법무법인 자체 Microsoft 365 테넌트 내부의 법률사무소용 AI 인프라 모습

When a client asks where its privileged files are processed, the firm that owns its AI build answers from its tenant.

New York, NY, Sept. 17, 2026 (GLOBE NEWSWIRE) -- Law firms adopting AI are running into a question from their clients: where are our privileged files processed, and who can reach them? AI infrastructure for law firms built inside the firm's Microsoft 365 tenant is how eSoftware Associates (ESW) gives firms that documented answer, a pattern it has delivered to more than 1,500 organizations over 20 years, including more than 200 migrations into Microsoft 365 GCC and GCC High environments with zero data loss.

"When a client's security team asks where its files are processed, you either answer from your tenant or you email a vendor and wait. We build it so the firm can answer for itself," said Russell Kommer, founder and CEO of eSoftware Associates, who has led the firm's Power Apps and custom Microsoft development.

KEY FACTS

1,500+ organizations served on the Microsoft platform.

92% multiproject return rate across the client base.

100% U.S.-based delivery team.

3 to 4 month average ROI timeline across ESW engagements.

Where a firm's AI is built decides who holds the data, the permissions, and the audit log

ESW designs legal AI on Copilot Studio, Dataverse, and Azure within the firm's existing Microsoft 365 tenant. One current engagement is with a 200-person law firm, covering AI routing for its attorneys and conference room scheduling across its offices around the country. The agents read the firm's SharePoint sites and matter records, inherit Microsoft 365 identity and access controls, and write to the same audit logs the firm's administrators already monitor. Nothing is copied to a platform the firm doesn’t administer.

The alternative to building is a finished product the firm sends documents into. Matter files, the prompts partners type, and the drafts the model returns all sit under contract terms fixed at signing, so changing any of them means reopening the contract. Access questions route through vendor support, and the vendor's policy sets the retention period. ESW builds the same capability inside the firm's tenant as custom Azure and SharePoint Framework development the firm can read, change, and keep.

The security questionnaire is where the difference surfaces

When a client sends a security questionnaire asking where its files are processed, a firm running its build answers from its tenant configuration. Alternatively, a firm running a vendor product answers from the vendor's documentation, and any question the documentation doesn’t cover routes through vendor support. Every ESW consultant on a build is U.S.-based and in-house with no offshore handoffs, so the processing location is part of the configuration the firm can point to.

The custody discipline law firms need is the same one regulated environments already require

ESW has completed more than 200 GCC and GCC High migrations with zero data loss. Those environments carry FedRAMP Moderate, FedRAMP High, ITAR, and DFARS requirements, which govern where regulated data sits and who can reach it. A law firm needs those same controls, driven by attorney-client privilege and the security terms clients write into outside counsel guidelines rather than by federal regulation. Either way, the controls are built from the same Microsoft services.

Before an agent is connected to the firm's SharePoint sites and mailboxes, ESW starts with a Microsoft 365 AI readiness assessment that scores the firm's governance, identity and sharing, and Copilot readiness. A firm that owns the build can then answer three questions from its configuration: who opened which matter, whether retention matches the firm's file policy, and what the model retained.

That scoring reveals a shared inbox or an old project site indexed alongside privileged correspondence. Those permissions accumulated one site at a time, and Copilot queries across all of them at once. The full report attaches severity and financial exposure estimates to each finding.

The three Microsoft services in an owned build carry different jobs. Copilot Studio holds the agent and its scoped data sources, Dataverse stores the structured records and enforces row-level security when a workflow needs a data layer under it, and Azure hosts the model deployment and the network boundary around it.

What owning the build means at renewal

An owned system stays with the firm at renewal while a rented one carries a switching cost measured in retraining and data export. Agents, connectors, and data models sitting in a tenant the firm controls keep running whether or not the firm renews with the consultancy that built them. Across ESW's client base, 92% of clients return for additional projects, and firms that already own the build typically come back to extend it into another practice group or workflow.

Law firms carry this obligation through attorney-client privilege and the security terms clients write into outside counsel guidelines, and it comes down to one requirement: a record of where the data sits and who reached it. AI infrastructure for law firms built inside the firm's Microsoft environment keeps that record under the firm's administration.

Frequently Asked Questions

Question: What is AI infrastructure for law firms built inside a firm's Microsoft 365 tenant?