Check ID:
Provider: Microsoft 365
Service:
Severity: HIGH
Categories:
Resource type:
admincenter_organization_customer_lockbox_enabledProvider: Microsoft 365
Service:
admincenterSeverity: HIGH
Categories:
identity-access, e5Resource type:
NotDefinedWhat this check verifies
Microsoft 365 organization setting indicates whether Customer Lockbox is enabled to require explicit approval for Microsoft support access to customer contentRisk
Without Customer Lockbox, Microsoft engineers may access tenant content during support without your approval, undermining confidentiality and accountability. This increases risks of targeted data exposure, insider misuse, and weakens auditability of access during troubleshooting.Recommendation
Enable Customer Lockbox to enforce tenant approval for data access (Require approval for all data access requests).
- Limit approvers per least privilege
- Establish an on-call review workflow
- Audit requests and engineer actions
- Layer with defense in depth (MFA, RBAC, logging) to strengthen control
Remediation
- CLI
- Dashboard steps
Set-OrganizationConfig -CustomerLockboxEnabled $true
References
- https://www.gitbit.org/course/ms-500/learn/locking-down-your-microsoft-365-tenant-from-microsoft-engineers-fldnualgc
- https://learn.microsoft.com/en-us/azure/security/fundamentals/customer-lockbox-overview
- https://learn.microsoft.com/en-us/microsoft-365/compliance/customer-lockbox-requests?redirectSourcePath=%2flv-lv%2farticle%2fOffice-365-klientu-lockbox-piepras%25C4%25ABjumu-36f9cdd1-e64c-421b-a7e4-4a54d16440a2&view=o365-worldwide
- https://learnthecontent.com/exam/microsoft-365/ms-700-managing-microsoft-teams/s/enable-customer-lockbox-for-data-security
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = admincenter_organization_customer_lockbox_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks