There’s a world of difference between storing legal documents in SharePoint and building a legal DMS on it.
The first can be as simple as creating sites and libraries and deciding where content should go. The second requires you to think about the wider architecture around that content: how matters are structured, who can access them, how information is governed and protected, and how lawyers interact with it day to day.
This can present some interesting design challenges, because these decisions are interconnected. Content structure can affect permissions; security choices can affect usability; and governance requirements can influence how information is organised and managed.
Get the foundations wrong, and the consequences can ripple through the entire system, becoming progressively harder to unwind as the environment grows.
Start with the structure
One of the first decisions to make is how matters themselves will be structured. A site-per-matter model and a library-based model each have implications for scalability, permissions, search, performance and lifecycle management. There isn’t one universally correct answer; the architecture needs to reflect the firm’s scale, working practices and priorities.
In our preferred model, Epona provides the legal layer on top of SharePoint, adding matter-centric structure, metadata, document and email filing, legal search and legal-specific permissions – while the underlying content remains within the firm’s own Microsoft 365 tenant.
Closely connected to that is the metadata itself. Decisions about matter number, client, practice area, document type, status and other legal context affect more than how content is filed. They influence search, classification and governance throughout the information lifecycle, while also providing valuable context for knowledge reuse and future AI tools.
The architecture also needs to connect reliably with the systems and processes around the matter. Practice management integration should allow client and matter information to flow into Epona and SharePoint; email filing needs to be designed into the matter architecture rather than treated as a bolt-on; and versioning needs to support collaboration while still making approved work easy to identify.
Those decisions extend beyond the active matter, too. Closure, archiving and retention need to be designed into the matter lifecycle, including when content can be defensibly disposed of and when it may have ongoing value to the firm’s knowledge base.
Build governance and security into the design
The way information is structured and managed also determines how effectively it can be protected and controlled. Security and governance therefore need to be considered alongside those structural decisions, not added once they’ve been made.
For legal content, least-privilege access is the obvious starting point. The model also needs to accommodate matter-specific permissions, ethical walls and client requirements, while still allowing lawyers to collaborate effectively.
Microsoft supplies many of the controls needed to put this into practice. Microsoft Entra provides the identity and access layer; Microsoft Purview can apply classification, sensitivity labelling, data loss prevention and retention; and Microsoft Defender provides additional security monitoring and threat protection around the environment.
Access outside the firm needs equal consideration. External sharing should support collaboration with clients and third parties without creating uncontrolled access paths, while auditability provides a clear record of how content has been accessed and managed.
These controls need to reflect the firm’s professional, regulatory and client obligations, while remaining practical enough to work in the real world.
Make the secure way the easy way
Practicality matters, because security controls that create too much friction invariably cause users to find “creative” workarounds – keeping documents in inboxes, saving local copies or sharing information through easier channels. In other words: cumbersome controls designed to reduce risk can end up creating new risks instead.
The answer isn’t weaker security. It’s making the secure way of working the easiest way of working. Filing needs to be simple, search reliable, and the experience should fit naturally around familiar Microsoft tools and legal workflows. Mobility and offline access also need to reflect how lawyers actually work – without compromising security.
Getting this right means designing user experience and adoption into the system from the outset. It also means recognising that good design doesn’t end at go-live. Clear ownership of provisioning, permissions, training, support and issue resolution helps keep the environment working as intended, while ongoing review allows it to evolve alongside the firm’s working practices and requirements.
Everything connects
The Microsoft 365 and SharePoint foundation, Epona legal layer, and the security and governance controls around them can’t be designed as isolated components. Choices made in one area inevitably shape what’s possible in another.
That alignment also needs to be upheld over time. A clear operating model helps keep structure, security, governance and user experience working together as the environment evolves.
AI is about to put that model under even greater scrutiny. As Copilot and other AI capabilities make information easier to find and use, the quality of the governance, permissions and information classification around that content becomes increasingly important.
That’s where we’ll pick up in our next article: why successful AI adoption starts with good governance.
Explore more topics in our legal DMS series:
Build a more secure, governed and AI-ready foundation for your firm. Talk to us today about how to modernise your legal DMS.
