Situation
A law firm in Vilnius with 30 employees: partners, lawyers, assistants and administration. All work runs in a Microsoft 365 environment: Outlook, Teams, SharePoint and OneDrive. Over five years, dozens of SharePoint sites had accumulated, each created however the person saw fit: some by client, some by lawyer, some just called “New site (3)”. Access was shared with “everyone in the organisation” links, because that was simpler.
The managing partner wanted to deploy Microsoft 365 Copilot. Lawyers were already using public AI tools for contract summaries, which raised confidentiality questions. Before the pilot, the firm’s IT lead ran a simple test: he typed one client’s name into search and saw case documents he had nothing to do with. Copilot would only speed up that kind of access: it answers based on everything the user can see.
The second question was backups. The firm believed that Microsoft keeps everything, until a lawyer accidentally deleted a client folder and, after 90 days, it turned out that it was no longer in the recycle bin.
What was needed
- A clear access structure: case documents are seen only by the team working on the case.
- Sensitivity labels so that confidential documents are marked and protected automatically.
- Independent Microsoft 365 backups with the ability to restore an email or document even after a year.
- A Copilot pilot that would not put client data at risk and would show real benefit.
- Minimal disruption for lawyers: not a single day without access to case files.
What we did
Weeks 1-2: access inventory
We compiled a report of all SharePoint sites, Teams teams and sharing links. The result: 46 sites, 19 of them with access for the whole organisation, and 230 active “anyone with the link” links. Together with the partners we agreed a new structure: one site per practice group, one case per Teams channel, and access through groups, not individuals.
Weeks 3-4: Microsoft 365 security cleanup
This was Microsoft 365 security work: we disabled anonymous sharing, moved case files into the new structure according to the agreed scheme (old links kept working thanks to redirects), and set up the sensitivity labels “Internal”, “Confidential” and “Client file”. The last one automatically encrypts the document and prevents it from being forwarded outside the firm. We enabled conditional access with multifactor authentication for everyone and blocked sign-ins with personal accounts from firm devices.
Week 5: Veeam backups
We enabled Microsoft 365 backup with Veeam: Exchange, SharePoint, OneDrive and Teams are backed up several times a day to the MDP CLOUD data centre in Lithuania (EU) and retained for seven years, as the firm required. We performed the first restore that same week: at a lawyer’s request we brought back an email thread deleted a month earlier.
Weeks 6-7: Copilot pilot
We enabled Microsoft 365 Copilot for ten lawyers. Beforehand we checked what each person sees: a search by client name now shows only the cases of their own team. The pilot lasted two weeks: contract summaries, meeting minutes from Teams, first drafts of replies to enquiries. Together we prepared a short usage policy: what is allowed, what is not, and how to check the results.
During the pilot every participant kept a simple log: which task they used Copilot for, how long it took before and how long now, and whether the result needed correcting. We also checked whether documents from other teams’ cases appeared in Copilot answers; in two weeks there were no such cases. The hardest part was not the technology but habits: some lawyers initially still tried to use public tools because they were familiar. Short practical sessions with concrete examples from the firm’s daily work helped.
Result
Confidential case files visible to the whole firm: none, zero, and this is checked every month by an automated report. Restoring a deleted email or document from a Veeam backup takes about 15 minutes, regardless of when it was deleted. The pilot participants estimated the saved time themselves: on average about 3 hours per week per lawyer, mostly from preparing summaries and minutes.
After the pilot, Copilot was extended to all lawyers. Use of public AI tools with client data is prohibited by internal policy and, technically, by DLP rules. We continue to look after the firm’s Microsoft 365 environment: new sites are created from an agreed template, and the access report goes to the managing partner every month.
“The biggest benefit is not Copilot, but that we finally know who sees what.”
What we would advise in a similar situation
- Fix access before Copilot. Copilot does not change permissions, it only shows what they really are.
- Sensitivity labels work only when there are few of them and they are clear. Three labels that everyone understands are better than ten.
- Microsoft 365 is not a backup. Deleted data disappears after a set period; an independent backup is the only way to bring it back after a year.
- Start the pilot with a few employees who will measure the benefit themselves. It is the best argument for the board.
