IT & Microsoft cloud for professional services

Most professional-services firms can answer perhaps two thirds of a serious questionnaire honestly and immediately. The remaining third tends to be the same items each time: a documented leaver process that is actually followed, evidence that backups have been tested rather than merely configured, a written incident response plan, and a clear statement of which subprocessors touch client data. Those gaps are usually days of work, not months, but only if you find them before a client does.

The efficient move is to prepare the answers once and reuse them. Firms that treat each questionnaire as a fresh scramble spend more partner time on it over a year than the underlying remediation would have cost, and they answer inconsistently, which itself invites follow-up questions.

The controls that work are the ones enforced by the platform. Permissions set at the matter or engagement level rather than a shared drive everyone can browse. Sensitivity labels that travel with a document, so classification persists when a file is copied, emailed or downloaded. Data loss prevention rules that stop a labelled document leaving by email or being shared to a personal account. And conditional access, so a document only opens from a managed, compliant device rather than from anywhere someone happens to be signed in.

Getting this right also makes the questionnaire above much easier to answer, because the honest answer becomes a description of a working control rather than a policy statement.

Practically that means multi-factor authentication everywhere as a baseline rather than an option, conditional access policies that evaluate device compliance and risk at sign-in, managed and encrypted devices whether they belong to the firm or the individual, and enough visibility to notice a sign-in that does not make sense. It also means being deliberate about personal devices, because in most professional firms people read email on their phones whether or not anyone has decided they may.

The trade-off worth being honest about is friction. Controls that are too aggressive get worked around, and a workaround is worse than a slightly looser control that people actually follow. The aim is policies that are strict where the data is sensitive and unobtrusive where it is not.

The obstacle is almost always permissions. Copilot surfaces what a user already has access to, which means it will cheerfully surface anything that has been over-shared. In a firm where a legacy file share was migrated with broad permissions, or where site access was granted generously years ago and never reviewed, the first serious result is often somebody finding a document they should never have been able to open. The tool did not cause that; it revealed it.

So the sequencing is: tidy the permissions and sharing model first, decide what should be labelled and restricted, then pilot with a defined group. Firms that do it in that order tend to get value quickly. Firms that buy licences first tend to pause the rollout within a month.

The immediate technical steps are straightforward if they have been prepared: revoke access at the identity layer so every connected application is cut at once rather than one by one, terminate active sessions so an existing sign-in does not simply continue, remove organisational data from personal devices, and convert the mailbox so colleagues can still reach ongoing matters without the account remaining live. Doing this at the identity layer rather than app by app is what makes it quick and complete.

The part firms most often lack is the evidence. Being able to show what a leaver had access to, when it was removed, and what data left with them matters if a dispute follows, and it is nearly impossible to reconstruct after the fact. Alerting on the pattern that usually precedes a resignation, unusual bulk downloads or sudden access to client material outside someone's normal matters, is worth having, and worth telling staff exists, since transparency about monitoring is both fairer and more effective as a deterrent.