cirsec Baselines
Esc
Microsoft 365 tenant · Data protection

Enable Customer Lockbox

When it fails: Microsoft engineers can access tenant content during support operations without the organization's approval. Without Customer Lockbox, data access by Microsoft support engineers is approved inside Microsoft only, and the organization has no say and no explicit record of the request.

CB-M365-DATA-008lowactivemanualprofile hardened

Description

Customer Lockbox is enabled for the organization. When a Microsoft engineer needs access to customer content to resolve a support case, the request is sent to approvers in the organization (Customer Lockbox Access Approver role), who approve or reject it within the time limit, and each request is recorded in the audit log.

Rationale

Access by the cloud provider's staff is one of the specific risks of hosting sensitive data in a public cloud. Customer Lockbox makes this access subject to the organization's explicit, logged approval, which supports the risk analysis of CB-M365-DATA-010 and contractual or regulatory requirements on third-party access.

Impact

Support cases that need content access wait for an approver. Name at least two approvers and include the approval step in the support procedure. Customer Lockbox does not cover every scenario (for example legal requests handled outside support).

Applies when

Requires: Microsoft Purview E5 Compliance

Setting

LocationMicrosoft 365 admin center > Settings > Org settings > Security & privacy > Customer lockbox (Exchange Online Get-OrganizationConfig CustomerLockBoxEnabled)
DefaultOff
RecommendedRequire approval for all data access requests

Audit

  1. Sign in to the Microsoft 365 admin center (https://admin.microsoft.com) as at least a Global Reader.
  2. Browse to Settings > Org settings > Security & privacy > Customer lockbox and check that Require approval for all data access requests is selected.
  3. Browse to Entra ID > Roles & admins in the Microsoft Entra admin center and check that Customer Lockbox Access Approver has at least two active or eligible members.
  4. Alternative in Exchange Online PowerShell: Get-OrganizationConfig | Select-Object CustomerLockBoxEnabled.
  5. Fail if CustomerLockBoxEnabled is False or if no approver is assigned.

Remediation

  1. Assign the Customer Lockbox Access Approver role to at least two people (eligible through PIM where available).
  2. Sign in to the Microsoft 365 admin center as a Global Administrator.
  3. Browse to Settings > Org settings > Security & privacy > Customer lockbox, select Require approval for all data access requests and Save.
  4. Alternative in Exchange Online PowerShell (Organization Management): Set-OrganizationConfig -CustomerLockBoxEnabled $true.

Rollback

Clear Require approval for all data access requests, or Set-OrganizationConfig -CustomerLockBoxEnabled $false.

References

Mappings

FrameworkIDRelation
NIST SP 800-53 Rev. 55.1.1AC-3related
NIST SP 800-53 Rev. 55.1.1PS-7related

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

  • related CB-M365-DATA-010 Approve a risk analysis before hosting sensitive data in Microsoft 365

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr