# Microsoft 365 Security Assessment for Canadian Law Firms: Identity and MFA > Liam from Amen Security · 2026-11-07T00:34:39.806Z · cybersecurity · microsoft-365 · identity · law-firms · mfa A Microsoft 365 security assessment for a Canadian law firm should review sign-in methods, independent verification of unexpected support calls, and approval of MFA resets or enrolments. Ask for documented findings, untested controls and separately scoped fixes. A review is not a guarantee against account compromise. This is a buying checklist, not an assessment of your environment, a service commitment or legal advice. Scope at a glance Stage or area What you should ask for Unexpected IT call Verify independently through a known channel MFA reset or enrolment Require an approved recovery process Review handover Request documented findings and scoped changes Scope summary by Amen Security. Not an assessment of your environment or a service guarantee.Why are Canadian law firms being targeted by help-desk phone scams? Picture a call to your receptionist about a "passkey migration." It sounds routine. That is the point. On October 28, 2026, [the Canadian Centre for Cyber Security warned](https://www.cyber.gc.ca/en/alerts-advisories/al26-028-ongoing-help-desk-voice-phishing-campaign-targeting-canadian-organizations) that callers were impersonating internal IT and sending employees to fake sign-in pages styled with the organization's name and look. The alert covers Canadian organizations, and it says October activity was concentrated on the legal sector. Keep that in proportion. It is a dated Canadian warning. It is not evidence of a new November campaign, and it says nothing about your firm specifically. If you run IT or operations at a firm, the real question isn't whether people have heard of phishing. It's whether a suspicious support call can be stopped without someone making up the rules on the spot. The questions below turn the alert into things you can actually put in a proposal request. Does MFA stop voice phishing on Microsoft 365? Voice phishing (vishing) is a social-engineering attack in which a caller impersonates a trusted party, such as internal IT, to get a user to approve a sign-in, reset a credential or visit a fake login page. See our [phishing glossary entry](https://amensecurity.ca/en/glossary/phishing) for the broader category. Conventional MFA helps, but not against everything. The Cyber Centre says real-time relay can bypass conventional MFA. It recommends phishing-resistant MFA, including FIDO2 security keys, device-bound passkeys or platform authenticators, especially for privileged and high-risk users. Two cautions. Don't turn that into "MFA is useless." And don't assume phishing-resistant methods fall to the same trick. How someone signs in and how their account gets recovered are separate questions, and you should ask them separately. Our [MFA glossary entry](https://amensecurity.ca/en/glossary/mfa) covers the basics. What should a Microsoft 365 identity review actually check? Start with what's really configured. Ask the assessor to document which methods are available, which ones users have actually registered, and which exceptions are still open. Then walk through the awkward cases. A lost phone. A new device. A partner who calls in claiming it's an emergency before a filing deadline. The Cyber Centre recommends stronger verification for resets, account recovery and new enrolments, so the review has to look at the approval workflow as well as the settings in [Microsoft Entra ID](https://amensecurity.ca/en/glossary/entra-id). "MFA enabled" on a dashboard is not the whole answer. What evidence should you ask for instead of a checkbox? A good proposal request names the tenant and the controls under review. We'd keep the evidence list short: - authentication-method coverage - an inventory of privileged roles - the written reset procedure - the relevant Conditional Access policies - who owns suspicious-registration alerts Agree up front what can be collected safely, how sensitive exports get shared, and who is allowed to read the report. The Cyber Centre also recommends monitoring suspicious MFA registrations and unusual Microsoft 365 file access, preserving identity-provider and Microsoft 365 audit logs, and verifying unexpected IT calls independently, regardless of urgency or caller ID. So ask a blunt question: who actually receives those signals, and who can act on them at 6 p.m. on a Friday? The report should also separate what was observed from what wasn't tested. Missing access is not a passed check. How do you keep the review from disrupting the firm? Never use a live suspicious call as a chance to experiment with tenant-wide settings. For a planned assessment, agree in writing whether the work is read-only and whether any follow-up changes need separate approval. Ask for a staged change proposal with dependencies, recovery arrangements and a named approver. If you suspect a compromise, don't wait for a routine assessment. Follow your incident process. The alert recommends revoking active sessions and tokens, resetting credentials, removing unauthorized MFA methods or devices, and reviewing mailbox and file activity. Those are actions for authorized responders. This article doesn't authorize anyone to perform them in someone else's environment. How do you compare Microsoft 365 security assessment proposals? Scope first, provider second. Send every bidder the same questions. Ask that exclusions sit right next to the finding they affect. And keep assessment, implementation and ongoing monitoring as three separate decisions. A cheap review that skips the recovery workflow may be answering a different question from the one that made you start looking. Amen's public [Cybersecurity services page](https://amensecurity.ca/en/services/cybersecurity) describes security assessments, access management, monitoring, and MFA and Conditional Access hygiene, with a written-scope approach and remote support for US clients. That's enough for a conversation about fit. It is not proof of a packaged legal-sector service, a delivery deadline or a guaranteed drop in risk. US teams can borrow the control questions, but the warning cited here is Canadian. Microsoft 365 identity review checklist for law firms Use these questions to compare written proposals side by side. Identity review proposal comparison Area Question Evidence to request Verification How are unexpected IT requests independently checked? Written process and owner Reset approvals What authorizes MFA recovery or enrolment? Evidence and exceptions Monitoring Who reviews suspicious registrations? Routing and escalation owner Exclusions Is implementation separate, and which controls remain untested? Written review boundary and separate change approval Frequently asked questions What is a Microsoft 365 security assessment for a law firm? It is a scoped review of how a firm’s Microsoft 365 tenant handles sign-in methods, MFA resets, new enrolments, privileged roles and alerting, producing written findings and separately scoped fixes rather than a promise that one control prevents every compromise. Does conventional MFA make this review unnecessary? No. The Canadian Centre for Cyber Security describes real-time relay against conventional MFA and recommends phishing-resistant methods, such as FIDO2 security keys or device-bound passkeys, alongside stronger verification for resets and recovery. Is the help-desk vishing warning about US law firms? No. The cited October 28, 2026 alert concerns Canadian organizations. US firms can adapt the control questions, but not the geographic attribution. What should a law firm do if it suspects an account is compromised? Follow its incident process instead of waiting for a routine assessment. The Cyber Centre recommends that authorized responders revoke sessions and tokens, reset credentials, remove unauthorized MFA methods and review mailbox and file activity. Article sources [Canadian Centre for Cyber Security, AL26-028: Ongoing help desk voice phishing campaign targeting Canadian organizations](https://www.cyber.gc.ca/en/alerts-advisories/al26-028-ongoing-help-desk-voice-phishing-campaign-targeting-canadian-organizations) [Amen Security: Cybersecurity services](https://amensecurity.ca/en/services/cybersecurity) Want a written scope for your firm? Tell us which systems matter most, what's worrying you and what you need at the end. [Contact Amen Security to scope a Microsoft 365 identity review](https://amensecurity.ca/en/contact). We'll confirm responsibilities, exclusions and next steps before any work is approved. ## Topic: Cybersecurity & compliance - [Main guide](https://amensecurity.ca/en/services/cybersecurity.md) - [Managed IT vs Break-Fix: Side-by-Side Comparison](https://amensecurity.ca/en/guides/msp-vs-break-fix.md) --- Source page: https://amensecurity.ca/en/blog/m365-identity-review-canadian-law-firms-vishing Markdown version for AI agents · Amen Security Email: info@amensecurity.ca Phone: +1 (204) 514-3536