Does this person still need the account, group or licence?
Find stale or inactive users and review the access still attached to them rather than assuming every directory object remains current.
Correlta for Law Firms & Solicitors
Find the access, device or sharing problem before it becomes a client-data problem.
See stale accounts, external sharing, endpoint protection, patching, backups and service issues across the firm, then get to the person, device or access path behind them without rebuilding the answer from separate systems.
Confidential work depends on ordinary IT getting the basics right
Fee earners
Leavers & movers
External sharing
Hybrid devices
Cyber security
Backups
Service continuity
The legal-sector question
Who can still get to what, and what evidence do you have right now?
Client confidentiality continues as people change roles, leave the firm or retain links created months earlier. The practical challenge is establishing where access still exists and whether the surrounding device and account evidence is current.
Correlta gives the IT team a clearer starting point for access reviews: account activity, groups, licence assignments, external/public sharing, devices, protection and other connected evidence in the same operational context.
Who outside the firm can still access this file?
Where Microsoft 365 provides the evidence, follow external recipients, public links and group-based access back to the sharing route.
Is the device used for confidential work patched and protected?
Keep update and endpoint-protection attention attached to the actual laptop or PC rather than treating security as an organisation-wide percentage.
Joiners, movers and leavers
Access usually becomes risky quietly, not dramatically.
A new starter is visible. A departed solicitor with an inactive account, an old group membership or a licence still assigned is easier to miss. So is a user who changed team while their access history stayed behind.
Join
Start with the account and the devices attached to it.
Use identity, group and device evidence as the operational baseline for the person entering the firm.
Move
Review what stayed behind when the role changed.
Group membership and sharing evidence can highlight access worth checking when a fee earner changes team, office or responsibility.
Leave
Carry the leaver review beyond the account state.
Look at the broader picture: account activity, licences, groups, devices and external sharing that may still deserve deliberate review.
Microsoft 365 sharing
“Shared externally” is only the start of the question.
For legal work, the useful answer is who can access the file, whether that access is direct or inherited through a group or link, and whether it still makes sense now.
- Find external recipients and public links where the connected Microsoft 365 evidence supports it.
- Follow the access route through users, groups and sharing links rather than stopping at a single warning badge.
- Keep the review human: Correlta surfaces the evidence; the firm decides whether the sharing is appropriate.
Screenshot placeholder
Microsoft 365 / Shared files
File → recipient → user/group/link → external or public access
People & licences
Find the account that looks finished but still carries access or cost.
Use account activity, group membership and licence assignment together to identify leavers and stale users worth checking.
Real Microsoft 365 Users / Groups / Licences capture to follow
Devices & protection
Find the laptop that fell behind while the fee earner kept working.
See overdue updates, reboot attention and endpoint protection gaps with the affected device and user context attached.
Real Patching / Endpoint Security capture to follow
Client confidentiality
Client confidentiality depends on the whole working environment.
SRA guidance says firms must keep the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents, and that firms need appropriate arrangements to help meet that obligation.
Correlta makes surrounding technical evidence easier to inspect across identities, access paths, external sharing, endpoints, protection, backups and service history where the connected systems provide it.
Why the legal sector attracts attention
Sensitive information and high-value transactions make law firms useful targets.
The NCSC’s legal-sector threat report highlights ransomware, data theft and the risks created by changing working patterns, while the SRA notes that law firms and their clients are attractive targets because firms handle sensitive information and transactions involving large sums of money.
The practical implication is that the firm needs a reliable way to distinguish current evidence from stale evidence and get to the account, device, backup or service behind a concern quickly.
Real enforcement example
£60,000
ICO fine against DPP Law following a cyber attack.
The ICO said an infrequently used administrator account without MFA was used to gain access to the firm’s network, after which highly sensitive and confidential information was stolen and published.
ICO enforcement summary →Hybrid legal work
The office perimeter stopped being the useful boundary.
Fee earners work from offices, home, court, client sites and while travelling. The useful IT question is therefore not simply “is the office secure?” but whether the account and device in use still show the protection, patching and activity you expect.
Is the identity still behaving like an active member of the firm?
Use current account and sign-in evidence where available to flag stale or unusual lifecycle conditions for review.
Is the laptop still current, patched and protected?
Follow update and endpoint-security attention to the actual endpoint rather than waiting for the user to notice a problem.
Is the dependency still available and protected?
Keep backup, monitoring and service evidence close enough to investigate before a matter or deadline is affected.
A recovery plan is much more convincing when the backup evidence was checked before the incident.
The SRA expects firms to think about business continuity when cyber incidents could delay client service. Correlta helps surface failed or stale protection and service evidence so recovery and continuity conversations start with a clearer technical picture.
Which protected workload is no longer showing current evidence?
Find failed or stale protection before somebody needs the restore.
Which service stopped reporting?
Separate a genuine healthy state from a status that only looks healthy because the source has gone quiet.
Which issue is consuming the same fee-earner time repeatedly?
Use recurring demand and ownership history to decide when another quick fix is no longer enough.
A new confidentiality surface
AI adds another place where client information can leave the intended boundary.
In August 2026 the SRA warned firms about instances of confidential client information being entered into public AI tools, alongside risks from inaccurate AI-generated legal work.
As firms use more digital routes for legal work, identity, device, Microsoft 365 and sharing hygiene become more important. Correlta keeps that surrounding technical evidence easier to review alongside the rest of the firm’s IT estate.
The moments that matter
Get to the answer before the partner meeting becomes the investigation.
“Are we sure everything was removed?”
Bring together account activity, groups, licences, devices and sharing evidence so the offboarding review is broader than a disabled login.
“Who outside the firm can still access this?”
Use external/public sharing evidence to trace the access route before deciding whether it should remain.
“Are our laptops actually patched and protected?”
Move from an overall percentage to the endpoints and users behind the exceptions.
“Can we recover, and what else is affected?”
Use backup, monitoring and support evidence to establish the current position without opening every supplier portal first.
Connect the IT around legal work
Bring the operational evidence around your legal systems and security controls into a clearer view.
Correlta connects people, devices, Microsoft 365, sharing, security, backups, monitoring and support so the firm can answer technical questions faster.
Case, practice and document management
Matter content, client records, legal workflows and professional decisions remain in the specialist systems designed for them.
MFA, EDR, email security and access policy
Use connected evidence to make exceptions and operational context easier to find.
The operational IT evidence around the firm
People, devices, Microsoft 365, sharing, security, backups, monitoring and support brought closer together so the next question takes less time to answer.
Start with a real legal-IT question
Bring us the question that currently ends in three portals and a spreadsheet.
Who still has access? Which externally shared files need review? Which fee-earner devices are behind on protection? Which backup evidence has gone stale? We will follow the question through Correlta with you.