By the end of 2025, the federal administration had moved around 54,000 workplaces operated by the Federal Office of Information Technology, Systems and Telecommunication to Microsoft 365. The migration ran from October 2024 to December 2025. Fifty-seven services are approved in the standard service. The Swiss Federal Audit Office has now examined the platform’s security and whether the additional functions are being used effectively. [1][2]
Appropriate protection for current use
The findings are nuanced. The SFAO says the platform was professionally set up in line with Federal Chancellery architecture rules and established methods. Safeguards are appropriate for the current restrictive use, and changes follow an established process. This is not a blanket clearance: Microsoft continuously adds cloud functions and security updates, so technical and organisational controls must keep pace. [1]
Four tasks remain open
The Federal Chancellery and FOITT must decide which security analyses should be monitored systematically. Configuration checks after new functions and updates should be automated as far as possible. A timetable for reviewing security-relevant settings and responding to deviations has yet to be defined. The required backup on the federal administration’s own systems is also still being built. [1]
Technology alone does not create value
Microsoft 365 gives federal staff additional tools for collaboration and cloud-based work. According to the SFAO, these tools bring real benefits only when working methods change as well. Continuous training and clear rules on permitted use are therefore necessary. [1]
The report neither identifies an acute security incident nor declares the platform risk-free. It describes a properly built platform with safeguards suited to present use, while highlighting unfinished work on monitoring, data sovereignty and recovery.
*Image: AI-generated illustration; OpenAI / Helvetia.rocks Editorial Desk; licence: AI-generated.*