Skip to main content
Version: 3.0.0-preview

CIS.M365.1.3.6 - (L2) Ensure the customer lockbox feature is enabled

Ben MilesSam Erde-Mynster
Contributed by Ben Miles with 2 co-contributorsAll contributors →

Overview​

1.3.6 (L2) Ensure the customer lockbox feature is enabled

Customer Lockbox is a security feature that provides an additional layer of control and transparency to customer data in Microsoft 365. It offers an approval process for Microsoft support personnel to access organization data and creates an audited trail to meet compliance requirements.

Rationale​

Enabling this feature protects organizational data against data spillage and exfiltration.

Impact​

Administrators will need to grant Microsoft access to the tenant environment prior to a Microsoft engineer accessing the environment for support or troubleshooting.

Remediation action​

To enable the Customer Lockbox feature:

  1. Navigate to Microsoft 365 admin center https://admin.microsoft.com.
  2. Click to expand Settings then select Org settings.
  3. Select Security & privacy tab.
  4. Click Customer lockbox.
  5. Check the box Require approval for all data access requests.
  6. Click Save.
PowerShell​
  1. Connect to Exchange Online using Connect-ExchangeOnline.
  2. Run the following PowerShell command:
Set-OrganizationConfig -CustomerLockBoxEnabled $true

Test Metadata​

FieldValue
Test IDCIS.M365.1.3.6
SeverityMedium
SuiteCIS
ProductMicrosoft 365
Related productsPurview
FeatureOrganization settings
AreaAccess control
Resource typeTenant
User impactLow
Implementation costLow
MITRE ATT&CKT1199 Trusted Relationship
Supports benchmarkCIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 1.3.6
Benchmark levelL2
Benchmark profilesE5 Level 2
Supports controlscis-m365:1.3.6
PowerShell testTest-MtCisCustomerLockBox
ServicesExchangeOnline
Compatible licensesLOCKBOX_ENTERPRISE

Source​