A law firm that has its IT in order gets a specific set of things: lawyers who can open a matter from a hotel room without a VPN ticket, a trust accounting system that nobody outside finance can reach, a document set that can be restored to a known point after someone drags a folder into the wrong site, and an answer ready for the insurer, the government client and the ASX-listed customer who all want to know how access is controlled. None of that arrives with a licence purchase. The licence is the starting point. The controls are the work.
This is an end-to-end look at what a small-to-mid Australian practice actually runs on, what the components cost, and which controls tend to break legal workflows when they are switched on without a plan.
Start with the systems, not the products
Most security advice written for SMEs assumes email, files and a couple of line-of-business apps. A legal practice has more surface than that, and the pieces interact:
- practice and matter management, usually cloud-hosted, often with a desktop component
- a document and precedent repository, either inside SharePoint or inside the practice management platform
- legal accounting and trust account software, with its own regulatory retention and audit expectations
- email and calendaring, where most confidential material actually moves
- court and government portals, several of which have their own authentication quirks
- electronic signing and verification of identity tools
- collaboration with barristers, experts and agents who are outside your tenant entirely
- time recording, billing and client intake
Any control you design has to survive contact with all of those. A conditional access rule that is correct in the abstract and blocks a court portal at 4:45pm on a filing day will be turned off, and it will stay off.
Which Microsoft 365 plan is the real starting point
The comparison most firms run is Business Standard versus Business Premium. Standard gives you the Office applications, Exchange, SharePoint, OneDrive and Teams. Premium adds the identity and endpoint security capability that Essential Eight-aligned work depends on — conditional access, device compliance, endpoint protection and the management layer that lets you enforce anything on a laptop you do not physically control.
Published Australian pricing is currently inconsistent, and that is worth knowing before you build a budget on a number you found in a blog. One Australian pricing summary lists Business Premium at A$32.90 per user per month on an annual commitment and A$39.48 on monthly commitment, and notes Business Premium was held in Microsoft's 1 July 2026 pricing round while other plans rose. A separate Australian licensing report lists Business Basic at A$11.03, Business Standard at A$22.05, Business Premium at A$34.55, Office 365 E3 at A$40.85 and Office 365 E5 at A$64.47 per user per month. Those figures do not agree, most likely because of differing billing terms, channels, price dates and tax treatment. Confirm the exact plan, commitment and reseller price on the day you sign.
Security add-ons sit on top of that again. Microsoft's Australian security pricing pages currently show Business Premium at A$32.90 per user per month paid yearly, and Purview-related business pricing including A$15 and A$22.40 per user per month depending on the product or package. Purview matters to firms that need data classification, retention and information protection over privileged material, but feature eligibility depends on the subscription and how it is deployed. Before you buy, ask which exact SKU is included, whether the feature applies to every user or only licensed ones, whether it covers macOS and mobile as well as Windows, whether guest accounts are in scope, and whether the provider is configuring and monitoring the control or simply assigning the licence.
The licence does not implement the Essential Eight
The Essential Eight is a set of eight mitigation strategies the Australian Signals Directorate recommends as a baseline. It is not a licence, and for a private law firm it is generally a security framework and a procurement or insurance expectation rather than a statutory certification. Microsoft's own guidance notes that Maturity Level 2 is mandatory for Australian non-corporate Commonwealth entities under the PGPA Act, not for every business. If you act for those entities, expect the question to arrive in a tender.
The more useful question than "are we compliant" is: which maturity level are we targeting, where are the gaps, and what evidence proves the controls operate on a Tuesday when nobody is watching.
Effort is measured in months. One Australian provider estimates three to six months for an Essential Eight assessment and implementation, with an initial investment of A$10,000 to A$25,000. That is a provider estimate rather than an official figure, but it is a far more realistic planning range than treating the project as a purchase order. The work includes inventorying users, endpoints, mobile devices and SaaS applications; enforcing MFA and removing legacy authentication; separating administrator accounts; reviewing external sharing and guest access; patching operating systems and applications; restricting macros and application execution where practical; designing and testing backups; building joiner, mover and leaver processes; and collecting the evidence an insurer or client will ask for.
The component most often underestimated is the exception process. Lawyers need older software, macro-enabled precedents, USB devices for court, and access paths the standard policy did not anticipate. Every one of those needs an owner, an approval and a review date, or the control gets bypassed informally and your evidence is worthless.
What managed support costs, and what the number contains
Published Australian prices for legal IT support vary by a factor of three, and the inclusions explain most of it.
| Published price | What the provider lists |
|---|---|
| From A$95 per user per month | Managed IT positioned for Australian law firms |
| A$119 per seat per month | SentinelOne EDR, email security, monitoring, patching, Microsoft 365 management, awareness training, DNS filtering, business-hours support |
| Approximately A$150 to A$300 per user per month | Fully managed service for a small firm, provider estimate |
These are published provider prices, not market research, and they are not directly comparable. What moves the number is device and user count, after-hours and onsite coverage, whether endpoint detection and response is included or billed separately, backup scope, whether the provider supports your practice management platform or hands you to the vendor, compliance documentation, Microsoft licensing, security monitoring, and the remediation work needed before steady state begins. Ask for the inclusion list beside the price, always. Our own managed IT and security work for legal practices starts with that list rather than a seat count, because the remediation backlog is usually where the first year's cost actually sits.
Backup, retention and disaster recovery are three different controls
Microsoft 365 retention preserves and discovers information according to policy. It does not necessarily give you an independent, quickly restorable copy of every mailbox, SharePoint site, OneDrive account and Teams workload. A dedicated SaaS backup may, but its retention period, storage location, immutability, restore granularity and licensing all need to be confirmed separately.
Make the answers quantitative:
- How many recovery points, held for how long?
- Can a compromised administrator account delete them?
- Can you restore a single document, a single mailbox, or an entire matter workspace?
- What are the recovery point and recovery time objectives?
- When was the last successful restore test, and what was restored?
- Are legal holds and trust account retention obligations preserved through a restore?
Test by restoring a real matter workspace. A green dashboard is not a restore.
Residency is not sovereignty
"Our data is in Australia" is an incomplete statement. A platform can store primary content in an Australian region while support access, telemetry, identity services, backups, subprocessors and privileged administrator access sit elsewhere. Put the questions in the contract: primary storage region, backup region, disaster recovery region, support and privileged access locations, subprocessors, encryption key location and control, the government access process, deletion timing after termination, and the export format if you leave. Do not accept a marketing page as the answer for a specific service.
Breach response is a legal process with an IT input
An Australian practice holds identity, health, financial, employment and witness material alongside privileged communications, so the Privacy Act and the Notifiable Data Breaches scheme are live obligations rather than background reading. Reporting on the reform package notes that from 10 June 2025 individuals gained a statutory tort action for serious invasions of privacy, while serious interference penalties for covered bodies corporate are the greatest of A$50 million, three times the benefit obtained, or 30% of adjusted turnover. Verify the statutory wording with the OAIC before relying on it in a policy document.
Operationally, you need a documented path to establish what was accessed or exfiltrated, which clients and individuals are affected, whether serious harm is likely, who in the firm makes that assessment, how quickly notifications are drafted, and how privileged material is handled during the investigation itself. Privacy notification does not answer your professional conduct obligations, and the two run on different clocks.
The first move
Sit down with the partners and write down the ten systems the firm cannot practise without, then, beside each, who owns it, where the data sits, whether it is covered by your backup, and whether MFA is enforced on it. Most firms find two or three systems that nobody owns and one that no backup touches. That list is the input to every decision above.
If you want that turned into a costed plan, Precision IT will run an Essential Eight-aligned assessment across your tenant, endpoints and practice management environment and come back with a gap list by control, a target maturity level, a fixed scope and price for remediation, and a plain answer on which controls are worth doing now versus at your next licence renewal. Request a consultation and tell us your user count and practice management platform — that is enough to scope it.