I would assume that the City(/County) of San Francisco IT Department also gets access to and control of the backend, in a similar manner as if they were hosting

I would assume that the City(/County) of San Francisco IT Department also gets access to and control of the backend, in a similar manner as if they were hosting it themselves. This would include things like privacy policies, security and account recovery, spam filter, attachment policies/malware scrubbing, recovery/removal of email when an employee is terminated, usage logs, and some way of obtaining an employee's email in the event of a lawsuit or disciplinary action. Optional possibilities include stronger guarantees about the provider's (in)ability to access the emails, and filtering tools to alert about suspicious (corruption, child porn) or non-work-related (hate speech, regular porn) email content.