Back to Checks
m365

Customer Lockbox is enabled at the organization level

admincenter_organization_customer_lockbox_enabled
Service: admincenterSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesse5
Resource Type:NotDefined

Microsoft 365 organization setting indicates whether Customer Lockbox is enabled to require explicit approval for Microsoft support access to customer content

Prowler logoProwlerprowler-provider-m365

Risk

Without Customer Lockbox, Microsoft engineers may access tenant content during support without your approval, undermining confidentiality and accountability. This increases risks of targeted data exposure, insider misuse, and weakens auditability of access during troubleshooting.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks admincenter_organization_customer_lockbox_enabled

Recommendation

Enable Customer Lockbox to enforce tenant approval for data access (Require approval for all data access requests).

  • Limit approvers per least privilege
  • Establish an on-call review workflow
  • Audit requests and engineer actions
  • Layer with defense in depth (MFA, RBAC, logging) to strengthen control

Remediation

CLI

Set-OrganizationConfig -CustomerLockboxEnabled $true

Other

1Go to https://admin.microsoft.com and sign in
2Navigate to Settings > Org settings
3Select Security & privacy
4Click Customer Lockbox
5Check "Require approval for all data access requests"
6Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.admincenter.admincenter_client import (
    admincenter_client,
)


class admincenter_organization_customer_lockbox_enabled(Check):
    """
    Ensure the customer lockbox feature is enabled.

    Customer Lockbox ensures that Microsoft support engineers cannot access content
    in your tenant to perform a service operation without explicit approval. This feature
    provides an additional layer of control and transparency over data access requests.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """
        Execute the check for the Customer Lockbox feature in Microsoft 365.

        This method checks if the Customer Lockbox feature is enabled in the organization configuration.

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []
        organization_config = admincenter_client.organization_config
        if organization_config:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=organization_config,
                resource_name=organization_config.name,
                resource_id=organization_config.guid,
            )
            report.status = "FAIL"
            report.status_extended = (
                "Customer Lockbox is not enabled at organization level."
            )

            if organization_config.customer_lockbox_enabled:
                report.status = "PASS"
                report.status_extended = (
                    "Customer Lockbox is enabled at organization level."
                )

            findings.append(report)

        return findings

References