(L2) Ensure the customer lockbox feature is enabled

Contributed by Ben Miles with 2 co-contributorsAll contributors →

Part of CIS · Microsoft 365 · Organization settings · All checks

Run this check

Invoke-Maester -TestId CIS.M365.1.3.6

Overview

1.3.6 (L2) Ensure the customer lockbox feature is enabled

Customer Lockbox is a security feature that provides an additional layer of control and transparency to customer data in Microsoft 365. It offers an approval process for Microsoft support personnel to access organization data and creates an audited trail to meet compliance requirements.

This check reads CustomerLockBoxEnabled from the Exchange Online organization configuration. If no configuration is returned, the check is skipped as NotAuthorized rather than reporting that Customer Lockbox is enabled. For returned configuration, the results table shows whether the setting is enabled.

Rationale

Enabling this feature protects organizational data against data spillage and exfiltration.

Impact

Administrators will need to grant Microsoft access to the tenant environment prior to a Microsoft engineer accessing the environment for support or troubleshooting.

Remediation action

To enable the Customer Lockbox feature:

1. Navigate to Microsoft 365 admin center https://admin.microsoft.com.
2. Click to expand Settings then select Org settings.
3. Select Security & privacy tab.
4. Click Customer lockbox.
5. Check the box Require approval for all data access requests.
6. Click Save.

PowerShell

1. Connect to Exchange Online using Connect-ExchangeOnline.
2. Run the following PowerShell command:

Set-OrganizationConfig -CustomerLockBoxEnabled $true

Related links

• Microsoft 365 Admin Center
• Turn Customer Lockbox requests on or off
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 65

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.1.3.6
Severity	Medium
Suite	CIS
Product	Microsoft 365
Related products	Purview
Feature	Organization settings
Area	Access control
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1199 Trusted Relationship
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 1.3.6
Benchmark level	L2
Benchmark profiles	E5 Level 2
Supports controls	cis-m365:1.3.6
PowerShell test	Test-MtCisCustomerLockBox
Services	ExchangeOnline
Compatible licenses	LOCKBOX_ENTERPRISE

Source

• Test: tests/cis/Test.CIS.M365.1.3.6.ps1
• Documentation: tests/cis/Test.CIS.M365.1.3.6.md