A Microsoft 365 security assessment for a Canadian law firm should review sign-in methods, independent verification of unexpected support calls, and approval of MFA resets or enrolments. Ask for documented findings, untested controls and separately scoped fixes. A review is not a guarantee against account compromise.
A Microsoft 365 security assessment for a Canadian law firm should review sign-in methods, independent verification of unexpected support calls, and approval of MFA resets or enrolments. Ask for documented findings, untested controls and separately scoped fixes. A review is not a guarantee against account compromise.
This is a buying checklist, not an assessment of your environment, a service commitment or legal advice.
Stage or area | What you should ask for |
|---|---|
Unexpected IT call | Verify independently through a known channel |
MFA reset or enrolment | Require an approved recovery process |
Review handover | Request documented findings and scoped changes |
Picture a call to your receptionist about a "passkey migration." It sounds routine. That is the point. On October 28, 2026, the Canadian Centre for Cyber Security warned that callers were impersonating internal IT and sending employees to fake sign-in pages styled with the organization's name and look. The alert covers Canadian organizations, and it says October activity was concentrated on the legal sector.
Keep that in proportion. It is a dated Canadian warning. It is not evidence of a new November campaign, and it says nothing about your firm specifically.
If you run IT or operations at a firm, the real question isn't whether people have heard of phishing. It's whether a suspicious support call can be stopped without someone making up the rules on the spot. The questions below turn the alert into things you can actually put in a proposal request.
Voice phishing (vishing) is a social-engineering attack in which a caller impersonates a trusted party, such as internal IT, to get a user to approve a sign-in, reset a credential or visit a fake login page. See our phishing glossary entry for the broader category.
Conventional MFA helps, but not against everything. The Cyber Centre says real-time relay can bypass conventional MFA. It recommends phishing-resistant MFA, including FIDO2 security keys, device-bound passkeys or platform authenticators, especially for privileged and high-risk users.
Two cautions. Don't turn that into "MFA is useless." And don't assume phishing-resistant methods fall to the same trick. How someone signs in and how their account gets recovered are separate questions, and you should ask them separately. Our MFA glossary entry covers the basics.
Start with what's really configured. Ask the assessor to document which methods are available, which ones users have actually registered, and which exceptions are still open.
Then walk through the awkward cases. A lost phone. A new device. A partner who calls in claiming it's an emergency before a filing deadline. The Cyber Centre recommends stronger verification for resets, account recovery and new enrolments, so the review has to look at the approval workflow as well as the settings in Microsoft Entra ID. "MFA enabled" on a dashboard is not the whole answer.
A good proposal request names the tenant and the controls under review. We'd keep the evidence list short:
Agree up front what can be collected safely, how sensitive exports get shared, and who is allowed to read the report.
The Cyber Centre also recommends monitoring suspicious MFA registrations and unusual Microsoft 365 file access, preserving identity-provider and Microsoft 365 audit logs, and verifying unexpected IT calls independently, regardless of urgency or caller ID. So ask a blunt question: who actually receives those signals, and who can act on them at 6 p.m. on a Friday? The report should also separate what was observed from what wasn't tested. Missing access is not a passed check.
Never use a live suspicious call as a chance to experiment with tenant-wide settings. For a planned assessment, agree in writing whether the work is read-only and whether any follow-up changes need separate approval. Ask for a staged change proposal with dependencies, recovery arrangements and a named approver.
If you suspect a compromise, don't wait for a routine assessment. Follow your incident process. The alert recommends revoking active sessions and tokens, resetting credentials, removing unauthorized MFA methods or devices, and reviewing mailbox and file activity. Those are actions for authorized responders. This article doesn't authorize anyone to perform them in someone else's environment.
Scope first, provider second. Send every bidder the same questions. Ask that exclusions sit right next to the finding they affect. And keep assessment, implementation and ongoing monitoring as three separate decisions. A cheap review that skips the recovery workflow may be answering a different question from the one that made you start looking.
Amen's public Cybersecurity services page describes security assessments, access management, monitoring, and MFA and Conditional Access hygiene, with a written-scope approach and remote support for US clients. That's enough for a conversation about fit. It is not proof of a packaged legal-sector service, a delivery deadline or a guaranteed drop in risk. US teams can borrow the control questions, but the warning cited here is Canadian.
Use these questions to compare written proposals side by side.
Area | Question | Evidence to request |
|---|---|---|
Verification | How are unexpected IT requests independently checked? | Written process and owner |
Reset approvals | What authorizes MFA recovery or enrolment? | Evidence and exceptions |
Monitoring | Who reviews suspicious registrations? | Routing and escalation owner |
Exclusions | Is implementation separate, and which controls remain untested? | Written review boundary and separate change approval |
It is a scoped review of how a firm’s Microsoft 365 tenant handles sign-in methods, MFA resets, new enrolments, privileged roles and alerting, producing written findings and separately scoped fixes rather than a promise that one control prevents every compromise.
No. The Canadian Centre for Cyber Security describes real-time relay against conventional MFA and recommends phishing-resistant methods, such as FIDO2 security keys or device-bound passkeys, alongside stronger verification for resets and recovery.
No. The cited October 28, 2026 alert concerns Canadian organizations. US firms can adapt the control questions, but not the geographic attribution.
Follow its incident process instead of waiting for a routine assessment. The Cyber Centre recommends that authorized responders revoke sessions and tokens, reset credentials, remove unauthorized MFA methods and review mailbox and file activity.
Amen Security: Cybersecurity services
Tell us which systems matter most, what's worrying you and what you need at the end. Contact Amen Security to scope a Microsoft 365 identity review. We'll confirm responsibilities, exclusions and next steps before any work is approved.
Your comment will be published after our team reviews it.
