Matters · Engagements · Client files

Managed IT for law, accounting and advisory firms

We run Microsoft 365, practice and document platforms and access to client and matter files, and keep current the security evidence your insurer asks for each year.

Discuss Managed IT See what we manage
$Managed IT cost calculator
Accountant reviewing year-end financials, with Microsoft 365 Copilot summarising the P&L in Excel
Client data secureDLP and sensitivity labels on client files, matter documents, email and Teams
Insurance evidenceMFA, patching, backup and restore evidence kept current for every renewal
Tested backupsImmutable backups of matters, client files and practice data, with restores tested
Governed CopilotPermissions, labels and sharing reviewed before Copilot reaches client files
Sector focus

IT for client-confidential work

Law firms, accounting practices and advisory firms hold information their clients trust them with, and each works with it differently: matters and document control, client files and lodgements, or engagements shared with clients and other advisers. We run the IT around each, from boutique partnerships to multi-office firms.

Law firms

Matters · Documents · Confidentiality

Law firms run on matters, deadlines, document control and client confidentiality, with practice and document platforms such as LEAP, Actionstep, FilePro, iManage or NetDocuments alongside Microsoft 365.

We look after the access, email, devices and secure sharing around those platforms, with matter-level permissions and the evidence your insurer asks for.

LEAPActionstepFileProiManageNetDocumentsMicrosoft 365
What we look after
  • Matter-level access and permission control
  • Reliable access to LEAP, Actionstep, FilePro or your practice system
  • iManage, NetDocuments, SharePoint or hybrid document environments
  • Secure email and file sharing with clients
  • DLP and sensitivity labels on matter files and correspondence
  • Cyber insurance evidence aligned to Essential Eight
  • Copilot and AI tools set up inside matter permissions
Evidence and controls

Evidence your insurer and clients can rely on

Insurers, larger clients and auditors now ask firms to show their controls. We keep that evidence current in your support portal and the monthly reporting you already receive, so renewal questionnaires and client security reviews are answered from records.

The same groundwork comes before Copilot: permissions reviewed, labels applied and old sharing links removed before AI reaches client files.

Example evidence packInsurance evidence for a mid-size practice
Kept current
OrderControl and how it’s evidencedReviewed
  1. 1
    MFA on every accountCoverage report from Entra ID, with exceptions listed
    Monthly
  2. 2
    Privileged accessAdmin accounts reviewed and kept separate
    Quarterly
  3. 3
    Patching and endpoint protectionPatch level and EDR coverage for every device
    Monthly
  4. 4
    Backups and restore testsImmutable copies, with restore results recorded
    Quarterly
  5. 5
    Email securitySPF, DKIM and DMARC, with impersonation protection
    Monthly
Agreed withPractice managerRun byInlight ITReportedMonthly
What we manage

The systems we look after day to day

The IT we look after around your practice platforms, client files and deadlines.

Users and IT support

Partners, fee earners and support staff message us in Microsoft Teams and follow the request there, with AI-assisted triage routing it to the right engineer. When a deadline is at risk, it’s a P1. Under our SLA-driven support model, the response target for a P1 incident is under 15 minutes.

Microsoft 365 and identity

MFA, Conditional Access and role-based permissions on every account, with access set up and removed as fee earners, graduates and contractors join, move or leave. Data loss prevention (DLP) and sensitivity labels are part of the setup, covering client files, matter documents and correspondence.

Computers and devices

Office and remote laptops, home-office setups and phones are managed to one standard, with endpoint protection, encryption and patching scheduled outside business hours.

Cloud, infrastructure and networks

Microsoft 365, Azure and hybrid document environments, chosen for how the firm’s files and practice platforms behave. Secure remote access, Wi-Fi and links between offices let people work from the office, from home or at a client’s premises.

Backup and recovery

Immutable backups across Microsoft 365, email, document platforms, client files and practice data, with restores tested. Systems are restored in the order client work needs them, starting with sign-in, email and live matters or engagements.

Vendors and practice platforms

LEAP, Actionstep, iManage, NetDocuments, Xero, MYOB, FYI Docs and NetSuite all depend on the devices, sign-in and connectivity we manage, and we coordinate with each vendor.

Cybersecurity and client data

Identity, endpoint and email security, patching and privileged access are part of the service, with Essential Eight-aligned controls and SOC and MDR where client data or your insurer calls for it. We watch mailbox rules and risky sign-ins for signs of business email compromise.

Copilot, AI and automation

Permissions, labels and old sharing links are cleaned up before Copilot reaches client files. We also agree rules for approved AI tools and build automation with Power Automate for document requests, client onboarding and reporting, inside the firm’s data boundaries.

Platforms we operate
MicrosoftFortinetCiscoSentinelOneProofpointNakivoIBMLenovo
Recent work

See the outcomes we’ve delivered for our clients

Financial services · Cybersecurity
OYA Financial Services
Protecting the payment decision
After responding to a BEC incident, we hardened OYA’s Microsoft 365 and identity controls and strengthened verification before high-risk payment details could change.
Read the OYA case study →
Common questions

Questions we get asked

Do the AML/CTF reforms affect our firm?
For certain services, yes. Lawyers, conveyancers, accountants and trust and company service providers now have AML/CTF obligations for designated services, including customer due diligence, PEP and sanctions screening, suspicious matter reporting and keeping records for seven years. The compliance program itself sits with the firm. We set up the IT those obligations depend on: controlled storage for due diligence records, access logging, retention and the evidence AUSTRAC or an auditor may ask for.
Do you support LEAP, Actionstep, iManage or NetDocuments?
We manage what those platforms rely on: devices, sign-in, Microsoft 365, email, permissions, secure sharing, backup and security. Configuration inside the legal application stays with its vendor or your platform owner, and we work with them when an issue crosses over.
Do you support Xero, MYOB, QuickBooks or FYI Docs?
Yes, the IT layer around them: Microsoft 365, identity, devices, client document exchange, backup and security. Most of these platforms are cloud-based, so the focus is secure sign-in, the right access for each staff member, and making sure client files exported from them are backed up and retained.
What cyber insurance evidence do insurers ask professional firms for?
Most renewal questionnaires ask whether MFA is on every account, how privileged access is controlled, how quickly patches are applied, whether devices have endpoint detection and response, how backups are protected and tested, and whether there is an incident response plan. Those answers come straight from your monthly reporting.
Is it safe to use Copilot with client files?
Yes, once permissions are right. Microsoft 365 Copilot works within each user’s existing permissions, so old sharing links, broad team sites and unlabelled client files can become visible through it. Before rollout we review SharePoint, Teams and OneDrive permissions, remove stale sharing, apply sensitivity labels and turn on DLP. After that, Copilot works inside the same boundaries as the rest of Microsoft 365.
How do we protect the firm against business email compromise?
With several layers. MFA and Conditional Access make stolen passwords far less useful, email authentication (SPF, DKIM and DMARC) makes your domain harder to impersonate, and impersonation protection flags lookalike senders. We also monitor for the signs of a compromised mailbox, such as new forwarding rules and unusual sign-ins, so we can act on an attempt early.
Do the new Privacy Act rules on automated decisions affect our firm?
They may. From 10 December 2026, APP 1.7 to 1.9 require privacy policies to explain where personal information is used in automated decisions that could significantly affect someone’s rights or interests. The wording of the policy sits with the firm or its privacy adviser. On the technology side, we document which systems and AI tools use personal information, where that data is stored, who can access it and how its use is logged.
What happens to access when a fee earner or contractor leaves?
Their access is removed when they finish: sign-in, mailbox, Teams and SharePoint, document and practice platforms, devices and any guest access to client workspaces. Mail and files are handed over to the right person, and access reviews pick up anything missed. New starters are set up the same way in reverse.
Can you work alongside our internal IT or operations manager?
Yes. Larger firms often have an internal IT person or an operations manager who looks after technology. Co-managed IT adds depth across Microsoft 365, security, backup, networks and escalation, without duplicating what your team already handles.
What reporting and reviews do we get?
You can check the health of your environment at any time through your support portal, and you get a monthly snapshot of support, security and backup activity. Each quarter we meet to look ahead at new partners and staff, office moves, device replacements, practice-platform changes, licensing and security improvements, so upgrades can be budgeted ahead of time. The reporting and meeting rhythm is set to suit your firm.
How much does Managed IT cost for a professional firm?
The price depends on users, sites, the technology being managed and security requirements. Microsoft licensing, hardware and project work are identified separately. Use our Managed IT cost calculator for an indicative estimate.
How does onboarding work for a firm?
We start by documenting your environment: access, devices, Microsoft 365, document and practice platforms, vendors, security controls and any open issues. We then bring each area under management in stages, beginning with monitoring and backup, and plan around deadlines and busy periods.
Do you help with myID and ATO Online services for agents?
Yes, at the identity and device level. Each staff member needs their own myID, linked to the practice through Relationship Authorisation Manager (RAM), so we make sure credentials aren’t shared, sign-in is protected, devices are managed and access is removed when people leave. The Tax Practitioners Board expects tax practitioners to keep client information secure, and the same controls give you evidence for that and for your cyber insurer.
Related services

Explore the services we provide

Next step

Protect client data and put AI to work safely

Tell us how your firm works today, and we’ll identify where security, backup and AI tools like Copilot can be improved.

Discuss Managed ITCalculate Managed IT cost

Prefer email? contact@inlightit.com.au