What AI Infrastructure for Law Firms Looks Like Inside a Firm's Own Microsoft 365 Tenant

When a client asks where its privileged files are processed, the firm that owns its AI build answers from its tenant.

New York, NY, Sept. 17, 2026 (GLOBE NEWSWIRE) -- Law firms adopting AI are running into a question from their clients: where are our privileged files processed, and who can reach them? AI infrastructure for law firms built inside the firm's Microsoft 365 tenant is how eSoftware Associates (ESW) gives firms that documented answer, a pattern it has delivered to more than 1,500 organizations over 20 years, including more than 200 migrations into Microsoft 365 GCC and GCC High environments with zero data loss.

"When a client's security team asks where its files are processed, you either answer from your tenant or you email a vendor and wait. We build it so the firm can answer for itself," said Russell Kommer, founder and CEO of eSoftware Associates, who has led the firm's Power Apps and custom Microsoft development.

KEY FACTS

• 1,500+ organizations served on the Microsoft platform.
• 92% multiproject return rate across the client base.
• 100% U.S.-based delivery team.
• 3 to 4 month average ROI timeline across ESW engagements.

Where a firm's AI is built decides who holds the data, the permissions, and the audit log

ESW designs legal AI on Copilot Studio, Dataverse, and Azure within the firm's existing Microsoft 365 tenant. One current engagement is with a 200-person law firm, covering AI routing for its attorneys and conference room scheduling across its offices around the country. The agents read the firm's SharePoint sites and matter records, inherit Microsoft 365 identity and access controls, and write to the same audit logs the firm's administrators already monitor. Nothing is copied to a platform the firm doesn’t administer.

The alternative to building is a finished product the firm sends documents into. Matter files, the prompts partners type, and the drafts the model returns all sit under contract terms fixed at signing, so changing any of them means reopening the contract. Access questions route through vendor support, and the vendor's policy sets the retention period. ESW builds the same capability inside the firm's tenant as custom Azure and SharePoint Framework development the firm can read, change, and keep.

The security questionnaire is where the difference surfaces

When a client sends a security questionnaire asking where its files are processed, a firm running its build answers from its tenant configuration. Alternatively, a firm running a vendor product answers from the vendor's documentation, and any question the documentation doesn’t cover routes through vendor support. Every ESW consultant on a build is U.S.-based and in-house with no offshore handoffs, so the processing location is part of the configuration the firm can point to.

The custody discipline law firms need is the same one regulated environments already require

ESW has completed more than 200 GCC and GCC High migrations with zero data loss. Those environments carry FedRAMP Moderate, FedRAMP High, ITAR, and DFARS requirements, which govern where regulated data sits and who can reach it. A law firm needs those same controls, driven by attorney-client privilege and the security terms clients write into outside counsel guidelines rather than by federal regulation. Either way, the controls are built from the same Microsoft services.

Before an agent is connected to the firm's SharePoint sites and mailboxes, ESW starts with a Microsoft 365 AI readiness assessment that scores the firm's governance, identity and sharing, and Copilot readiness. A firm that owns the build can then answer three questions from its configuration: who opened which matter, whether retention matches the firm's file policy, and what the model retained.

That scoring reveals a shared inbox or an old project site indexed alongside privileged correspondence. Those permissions accumulated one site at a time, and Copilot queries across all of them at once. The full report attaches severity and financial exposure estimates to each finding.

The three Microsoft services in an owned build carry different jobs. Copilot Studio holds the agent and its scoped data sources, Dataverse stores the structured records and enforces row-level security when a workflow needs a data layer under it, and Azure hosts the model deployment and the network boundary around it.

What owning the build means at renewal

An owned system stays with the firm at renewal while a rented one carries a switching cost measured in retraining and data export. Agents, connectors, and data models sitting in a tenant the firm controls keep running whether or not the firm renews with the consultancy that built them. Across ESW's client base, 92% of clients return for additional projects, and firms that already own the build typically come back to extend it into another practice group or workflow.

Law firms carry this obligation through attorney-client privilege and the security terms clients write into outside counsel guidelines, and it comes down to one requirement: a record of where the data sits and who reached it. AI infrastructure for law firms built inside the firm's Microsoft environment keeps that record under the firm's administration.

Frequently Asked Questions

Question: What is AI infrastructure for law firms built inside a firm's Microsoft 365 tenant?

Answer: AI infrastructure for law firms built inside the firm's Microsoft 365 tenant means the system runs on licensing the firm already carries, so the firm holds the data, permission model, and audit logs, and can change the build without asking a vendor. Agents inherit the firm's existing Microsoft 365 permissions, reaching only the files a given user can already open. The alternative is sending documents into a finished product on a platform the firm doesn’t administer, where retention follows the vendor's schedule. ESW has worked on the Microsoft platform for 20 years and has delivered custom builds inside client tenants for more than 1,500 organizations.

Question: Is it cheaper to just buy a legal AI product?

Answer: A packaged product starts cheaper and prices differently over time. A subscription is a per-seat operating cost with a switching cost attached at renewal, while an owned build is a scoped engagement on licensing the firm already holds, and the system keeps running whether or not the firm renews with whoever built it. Across ESW's client base, engagements average a three- to four-month ROI timeline and save more than 20 hours a week per client. Research and general drafting are well served by a packaged product; privileged matter work and outside counsel guidelines are the conditions that move a firm to its own tenant.

Question: Who sets up Microsoft 365 compliance for a law firm?

Answer: A Microsoft implementation partner handles this work because the build is Copilot Studio, Power Platform, SharePoint, and Azure engineering applied to legal workflows rather than a software purchase. eSoftware Associates is 100% U.S.-based and has completed more than 200 migrations into Microsoft 365 GCC and GCC High environments with zero data loss. That regulated-environment record is the relevant qualification, because a firm's confidentiality requirements match those of a controlled-data environment, not a standard office rollout. Scoping starts with an assessment of the firm's existing data and permissions.

About eSoftware Associates (ESW)

ESW builds secure business apps, workflows, portals, and automations across Power Apps, SharePoint, Dataverse, SPFx, Copilot & AI Agents, and Azure. 100% U.S.-based since 2006.

Sarah Evans
Head of PR, Zen Media
sarah@zenmedia.com