Key takeaways
- California's ethics rules do not name MFA, but Business and Professions Code section 6068(e)(1) and rule 1.1 put client confidentiality and technology competence at stake.
- ABA Formal Opinion 498 lists multi-factor authentication among reasonable measures for protecting client information.
- Under California rule 5.1(a), managerial lawyers must make reasonable efforts to ensure the firm has compliance measures, which makes exception approval a management decision.
- The strongest compensating control is usually a different MFA method, such as a hardware security key or passkey.
- Every exception needs a named approver, compensating controls and a fixed expiry date.
Every law firm eventually has the conversation. A senior partner will not install the authenticator app, or will not let the firm manage the phone that holds client email. A quiet pass feels easiest, yet an undocumented exemption is the record a firm least wants to produce after a breach. This checklist shows how to turn a refusal into a written, time-limited MFA exception with controls that still protect client confidences.
Can a law firm let a partner skip MFA?
Yes, if the exception is a documented management decision backed by compensating controls, and it does not reduce the firm's duty to protect client information. California's ethics rules do not name multi-factor authentication. They do impose duties that a weak account puts at risk: Business and Professions Code section 6068(e)(1) requires an attorney to maintain inviolate the confidence, and at every peril to preserve the secrets, of a client, and comment 1 to rule 1.1 makes understanding the benefits and risks of relevant technology part of competence.
National guidance points the same way. ABA Formal Opinion 498, on virtual practice, lists multi-factor authentication to firm systems among the reasonable measures for protecting client information. ABA Formal Opinion 483 describes what lawyers owe clients after a breach, including monitoring firm technology and notifying clients when material confidential information is involved. ABA opinions are not binding in California, though they are a useful benchmark for what reasonable efforts look like.
Why does the exception need to be in writing?
A written exception turns a gap into a managed risk. Without it, the firm has a security policy that says one thing and a practice that says another, and no record of who decided or why. The NIST Cybersecurity Framework 2.0 describes the expected outcome in subcategory ID.RA-07: changes and exceptions are managed, assessed for risk impact, recorded and tracked.
Rule 5.1 adds a firm-level reason. Under rule 5.1(a), lawyers with managerial authority must make reasonable efforts to ensure the firm has measures giving reasonable assurance that all lawyers comply with the rules. A written exception process, applied the same way to every lawyer, is one of those measures.
What should the exception record include?
Keep it to one page, and keep every exception in a single register. Each record should include:
- The policy section being waived, such as "MFA required for Microsoft 365 sign-in" or "firm management required on any phone that accesses firm email."
- The person and accounts covered. One partner, named accounts, not "partners."
- The reason for the request, in the partner's terms. "Does not want firm software on personal phone" is a different problem from "the authenticator app keeps failing while traveling."
- The risk being accepted: what client information the account can reach, and what an attacker could do with it.
- The compensating controls in place for the life of the exception.
- The approver's name, role and date.
- A fixed expiry date, and who will review it before then.
Which compensating controls make an MFA exception defensible?
The strongest compensating control is usually a different form of MFA, because many refusals are about the method. Before writing an exception, offer the alternatives Microsoft 365 supports through authentication strengths, such as a hardware security key, Windows Hello for Business on the partner's firm laptop, or a passkey. A partner who objects to phone prompts may accept a key on a key ring. Our guide to phishing-resistant MFA options compares these methods.
If the partner refuses every method, narrow what the account can do:
- Allow sign-in only from a firm-managed computer, and block browser and mobile access from anything else.
- Restrict sign-ins to expected countries and block legacy authentication.
- Shorten session lifetimes so a stolen session expires quickly.
- Turn on risky sign-in alerts and review them weekly. Our article on spotting risky sign-ins covers what to watch for.
- Remove administrative rights and limit access to the matters the partner works on.
What if the partner refuses device management on a personal phone?
Refusing full device enrollment does not have to mean unmanaged client email. Microsoft's app protection policies protect firm data inside Outlook and Teams without the firm managing the whole phone. They can require a PIN for the app, block copying client content into personal apps, and let the firm wipe firm data without touching personal photos or messages. If the objection is personal privacy, app-level protection addresses it directly.
If the partner refuses both enrollment and app protection, the cleaner exception is no firm email on that phone, with access from a firm-issued device instead. Our guide to secure remote access from court and client sites covers options for attorneys who work away from the office.
Who should approve a partner's security exception?
The managing partner or management committee should approve it. The partner who asked should never approve their own exception. IT can describe the risk and the compensating controls, but accepting a risk to client confidences is a management decision under rule 5.1. If the managing partner is the one requesting the exception, route it to the management committee or another partner with authority. The approval should be dated and should reference the specific record, not a general conversation.
How long should the exception last?
Set a fixed expiry, usually 90 days and rarely more than a year, and review it before it lapses. An exception without an end date becomes the policy. At each review, ask whether the original reason still holds, whether the compensating controls are working, and whether a different authentication method would now be accepted. Close the exception as soon as the partner adopts a supported method, and record the closure.
What should you do this quarter?
- Pull a report of every account without MFA and every phone with firm email that is not under device management or app protection.
- Match each gap to a written exception. Any gap without one needs a decision.
- For each refusal, offer at least one alternative method before writing an exception.
- Put every exception in one register with owners and expiry dates, and review it at a management meeting.
- Confirm your written security policy describes the exception process, so it applies the same way to every lawyer and staff member.
How does s90 help?
s90 tracks policy exceptions in each client's risk register, configures the compensating controls in Microsoft 365, and reports open exceptions and their expiry dates in our Technology Posture Report, so the managing partner sees them alongside everything else. When a partner is ready to move from an exception to a supported method, we handle the setup. If you have refusals that have never been written down, we are happy to help you sort them out.
