Selling cloud based versions of business software has never been easy, particularly when it comes to addressing the thorny issue of administrator access. If my productivity applications and associated data are hosted and stored from afar, who can look at my documents, my spreadsheets, my e-mail?

Solution providers were just starting to get their arms around answering such questions when former NSA contractor Edward Snowden complicated things with leaks that showed persistent and invasive access of data by government intelligence agencies.

It isn’t so much that data in the cloud is any more at risk that information sitting in a local data center or some other on-premises equipment. In fact, there’s good evidence that cloud hosts do a better job of access control than most in-house IT departments. The problem has been explaining that to an increasingly skittish client base at a time when evolving the cloud has risen to the level of imperative for end users and the partners who serve them.

So it was refreshing this week to see Microsoft Corp. invest some effort in explaining exactly how it keeps client data in its Office 365 services away from unauthorized prying eyes through the prudent application of rights management and user-based access control.

Microsoft calls the Office 365 protection schema “lockbox” which is as good a name as any, we suppose, for what should be table stakes in the world of cloud applications and storage assets that involve critical business data. Microsoft corporate VP in the Office Server and Services unit Perry Clarke and OSS director of program management Vivek Sharma  teamed up for a video posted to the Microsoft Office blog this week that details the safeguards at work in Office 365.

httpsvh://www.youtube.com/watch?v=RgmF_JOzb_k

“The idea that somehow your data may be more accessible in Office 365 as a cloud service by the people administering and running the service, and therefore more vulnerable, is a common fear,” said Sharma. “How is it that we maintain the service and do not expose your data to engineers during troubleshooting activities?”

Microsoft accomplish this “lockbox” concept, the pair say, by implementing a stringent time-based work flow that allows only pre-assigned two-factor-authenticated administrators to request escalation. All actions related to customer data access go through a formal escalation and approval process that is supervised, logged, and audited. Administrators can only request permission to take actions based on their predefined set of privileges through role-based access control and even then are only allowed in for a specified time window for completion.

“Ultimately if the service is working properly, nobody has access to your data,” Clarke said. “There is zero standing access to your data, unlike in on-premises environments, where an administrator may have long-standing permissions and access.”

Sharma adds that the logs and audits of administrator activities, which are performed by both computer algorithms and human beings, are quick to show if an admin attempts to gain more access than is necessary to complete their maintenance task. “It’s pretty easy for us to see the outliers,” he said.

With lockbox, “no one has meaningful access to data without escalation of privileges and we limit what the tools used to troubleshoot the service can do,” Sharma added.

The RBAC systems ascribed to the Office 365 services aren’t groundbreaking or particularly surprising. But they are important for a couple of reasons.

First, they are added comfort in a time when cloud concerns in general – and the fears raised by the Snowden leaks in particular, are having broad repercussions in the IT industry andpushing potential customers to rethink their cloud computing deployment plans amid security and privacy concerns, according to a new survey.

Research by the Cloud Security Alliance late last year showed indicates growing reluctance to engage cloud services providers. That reluctance is acute among organizations outside the U.S. who’ve become increasingly doubtful of the integrity of data-center assets housed in the U.S. since the NSA scandal.

The survey found 56 percent of businesses based outside the U.S. are less likely to use U.S.-based cloud providers as a result of the Snowden affair. Some 10 percent say they’d already cancelled a project with a U.S.-based cloud provider.

The Office 365 lockbox description is also important as a tool to help solution providers answer the concerns of clients and respond to questions these customers haven’t even fully framed yet.  The Microsoft video does the cloud services community a service by putting voice to the fears partners deal with daily and showing how these issues can be explained in a thoughtful and relevant way.

You don’t even need to be selling Office 365 to appreciate a tool like that in your marketing arsenal.

This article originally appeared on Channelnomics.