# Customer Lockbox

> Customer Lockbox requires explicit approval from your organization before Microsoft engineers can access your data during support operations.

Customer Lockbox requires explicit approval from your organization before Microsoft engineers can access your data during support operations. Enabling this feature gives you greater control and transparency over data access for support scenarios.

## Settings this baseline controls

| Setting                  | What it does                                                                                                                                                                                                                |
| ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Customer Lockbox enabled | Enables or disables Customer Lockbox, which requires approval for Microsoft support to access your data. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-organizationconfig?view=exchange-ps) |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline turns on Customer Lockbox, so Microsoft can't access this client's data during a support case without your explicit approval first.

1. Add the baseline to the tenant directly ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)) or through a scheme ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. Turn on **Customer Lockbox enabled**. It's a single tenant-wide switch, with nothing else to configure.
3. Save. **Auto-remediation** is safe to turn on, since it only re-asserts the same switch and never affects anyone's day-to-day access.

> **Licence: Customer Lockbox:** This baseline only applies to tenants licensed for Customer Lockbox (see [Licence requirements](https://docs.octiga.io/reference/licence-requirements/)).

## Check it worked

Passing means **Microsoft 365 admin centre → Settings → Org settings → Security & privacy → Customer Lockbox** shows **Require approval for all data access requests** checked. Users notice no change. If a Microsoft support engineer needs to access the tenant's content to resolve a ticket, your organisation's designated approver gets an email asking them to approve or deny that request first.

## Standards this addresses

### CIS

- **M365 1.3.6** — CIS M365 Foundations Benchmark 1.3.6
- **v8 3.3** — CIS Controls v8 Safeguard 3.3

### NIST

- **PR.PT-3** — NIST CSF 2.0 PR.PT-3
- **AC-20** — NIST SP 800-53 AC-20
- **SC-7** — NIST SP 800-53 SC-7

### ISO 27001

- **A.5.8** — ISO/IEC 27001:2022 Annex A.5.8
- **A.5.22** — ISO/IEC 27001:2022 Annex A.5.22

### GDPR

- **Article 28** — GDPR Article 28
- **Article 32** — GDPR Article 32

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)