Skip to content
MitoMito Docs

CIS.M365.1.3.6: Ensure the customer lockbox feature is enabled
ID CIS.M365.1.3.6
Severity Medium
Suite CIS Microsoft 365 Foundations Benchmark
Product Microsoft 365
Related products Purview
Feature Organization settings
Security area Access control
Resource type Tenant
User impact of fixing Low
Effort to fix Low
Benchmark CIS Microsoft 365 Foundations Benchmark 7.0.0, 1.3.6 (L2, E5 Level 2)
Framework controls cis-m365:1.3.6
MITRE ATT&CK T1199
Reads from Exchange Online
Licence needed LOCKBOX_ENTERPRISE

What this checks and how to fix it

Section titled “What this checks and how to fix it”

1.3.6 (L2) Ensure the customer lockbox feature is enabled

Customer Lockbox is a security feature that provides an additional layer of control and transparency to customer data in Microsoft 365. It offers an approval process for Microsoft support personnel to access organization data and creates an audited trail to meet compliance requirements.

Rationale

Section titled “Rationale”

Enabling this feature protects organizational data against data spillage and exfiltration.

Impact

Section titled “Impact”

Administrators will need to grant Microsoft access to the tenant environment prior to a Microsoft engineer accessing the environment for support or troubleshooting.

Remediation action

Section titled “Remediation action”

To enable the Customer Lockbox feature:

  1. Navigate to Microsoft 365 admin center https://admin.microsoft.com.
  2. Click to expand Settings then select Org settings.
  3. Select Security & privacy tab.
  4. Click Customer lockbox.
  5. Check the box Require approval for all data access requests.
  6. Click Save.
PowerShell
Section titled “PowerShell”
  1. Connect to Exchange Online using Connect-ExchangeOnline.
  2. Run the following PowerShell command:
Terminal window
Set-OrganizationConfig -CustomerLockBoxEnabled $true
Section titled “Related links”

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: NZLostboy; contributors: SamErde, Mynster9361. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.