Before you let an outsider into your organisation, you want to know: what does this person see, what can they do, what do they mean for your security? The honest answer: as an adoption and enablement consultant I work with your people, not with your systems. I need no admin rights, no tenant access and no access to production data. This page tells you openly what that means, and where the line to your IT runs.
Most security concerns about external partners come down to one question: what could this person do, deliberately or by accident? With me, the answer is structurally small. Adoption needs no rights in your systems.
I do not configure your Microsoft 365 tenant. I need neither global admin roles nor access to your production systems or sensitive data. My work happens in training rooms, workshops and conversations, not in your admin centres.
The people I deal with are your employees, your champions and your leaders. I show them how to use the tools safely and productively. The lever is behaviour, not technical settings. That keeps my contact with your systems close to zero.
Every external access is a risk you have to manage. If a consultant as a rule needs no technical access, that risk largely disappears. For your security team this is the key point: no account with far reaching rights that could be compromised.
You work with me throughout, not with rotating junior teams that each need access, onboarding and insight. Fewer people with insight means less surface for you to keep an eye on.
So that there is no misunderstanding: adoption and technical governance are two separate worlds. I know both sides, but I deliver only one. The other stays with you on purpose, where it belongs.
Training, e-learning, champion programmes, use cases, change support, usage measurement and C-level coaching. I teach the safe and productive use of Microsoft 365 and Copilot. You’ll find the details under Copilot training including safe use.
Permissions, Purview, DLP, data residency, admin settings and tenant configuration stay with your IT and security. I do not implement any of it, and I do not want to. That is your authority and your responsibility.
I know the technical topics and I ask for them as a precondition before Copilot is rolled out. One example is the oversharing risk: before you train broadly, your permissions should be in order. More on this on the blog.
I stay in my role. I do not slip step by step into technical tasks where your IT has to keep control. Clear boundaries protect you and keep the responsibilities cleanly separated.
Besides minimal access, what counts is how I handle what I see and hear, and whether I understand the regulated environment you move in.
I sign your non-disclosure agreement and treat everything I come across during our work together as confidential. For me that is standard, not a special case.
Four years at a major Swiss bank. I know the banking secrecy and FINMA context, and the justified caution of regulated institutions, from practice. I work within your existing guard rails, not against them. More on this under Copilot for banks and regulated industries.
I work as a Swiss provider under the revised Swiss Data Protection Act (revDSG), the Swiss counterpart to the GDPR. In the training sessions I teach safe use: which use cases are fine, and what you do not put into Copilot. That is the behavioural counterpart to the technical guard rails set by your IT. How I handle your data is described in the privacy notice.
Usage is measured and can be evidenced to the executive board and to internal audit. At a major Swiss bank, 712 responses gave 97.9% approval and 90.2% clarity, across more than 4,000 training participations in four years. You’ll find the anonymised case study in the case study.
No. For adoption and enablement I need no admin rights, no tenant access and no access to your production systems or sensitive data. I work with your people in training sessions, workshops and conversations. If a task were to require limited access as an exception, you define the scope and the duration, and it runs through your IT under your rules.
Yes. I sign your non-disclosure agreement and treat everything I come across during our work together as confidential. For me that is standard, not a special case.
I do not put confidential data of yours into Copilot. In the training sessions this is exactly one of the core topics: I teach your employees which use cases are fine and what you do not put into Copilot. Safe everyday use complements the technical rules set by your IT.
No, and I do not claim to be. I am a single consultant for adoption and enablement, not a platform that processes your data. My security argument does not lie in certificates. It lies in the fact that structurally I need almost no access, and therefore create hardly any risk.
No. I am not a legal or compliance adviser, and I give no compliance guarantees, neither GDPR nor FINMA. I do not obtain regulatory pre-approvals. I know the regulated context from four years at a major Swiss bank and I work within your existing rules, but the legal and regulatory assessment stays with your specialist and legal functions.
That stays entirely with your IT and security. Permissions, Purview, DLP, data residency and admin settings are not something I implement. I know the topics, I ask for them as a precondition before a rollout, for example against oversharing, and I respect the clear boundary between my adoption work and your technical governance.
If your security or procurement team still has open questions, I am happy to go through them before anything is signed. Book an intro call or read more about me.
Book your call now or fabrizio.marra@worksmart365.ch