# (L2) Ensure the customer lockbox feature is enabled

(L2) Ensure the customer lockbox feature is enabled. A Maester check for Microsoft 365, Organization settings.

Source: https://maester.dev/docs/tests/CIS.M365.1.3.6

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/nzlostboy" title="Ben Miles · Original author"><img src="https://github.com/NZLostboy.png" alt="Ben Miles" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/samerde" title="Sam Erde · Co-contributor"><img src="https://github.com/SamErde.png" alt="Sam Erde" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/mynster9361" title="-Mynster · Co-contributor"><img src="https://github.com/Mynster9361.png" alt="-Mynster" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/nzlostboy">Ben Miles</a> with 2 co-contributors</span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Microsoft 365 · Organization settings · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.1.3.6
```

## Overview

1.3.6 (L2) Ensure the customer lockbox feature is enabled

Customer Lockbox is a security feature that provides an additional layer of control and transparency to customer data in Microsoft 365. It offers an approval process for Microsoft support personnel to access organization data and creates an audited trail to meet compliance requirements.

This check reads `CustomerLockBoxEnabled` from the Exchange Online organization configuration. If no configuration is returned, the check is skipped as `NotAuthorized` rather than reporting that Customer Lockbox is enabled. For returned configuration, the results table shows whether the setting is enabled.

#### Rationale

Enabling this feature protects organizational data against data spillage and exfiltration.

#### Impact

Administrators will need to grant Microsoft access to the tenant environment prior to a Microsoft engineer accessing the environment for support or troubleshooting.

#### Remediation action

To enable the Customer Lockbox feature:

1. Navigate to Microsoft 365 admin center [https://admin.microsoft.com](https://admin.microsoft.com).
2. Click to expand **Settings** then select **Org settings**.
3. Select **Security & privacy** tab.
4. Click **Customer lockbox**.
5. Check the box **Require approval for all data access requests**.
6. Click **Save**.

##### PowerShell

1. Connect to Exchange Online using `Connect-ExchangeOnline`.
2. Run the following PowerShell command:

```powershell
Set-OrganizationConfig -CustomerLockBoxEnabled $true
```

#### Related links

* [Microsoft 365 Admin Center](https://admin.microsoft.com)
* [Turn Customer Lockbox requests on or off](https://learn.microsoft.com/purview/customer-lockbox-requests#turn-customer-lockbox-requests-on-or-off)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 65](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.1.3.6 |
| Severity | Medium |
| Suite | CIS |
| Product | Microsoft 365 |
| Related products | Purview |
| Feature | Organization settings |
| Area | Access control |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1199 Trusted Relationship |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 1.3.6 |
| Benchmark level | L2 |
| Benchmark profiles | E5 Level 2 |
| Supports controls | cis-m365:1.3.6 |
| PowerShell test | [Test-MtCisCustomerLockBox](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.1.3.6.ps1) |
| Services | ExchangeOnline |
| Compatible licenses | LOCKBOX_ENTERPRISE |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.1.3.6.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.1.3.6.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.1.3.6.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.1.3.6.md)