Ethical Walls for Law Firms: Which Cloud Platforms Actually Support Them (and How to Set Them Up)

A partner brings in a new client. Conflicts runs the check and finds that a lateral associate who joined last spring worked for the other side at her old firm. The firm can take the matter, but only if that associate is walled off: no access to the files, no conversations about the matter, nothing.

The conflicts memo takes an afternoon. Actually enforcing the wall across email, Teams, SharePoint, the document management system, the practice-management platform and whatever AI tools the firm has added this year is harder. A lot of firms find out at this point that their “ethical wall” is a memo and a folder permission someone set by hand.

This guide gives the practical answer to a question we hear from law firms: which cloud platforms offer ethical wall controls for conflicts checks and matter access, and how do you make them work together? We cover what each major platform actually does, based on the vendors’ own documentation, and how a managed IT provider should set up, audit and maintain walls over time.

A note before we start: this is a technology guide, not legal advice. Your state’s version of the Rules of Professional Conduct, your clients’ outside counsel guidelines and your firm’s general counsel or ethics partner decide what a wall has to include. IT’s job is to enforce that decision reliably and prove it was enforced.

What an Ethical Wall Is, and Why IT Owns Half of It

An ethical wall (also called an information barrier, or a “screen”) keeps specific people away from specific matters, and keeps information from flowing between groups that shouldn’t share it.

Under the ABA Model Rules, the reason walls matter is imputation. Model Rule 1.10(a) provides that while lawyers are associated in a firm, none of them may knowingly represent a client when any one of them practicing alone would be prohibited from doing so by Rules 1.7 or 1.9, subject to exceptions. One of those exceptions, Rule 1.10(a)(2), covers conflicts a lawyer brings from a prior firm. It requires, among other things, that the disqualified lawyer be “timely screened from any participation in the matter,” that written notice describing the screening procedures go to the affected former client, and that certifications of compliance be provided on request.

Model Rule 1.0(k) defines “screened” as the isolation of a lawyer from any participation in a matter “through the timely imposition of procedures within a firm that are reasonably adequate under the circumstances to protect information.” The Comment to Rule 1.0 mentions technology directly. Among the procedures it lists are denying the screened lawyer access to firm files or other information, “including information in electronic form,” relating to the matter, plus periodic reminders of the screen to everyone affected. It also says screening measures should be put in place as soon as practical once the firm knows, or reasonably should know, that a screen is needed.

States adopt their own versions of these rules, and not every state permits non-consensual screening of lateral conflicts in the same way. Confirm the rule that applies to your firm with your ethics counsel.

For IT, the work comes down to three common scenarios:

• Lateral hires. A new lawyer or staff member is blocked from specific matters because of work at a prior firm.
• Conflicts on new or existing matters. The firm takes on a matter that is adverse to another client, or represents opposing sides of a transaction with consent, and the two teams have to be separated.
• Need-to-know matters. A client, or the matter itself (a sensitive deal, an internal investigation, a high-profile client), requires that only the assigned team can see anything.

In each case the wall has to hold in every system where matter information lives, and the firm has to be able to show that it held.

The Short Answer: Who Offers What

No single cloud platform enforces an ethical wall across a whole law firm by itself. In practice, walls get built from a few layers:

The details of each layer, and the limits that matter, are below.

Microsoft 365: Information Barriers Plus Matter-Level Permissions

Most small and mid-sized firms already run on Microsoft 365, so this is usually where the conversation starts. Microsoft gives you two different tools that work together.

What Purview Information Barriers do

Microsoft describes Microsoft Purview Information Barriers (IB) as a compliance solution that restricts two-way communication and collaboration between groups and users in Microsoft Teams, SharePoint and OneDrive. Microsoft’s own list of example scenarios includes this one: “A lawyer’s data obtained from one client can’t be accessed by a lawyer at the same firm who represents a different client.”

Here is how it works, according to Microsoft’s documentation:

• Segments. You group users into segments based on directory attributes in Microsoft Entra ID, such as department or group membership. Outside of legacy mode, Microsoft documents support for up to 5,000 segments, with a user able to belong to up to 10 (Get started with Information Barriers).
• Block or allow policies. A block policy prevents one segment from communicating with another. An allow policy lets a segment communicate only with specific other segments.
• Teams enforcement. Policies are checked when someone is added to a team, starts a chat, invites someone to a meeting, shares a screen or places a Teams call. Blocked users don’t appear in the people picker. If a policy changes, existing 1:1 chats between newly blocked users become read-only, and affected users are removed from group chats (Information Barriers in Microsoft Teams).
• SharePoint and OneDrive enforcement. Sites can be associated with segments. In “Explicit” mode, only users whose segment matches the site can access and share its content, and “Anyone” and company-wide sharing links are disabled (Use Information Barriers with SharePoint).

What Information Barriers don’t do

Most failed Microsoft 365 wall projects come from misunderstanding these limits:

• Email is not covered. Microsoft states that IB policies can’t restrict communication and collaboration in email, including Exchange Online, and points to Exchange mail flow rules for that.
• Barriers are two-way only. One-directional restrictions (“A can talk to B, but B can’t talk to A”) aren’t supported.
• Segments are built from directory attributes, not matter numbers. IB is designed around groups of people. For “this one associate can’t touch this one matter,” the matter-level permissions described below are usually the better fit, with IB added where communication between two teams also has to be blocked.
• Licensing and lead time. IB is a licensed Purview capability, and Microsoft notes that users in assigned segments require licenses. Prerequisites include enabling scoped directory search in Teams and waiting before you define policies, and Microsoft advises allowing time for policies to propagate. Check your subscription before you plan the rollout.

Matter-level access in SharePoint and Teams

For walling a specific person off a specific matter, the cleaner Microsoft 365 pattern is usually one site (or team) per matter, with access granted through a group that mirrors the matter team.

Microsoft’s restricted site access control tightens this up. When it’s applied, users who aren’t in the specified Microsoft 365 or Entra security group can’t access the site or its content, “even if they had prior permissions or a shared link.” Microsoft also says organization-wide search and Copilot results honor the policy, which matters now that AI assistants can surface content from across the tenant.

Two caveats from Microsoft’s documentation:

• Private and shared channel sites in Teams are separate site collections. A restriction on the parent team’s site doesn’t automatically apply to them, so each one has to be configured on its own.
• Restricted access control is part of SharePoint Advanced Management, which has its own licensing prerequisites. Confirm eligibility for your tenant.

SharePoint Advanced Management also includes data access governance reports, including a “site permissions for a given user” report that lists every site a user can access and how that access was granted. That report is very useful when a lateral hire arrives and you need to confirm what they can actually reach.

Google Workspace: Trust Rules for Drive

Firms on Google Workspace have a more limited native option. Trust rules for Drive sharing let administrators set policies, applied to users, groups, organizational units and domains, that control whose files can be shared with whom, both internally and externally. Google’s own example is restricting Finance-owned files so they can be shared only with Finance and Executives.

Trust rules apply to Google Drive sharing, and Google lists them only for certain editions (Enterprise Standard and Plus, Frontline Plus, Education Standard and Plus, and Enterprise Essentials Plus at the time of writing). They are a useful layer, but they aren’t a complete wall on their own.

Legal Document Management Systems: Where Most Walls Live

For firms that use a legal DMS, the DMS is usually the most important place to enforce the wall, because that’s where the work product is.

iManage Security Policy Manager

iManage’s administration guide describes Security Policy Manager as delivering “need-to-know security, ethical walls and information barriers” across iManage Work and Records Manager, as well as non-iManage systems such as time and billing and conflict management. Per iManage’s documentation:

• Security can be assigned at the client, client group, matter, case, department and location level, with access granted to or denied from specific users and groups.
• Policy types include restricted (need-to-know) access, opposing client/matter segregation and conflicted user exclusions.
• Client and matter details are typically imported from a time and billing or practice management system, and users and groups from Active Directory. Self-maintaining rules can then add or remove people from matter teams automatically.
• Policies can be managed centrally by conflicts, IT or risk, or delegated to client or matter teams. All changes are audited, with reporting for client and regulatory audits.

iManage’s product page also says AI tools that access iManage content through its MCP Server and connected third-party tools are subject to the same access policies as users.

NetDocuments

NetDocuments’ ethical walls page describes letting authorized users create, edit and apply security policies to content in NetDocuments workspaces, to build ethical walls “around specific users and documents,” with access controls at the user, document or workspace level and reporting on who is accessing which documents.

We couldn’t find a public NetDocuments administrator article describing the configuration steps in detail, so ask your NetDocuments administrator or partner to walk you through how walls are configured and reported in your specific repository.

Practice Management: Don’t Leave the Back Door Open

A wall in the DMS doesn’t help much if the screened lawyer can still open the matter’s notes, contacts and communications in the practice-management system.

Clio Manage is a good example of what to look for. According to Clio’s help article on matter permissions:

• Matters are visible to all firm users by default. You can restrict a matter to specific users or groups (up to 20 per matter).
• Administrators can block specific users from viewing or accessing a matter, which Clio describes as useful “if there may be a conflict of interest.” Blocking overrides group permissions, and blocks can be applied in bulk.
• Administrators can filter for matters they are restricted from and update permissions in bulk to audit and correct access.

Clio’s documentation also includes an important caveat: users who don’t have access to a matter may still see its bills if they have billing or accounts permissions, and may see matter details in reports if they have reports permissions. Role permissions have to be reviewed alongside matter permissions. Whatever practice-management system your firm uses, ask the same question: which side doors (billing, reporting, search, integrations) bypass matter-level restrictions?

Dedicated Walls Platforms: One Policy, Many Systems

As firms add systems, maintaining the same wall by hand in five places stops being realistic. That’s the problem dedicated walls platforms address.

Intapp Walls is the best-known example. Intapp describes it as letting firms set policies once and enforce them across people, systems and AI tools, with self-maintaining rules that update as matter activity and firm data change, recorded user acknowledgments when policies change, automatic reversal of unauthorized changes made in systems outside Intapp Walls, and configurable reporting on policy activity. iManage Security Policy Manager plays a similar central role in iManage environments.

These tools are typically licensed and implemented as their own projects. For a smaller firm, a well-documented manual process across two or three systems may be enough. Once the number of systems or walls grows, central enforcement becomes much easier to defend.

How an IT Provider Should Set Up, Audit and Maintain Ethical Walls

The platform features are the easy part. Walls usually fail on process: a step gets skipped, an exception never gets removed, or a new system gets added without anyone extending the wall to it. A sound approach looks like this.

1. Inventory every place matter information lives

Email, Teams/chat, SharePoint/OneDrive or Drive, the DMS, practice management, billing, file shares, scanners and their destination folders, backup consoles, eDiscovery tools and AI assistants. A wall is only as strong as the system it wasn’t applied to.

2. Make conflicts the trigger, not an IT ticket

The decision to screen someone belongs to the conflicts team or ethics partner. IT should receive a defined request (who, which matter, effective date, which systems) through a documented workflow, and confirm back when enforcement is complete. Given the Rule 1.0 comment’s emphasis on timeliness, set an internal service level for how quickly walls are applied.

3. Enforce in layers

• ✅ Matter-level restriction or user block in the DMS
• ✅ Matter-level restriction or user block in practice management, plus a review of billing and reporting roles
• ✅ Restricted, group-based access on the matter’s SharePoint site or Team, including any private or shared channels
• ✅ Information Barriers (or equivalent) where communication between two teams also has to be blocked
• ✅ Mail flow rules if email between specific people has to be restricted (IB doesn’t cover email)
• ✅ Confirmation that AI assistants and search respect the same permissions

4. Log everything, and keep the logs long enough

Microsoft’s Purview Audit captures user and admin activity across Microsoft 365 services. Microsoft documents 180-day retention for Audit (Standard) and longer retention options with Audit (Premium) and add-ons. If your walls may need to be evidenced long after the fact, decide now whether that’s long enough or whether logs need to be exported to a SIEM or archive. Keep DMS and walls-platform reports alongside them.

5. Run access reviews on a schedule

Microsoft Entra access reviews let you set up recurring reviews of group membership (weekly, monthly, quarterly or annually) so matter owners confirm who still needs access. Microsoft lists Entra ID Governance (or Entra Suite) licensing for this feature, with some capabilities available under Entra ID P2. Whatever tool you use, review walled matters on a fixed cadence and keep the evidence.

6. Build walls into onboarding, role changes and offboarding

• Onboarding laterals: Conflicts clears the hire, walls are applied before the account is enabled, and IT runs a “what can this user reach” report on day one.
• Role or team changes: Directory attributes drive IB segments and dynamic groups, so a title or department change can move someone across a barrier. Treat attribute changes as access changes.
• Offboarding: Disable access everywhere, and keep the wall documentation. Former-client certification obligations don’t end when the employee leaves.
• Lifting a wall: Only on written instruction from conflicts or the ethics partner, and logged like any other change.

Common Mistakes We See

• Treating a folder permission set by hand as the wall, with no record of who set it or when
• Walling the DMS but not Teams, OneDrive, practice management or billing
• Assuming Information Barriers cover email (they don’t)
• Forgetting that Teams private and shared channels have their own sites
• Rolling out an AI assistant before confirming it respects matter-level permissions
• Letting the vendor’s default “everyone in the firm can see everything” setting stand
• No periodic review, so walls drift as people change roles

Frequently Asked Questions

Does Microsoft 365 have ethical wall controls?

Yes, in two forms. Purview Information Barriers block communication and collaboration between defined segments of users in Teams, SharePoint and OneDrive, but not email. SharePoint restricted access control and group-based site permissions limit who can open a specific matter site. Both have licensing prerequisites, so check your subscription.

Is an ethical wall in our DMS enough?

Usually not by itself. The Comment to ABA Model Rule 1.0 describes denying the screened lawyer access to information relating to the matter, “including information in electronic form.” If matter information also lives in email, Teams, practice management or billing, the wall needs to reach those systems too. Your ethics counsel should define the scope.

Do small firms need a dedicated walls platform like Intapp Walls?

Not necessarily. A firm with a few systems and an occasional wall can often enforce it with native controls and a documented process. As the number of systems and walls grows, a central policy engine reduces the risk of a missed step.

Can our IT provider decide when a wall is needed?

No. That’s a legal and ethical decision for the firm’s conflicts team or ethics partner. IT’s role is to enforce the decision quickly and completely, and to produce the evidence that it was enforced.

How BrightWorks IT Helps Law Firms

BrightWorks IT supports law firms with legal IT services that cover the technical side of ethical walls end to end. We map where your matter data lives, configure Microsoft 365 and your other platforms to enforce walls consistently, connect the process to your conflicts workflow, and set up the logging and access reviews you need to show compliance. That work sits alongside our cybersecurity, compliance and cloud solutions services.

For a broader look at law firm security requirements, see our guide to IT compliance for law firms.

Find Out Where Your Walls Actually Stand

If you aren’t sure whether your firm’s ethical walls hold in every system, or whether you could prove it if a former client asked, start with an assessment. We’ll review how matter access is controlled today, where the gaps are and what it would take to close them.

Schedule your free IT assessment →

BrightWorks IT provides managed IT, cybersecurity and cloud services for small and mid-sized businesses, including law firms. This article is general technology information, not legal advice. Product capabilities are summarized from vendor documentation available at the time of writing and may change.