Most law firms I look at have a shared mailbox a former employee can still sign into.
Here's how it happens. Someone leaves. You convert their mailbox to a shared mailbox so the team keeps the history — smart move, and Microsoft's own instructions walk you right through it. But one line in those instructions is easy to skip: if you don't reset the password, the original username and password keep working on that mailbox after the conversion.
So the paralegal who left in March still holds credentials that open intake@ or billing@. Nobody did anything wrong. The cleanup step is just optional, and nothing warns you.
Calendars have a quieter version of the same problem. Out of the box, Microsoft 365 lets any user share their calendar with anyone who has an email address — including publishing it to a link anyone can open. A partner's calendar with full detail turned on is a list of who you're meeting and what the matter is called.
None of this is hard to fix. Block sign-in on every shared mailbox account, reset the password on any mailbox you converted, and set calendar sharing to free/busy only.
It's a twenty-minute job. Much better conversation to have now than after a client asks why their matter showed up somewhere it shouldn't.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email