Page tree
Skip to end of metadata
Go to start of metadata



Please contact us via email or phone +41 44 632 77 77

Data protection and privacy

General Information

The use of Microsoft 365 is established in close coordination with the Chief IT Security Officer. It should be noted that the requirements regarding information security and data protection also remain valid when using cloud services.

=> No confidential data may be processed or stored in the Microsoft Cloud.

According to the directive “Information security at ETH Zurich”, the information owners are responsible for the correct classification. All users of Microsoft 365 / Teams must confirm that they have read these terms of use during the subscription. 


All data which are treated by the users in the Microsoft cloud are encrypted in both transport and storage. Here you will find an overview of the different encryptions per service.



Encryption during transport


Server-zu-Server MTLS
Client-zu-Server (Sofort-Nachrichten, Status) TLS
Audio und Videofreigabe TLS/SRTP
Signalisierung TLS

SharePoint Online

Client-zu-Server TLS
Rechenzentrum-zu-Rechenzentrum TLS

OneDrive for Business

Client-zu-Server TLS
Rechenzentrum-zu-Rechenzentrum TLS

Exchange Online

Not applicable - wird in der ETH Zürich zurzeit on-Premise gespeichert



Encryption data storage (Data @ Rest)


AES-256 (SharePoint Online)

SharePoint Online


Pro Datei und Tenant wird ein individueller Schlüssel (Handling durch SharePoint Online Dienst) erzeugt bevor Dateien in Azure Storage abgelegt werden.

Azure Storage selbst kann Dateien nicht entschlüsseln da Schlüssel nur für SharePoint Online Dienst lesbar ist.

Alle Ver- und Entschlüsselung findet im gleichen Sicherheitskontext wie die Tenant Isolierung statt, welche ebenfalls Azure AD und SharePoint Online von anderen Kundenumgebungen trennt.

OneDrive for Business

AES-256 (SharePoint Online)

Exchange Online

Not applicable - wird in der ETH Zürich zurzeit on-Premise gespeichert


Data storage

All data used by the user in the Microsoft Cloud is encrypted both in transport and in storage. The data is stored in Microsoft data centers in Switzerland or at locations in the European Union (EU). All applications in which Microsoft stores data outside of Switzerland or the EU have been deactivated by the ID. Exceptions to this must be approved by the school management.

 Where is my data stored?

The following table shows where Microsoft stores its data for Microsoft 365 services used in Switzerland.

Service / Application Location
OneDrive for BusinessSwitzerland
SharePoint OnlineSwitzerland
Microsoft TeamsSwitzerland
Office Online & MobileSwitzerland
PlannerGlobale Region 1 – EMEA
OneNote ServicesSwitzerland
StreamGlobale Region 1 – EMEA
WhiteboardGlobale Region 1 – EMEA
FormsGlobale Region 1 – EMEA

Note: The "Global Geography 1 - EMEA" region described by Microsoft includes data center locations in Finland, Austria, France, Ireland and the Netherlands

The complete and actual list about data storage and its location for Microsoft 365 services used in Switzerland can be called up under the following link:
Use of online services Microsoft uses so-called online services to convert certain formats. For this purpose, certain file types are sent to this online-service for conversion. The converted file is then immediately sent back to the user's computer. In such cases, the transfer to and from Microsoft takes place via a secure connection. The Microsoft Online Service does not save any data on its servers. More information on this topic: 

Microsoft ensures that data in the event of loss can be restored for the affected users within a period of up to 90 days. All users of Microsoft 365 are created with their identities from the Active Directory (AD) in the Microsoft Cloud. We use a procedure called ADFS to register. This synchronizes the identities in the Microsoft Cloud. The ETH username and the ETH password are used for registration. Office 365 does not use a separate password and does not save it in the cloud. 

Use of logging data in Microsoft 365

Microsoft 365 brings together various log data that arise when using Microsoft 365 cloud services in a central container under the name Unified Audit Log (UAL). This logging of log data is saved by Microsoft in the cloud and made temporarily accessible to ETH Zurich. The IT services have drawn up a logging policy in cooperation with the Chief Security Information Officer. This describes the framework as well as the accompanying technical and organizational protective measures that form the prerequisites for the operation of the Unified Audit Log of MS 365. 

=> Link to the Logging Policy (in German)

Multi-factor authentication for guest access to MS Teams

When using cloud services, additional security measures must be taken in order to prevent unauthorized access to the data stored in the cloud. For this reason, multi-factor authentication is activated for all guests. This means that all guests must register a second factor when logging in for the first time, e.g. a mobile phone or an authenticator app.

In addition to the mandatory password, the guest must then identify himself, depending on the method selected, using an SMS code sent to a smartphone or using a specific authentication app. The combination of several authentication factors increases the certainty that the user who is currently trying to authenticate is actually who he claims to be.

Set-up of the multi-factor authentification  

Step 1: Click on the link in the invitation email "Open Microsoft Teams". If the email address to which the invitation was sent is not yet linked to a Microsoft account, you must first create an account.


Step 2: The "More information required" screen will be displayed. Click "Next"

Step 3: Choose which method you want to use to authenticate yourself. 

The following options are available:
  • Authentication phone / mobile Phone (SMS or call back)
  • Office phone 
  • Mobile app

Option 1: You can have an SMS code sent to your mobile phone.

Option 2: In case you select the office phone option, you can answer the call on your landline.

Option 3: In case you wish to use the Microsoft Authenticator app, please select "Mobile App". 

When using the Authenticator app from Microsoft (download link, it must not be deleted after registration. The Authenticator app must also be reconfigured after a device change.

An explanatory video how to set up the Microsoft Authenticator app is available under the following link:

The multifactor authentication must be confirmed regularly. Whenever you then log in again or after a long period of inactivity on a device with your Microsoft 365 account, you have to confirm the registration by another factor. This procedure is reliable protection against phishing or unauthorized login with your Micrososft365 account and password.

Each user can also check or manage the MFA settings directly via the following link:

Here you can switch to a different method, store additional registration methods and set the standard registration method. It is recommended to store at least one additional registration method in the event that the preferred route is not available, for example in the event of a defect / replacement of your mobile phone.

Information architecture

Microsoft Teams is the central element of the Microsoft 365 landscape, but has no data storage itself. Teams divides the data that is generated in a team into different applications:

Group conversations and the group calendar are stored in Exchange
Meetings are stored in Exchange as well
Team chats are also stored in Exchange
Meeting recordings end up in Stream
All other documents, the OneNote notebook and the SharePoint Wiki end up in the site collection in SharePoint.
File attachments in a chat and attachments to tasks from Planner are stored in SharePoint.

Based on the current Exchange Hybrid mode used within ETH, certain deviations may arise from the above illustration. Voice mail is deactivated and chats are not recorded in Exchange due to the hybrid exchange mode.

  • No labels