility for Microsoft 365 support, security, governance, and escalation. Your team keeps control of legal decisions and firm-specific workflows, while the provider supplies defined technical capacity and specialist support.
How Is Co-Managed IT Different From Fully Managed IT For Legal Offices?
Fully managed IT places most operational technology responsibility with the provider. Co-managed IT keeps an internal IT resource or operations leader actively involved. Choose co-management when you want added depth and coverage without losing day-to-day control of the tenant and legal workflows.
What Microsoft 365 Tasks Should Stay With Internal IT?
Keep tasks that require client, matter, or business context inside the firm. This includes approving sensitive access, directing legal hold scope, authorizing sharing exceptions, and making notification decisions after a suspected privacy incident.
What Tasks Should Be Delegated To A Co-Managed Provider?
A provider can commonly handle Microsoft 365 administration, endpoint management, security monitoring, incident containment, routine support, configuration maintenance, policy implementation, after-hours coverage, and Microsoft vendor escalation. The exact scope should be documented in a RACI.
How Should A Law Firm Handle Guest Access In Teams And SharePoint?
Set tenant-level rules for who can invite guests, which workspaces can be shared externally, and how long access lasts. Review guests and sharing links regularly, especially after a transaction or matter closes. Avoid treating external sharing as a one-time approval with no follow-up.
What Is The Best Way To Set Up Legal Hold And Retention?
Use a documented workflow. The firm identifies the legal requirement and scope. The provider applies the technical controls in Microsoft Purview. The firm verifies the result and authorizes release. Retention policies support routine records management; legal hold preserves data for specific matters.
What Happens If A Microsoft 365 Security Incident Occurs?
The provider should contain the technical threat, preserve evidence, assess exposure, and help recover systems. Firm leadership should direct legal, client, insurer, and notification decisions. Your incident plan should name contacts, authority levels, and the evidence to preserve before an incident occurs.
Sources
• Microsoft Learn – Microsoft 365 admin center delegated access and roles: https://learn.microsoft.com/
• Office of the Privacy Commissioner of Canada – privacy guidance for organizations using service providers: https://www.priv.gc.ca/