What this check looks at
Checks that Customer Lockbox is on, so a Microsoft engineer needs the organisation’s approval before looking at its data during a support case.
When a Microsoft support engineer needs to look at a customer’s content (mailbox data, files in SharePoint or OneDrive, Teams data) to resolve a support case, Microsoft’s internal approval process grants temporary access. Customer Lockbox adds the customer to that process: the request waits until someone in the organisation approves or rejects it, and every request and decision is recorded in the audit log. It is off by default and needs a licence that includes it, such as Microsoft 365 E5 or E5 Compliance.
The check is not applicable unless the tenant’s licences include Customer Lockbox. Where they do, it reads the CustomerLockBoxEnabled setting from Exchange Online’s organisation configuration and fails when it is off, passes when it is on.
With Customer Lockbox off, access during a support case is approved by Microsoft alone. That is not an attack route in the usual sense, but it means the organisation cannot show a regulator, auditor or customer who looked at its data, when and why, and has no chance to refuse.
Why it matters
Customer Lockbox puts the organisation, not Microsoft, in charge of when its content is looked at during support, and leaves an audit record of every request. Regulators and customers often ask for it.
Organisations handling sensitive data, such as law firms, medical practices and financial advisers, are often asked by clients and regulators how their cloud provider’s access is controlled. With Customer Lockbox on the answer is concrete: nobody at Microsoft sees content unless a named person in the firm approves that specific request, and the audit log proves it.
Under UK GDPR, Microsoft acts as a processor and the organisation remains the controller, responsible for overseeing how its processors access personal data. Customer Lockbox turns that oversight into a recorded approval. Where the licence is already paid for it costs nothing; the only operational cost is answering the occasional request within 12 hours.
CIS Microsoft 365 Foundations Benchmark 1.3.6 asks for Customer Lockbox to be enabled. ISO 27001 A.5.15 (access control) and A.5.19 (information security in supplier relationships), NIST CSF 2.0 PR.AA-05, NCSC CAF A4.a (supply chain) and the NCSC’s supply chain security guidance all expect control over a supplier’s access to data.
How to fix it
Where: Microsoft 365 admin centre → Settings → Org settings → Security & privacy
Before you start
- Needs a licence that includes Customer Lockbox (E5, or the add-on). Agree who approves requests: Customer Lockbox access approvers are notified by email.
Step by step
- Confirm the licence. In the Microsoft 365 admin centre, go to Billing > Licences and check the tenant holds Microsoft 365 E5, Office 365 E5, Microsoft 365 E5 Compliance or the Customer Lockbox add-on. Without one of them the check is not applicable.
- Choose and assign the approvers. Agree with the client one or two people who will approve requests. In the Microsoft Entra admin centre, go to Entra ID > Roles & admins, open Customer LockBox Access Approver and add them with Add assignments. Global Administrators can approve too, but named approvers stop requests waiting on someone who does not read the email.
- Turn on Customer Lockbox. In the Microsoft 365 admin centre, go to Settings > Org settings, select the Security & privacy tab, then Customer lockbox. Tick Require approval for all data access requests and select Save.
- Or turn it on in PowerShell. Connect with Connect-ExchangeOnline and run Set-OrganizationConfig -CustomerLockBoxEnabled $true. The setting covers Exchange Online, SharePoint, OneDrive and Teams together.
- Tell the approvers how requests arrive. Approvers receive an email when Microsoft asks for access and review it in the Microsoft 365 admin centre under Support > Customer Lockbox requests. A request not approved within 12 hours expires, which can hold up a support case, so make sure they know what to expect and who to call about it.
- Confirm the setting. Run Get-OrganizationConfig | Format-List CustomerLockBoxEnabled and check it shows True, or reopen Settings > Org settings > Security & privacy > Customer lockbox and confirm the box is ticked. The next assessment passes.
With PowerShell
Set-OrganizationConfig -CustomerLockBoxEnabled $true
What users will notice
None for users. Microsoft support cases that need access to content wait for an approver.
How to confirm it worked
Get-OrganizationConfig shows CustomerLockBoxEnabled as True.
Frameworks and controls
This check maps to controls in 14 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | A4.a Supply chainB3.c Stored data |
| DSPT | Standard 10: Accountable suppliers |
| DORA | Art. 28 Management of ICT third-party risk |
| NIS2 | Art. 21(2)(d) Supply chain security |
| Microsoft Cloud Security Benchmark | PA-7 Follow just enough administration (least privilege) |
| Zero Trust | Data |
| SOC 2 | CC6.3 Role-based access and least privilege |
| NIST SP 800-171 | 3.1.1 Limit system access to authorised users, processes and devices |
| CMMC Level 2 | AC.L2-3.1.1 Authorized Access Control |
| ISO 27001:2022 | A.5.15 Access controlA.5.19 Information security in supplier relationships |
| CIS M365 | 1.3.6 Ensure the customer lockbox feature is enabled |
| CIS Controls v8.1 | 3.3 Configure data access control lists (IG1) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Supply chain securityData security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Customer Lockbox (Microsoft Learn)