Customer Lockbox
Customer Lockbox requires explicit approval from your organization before Microsoft engineers can access your data during support operations. Enabling this feature gives you greater control and transparency over data access for support scenarios.
Settings this baseline controls
| Setting | What it does |
|---|---|
| Customer Lockbox enabled | Enables or disables Customer Lockbox, which requires approval for Microsoft support to access your data. Learn more |
Configure it
This baseline turns on Customer Lockbox, so Microsoft can’t access this client’s data during a support case without your explicit approval first.
-
Add the baseline to the tenant directly (Adding a baseline) or through a scheme (Deploying a scheme).
-
Turn on Customer Lockbox enabled. It’s a single tenant-wide switch, with nothing else to configure.
-
Save. Auto-remediation is safe to turn on, since it only re-asserts the same switch and never affects anyone’s day-to-day access.
Check it worked
Passing means Microsoft 365 admin centre → Settings → Org settings → Security & privacy → Customer Lockbox shows Require approval for all data access requests checked. Users notice no change. If a Microsoft support engineer needs to access the tenant’s content to resolve a ticket, your organisation’s designated approver gets an email asking them to approve or deny that request first.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.