AI Builds: How Secure is Microsoft?

Your email is in Outlook. Your briefs are in Word. Your client files sit in SharePoint and OneDrive. Now Microsoft wants to put Copilot in the middle of all of it, and Copilot will find anything your permissions already let you see. In this AI Builds episode, Ron Drescher argues that the real risk isn't Microsoft's security. It's whether your firm ever configured it.

How secure is Microsoft, and how secure is your firm's use of it?

In this episode:

- The three-legged stool applied to Microsoft 365: Microsoft secures the platform, your firm configures it, and every user still holds a key
- What Microsoft 365 actually protects (encryption, multifactor authentication, sign-in monitoring, auditing) and why your subscription tier decides which protections you have
- The two questions to ask about any Microsoft security feature: does my plan include it, and is it turned on?
- "Folder mania" in the cloud: how years of loose SharePoint and OneDrive permissions become a live problem once AI can search them
- Why Copilot can surface a confidential client file without breaking a single rule: it followed the rules, but the rules were wrong
- Sorting out the Copilot family: consumer Copilot, Microsoft 365 Copilot Chat, and the fully integrated Microsoft 365 Copilot
- What you are really authorizing when you click "Connect your Microsoft 365 account" on a third-party legal AI tool
- User-level vs. application-level permissions, and four questions to ask any AI vendor before granting access
- The five admin locations a small firm should know: Microsoft 365 Admin Center, Microsoft Entra, SharePoint Admin Center, Microsoft Defender, and Microsoft Purview

We also discuss:

- Why cloud storage is not a backup or disaster recovery plan
- Ransomware as a business continuity question: could you meet tomorrow's filing deadline?
- Why you shouldn't change unfamiliar security settings in the middle of a workday
- The "miscellaneous" folder nobody has opened since 2017
- Five questions to bring to whoever manages your firm's technology
- The AI paradox: new tools make old security mistakes more expensive

Download: How Secure Is Microsoft? A Microsoft 365 Security Guide for Solo and Small-Firm Lawyers
A nine-page companion to this episode (and to How Secure Is Google?) It walks you and your IT provider through six places to review in Microsoft 365, with Microsoft-published screenshots and exact menu paths.
- Users, administrators, and stronger sign-in through security defaults or Conditional Access
- Client sharing limits in SharePoint and OneDrive, and the permissions you've already granted to outside apps
- Oversharing reports to run before Copilot, plus how to confirm Purview auditing actually works
- A plain-English licensing page and a printable firm security checklist
https://lawyeraitoolkit.com/deliverables#row-WoaNrpcH4Y

Key Takeaway

Copilot doesn't create your permission problems. It exposes them. A SharePoint site that has been quietly overshared for five years was a low-grade risk when nobody could search it. Put an AI assistant on top, and an associate can surface another client's confidential file by asking one question. Microsoft built the lock. Your firm decides who holds the keys.

Simpsons lawyers feel this first. They've turned on Copilot or connected a new legal AI app without ever opening Entra or the SharePoint Admin Center. Flintstones lawyers running Microsoft 365 out of the box carry the same oversharing risk; they just haven't triggered it yet. Jetsons lawyers building on Microsoft data need to know exactly what permissions their tools hold. The answer is yes to AI inside Microsoft 365, if you've audited who can open the folders first.

Mentioned in This Episode

- Microsoft 365 (Business Basic, Business Standard, Business Premium)
- Outlook, Word, Excel, PowerPoint, Teams
- Exchange Online, OneDrive, SharePoint
- Microsoft Entra
- Microsoft Copilot (consumer), Microsoft 365 Copilot Chat, Microsoft 365 Copilot
- Microsoft 365 Admin Center
- SharePoint Admin Center
- Microsoft Defender
- Microsoft Purview
- Companion episode: AI Builds: How Secure Is Google?
- Prior episode on "folder mania"
- Microsoft's security documentation
Microsoft 365 Copilot: Data, Privacy, and Security — Microsoft's explanation of how Copilot handles organizational information, protects prompts and responses, and respects existing Microsoft 365 permissions. Particularly relevant to the distinction between using AI and giving AI access to your firm's documents.

Microsoft: Enterprise Data Protection for Copilot — Explains Microsoft's enterprise data protection commitments, including restrictions on using organizational prompts and responses to train foundation models. Useful for distinguishing business Copilot experiences from consumer AI services.

Microsoft Entra: Permissions and Consent — Explains how third-party applications obtain permission to access Microsoft 365 information, including the important distinction between delegated permissions and application permissions. This is especially relevant when a lawyer connects an outside legal AI product to Outlook, OneDrive, or SharePoint.

Microsoft Cloud: Shared Responsibility Model — Explains which security responsibilities belong to Microsoft and which remain with the law firm, including user identities, device security, access permissions, and configuration. This is the official Microsoft resource supporting our Three-Legged Stool concept. Microsoft Learn

Microsoft: Manage Copilot Chat — Explains how administrators can manage employee access to Copilot Chat, including restrictions and application availability. Useful for lawyers who want to control when and how AI becomes available within their Microsoft environment. Microsoft Learn

Microsoft: Copilot Security and Governance — Explains how Microsoft addresses excessive document sharing, AI access to organizational information, and compliance controls. Particularly relevant to our Foldermania discussion and the risk of Copilot discovering documents that employees already have permission to access but shouldn't. 

[email protected]

Highlight Reels on YouTube and Instagram