Customer Lockbox: Make Microsoft Support Knock Before They Open Your Data

Customer Lockbox is the Microsoft 365 setting that makes a Microsoft support engineer knock and wait before they look at your organisation’s content. Without it, Microsoft still runs its own internal approval process. You just aren’t part of it.

Most support cases never get near your data. Engineers work from telemetry, logs and diagnostic tools, and nobody needs to read Dave from accounts’ inbox to fix a mail flow rule. Now and then, though, a stubborn case needs a human to look at the content itself.

If you work in a school or college, that content might be safeguarding notes, SEN plans or a half-finished subject access request. You probably want a say in who sees it, and when.

This guide covers what Microsoft 365 Customer Lockbox is, which licences include it, how to turn it on, how the approver role works, how to review a request and how to audit what happened afterwards.

Never miss a guide: subscribe here and check out my YouTube channel.

What is Microsoft 365 Customer Lockbox?

Customer Lockbox is a Microsoft Purview feature that adds you to the approval workflow when a Microsoft engineer needs your tenant’s content during a support case. The engineer raises a request, a Microsoft Support manager approves it internally, and then it lands with your approvers.

Microsoft 365 runs on least privilege and just-in-time access, so no Microsoft staff have standing access to customer content. Lockbox doesn’t replace that model. It adds a final signature, and the signature is yours.

Each request includes the service request number, the service involved, the expected start time and how long the engineer needs. If you deny it, no access happens.

Service	What a request could touch
Exchange Online	Mailboxes, email bodies and attachments
SharePoint	Site contents and files
OneDrive	Users’ personal files
Microsoft Teams	Chats, channel messages, meeting recordings, transcripts and shared files
Windows 365	Content on Cloud PCs
Microsoft 365 Copilot	Copilot interactions, covered through the Exchange Online support

That list is worth reading twice. Teams meeting recordings and Copilot interactions hold a surprising amount of the stuff people would rather nobody else saw, including the transcript where someone forgot they were still unmuted.

How a Customer Lockbox request works

The workflow is short, and most of it happens before you hear anything.

1. A user hits a problem, for example with their mailbox, and you raise a Microsoft support request.
2. The support engineer works through telemetry and diagnostic tools first.
3. If they need to see content, they create a Customer Lockbox request with the tenant name, service request number, start time, duration and service.
4. A Microsoft Support manager approves it internally.
5. Your approvers receive an email notification.
6. An approver signs in to the Microsoft 365 admin centre and chooses Approve or Deny.
7. If approved, the engineer works within the requested window using pre-approved cmdlets, and access is revoked automatically at the end.

Timer	Value
Time to respond before a request expires	12 hours
Maximum access once approved	4 hours (the engineer can ask for less)
Typical delay before audit records appear	60 to 90 minutes for Exchange, SharePoint, OneDrive and Teams
Audit (Standard) retention	180 days

Why Customer Lockbox matters, especially in schools

For most organisations, this is about control and evidence. You can show an auditor, a governor or a data protection officer that external support access to personal data needs an explicit, logged approval.

Schools and colleges hold some of the most sensitive data in any tenant. Think safeguarding records, SEN information, medical notes, exclusions, staff HR cases and subject access request files sitting in a shared mailbox.

UK GDPR expects you to know who processes personal data and why. It won’t make you compliant on its own, but it turns “we trust our supplier” into “we approved this specific access, at this time, for this reason”.

It also helps with the awkward question in every data protection impact assessment: can the cloud provider see our data? The honest answer becomes “only if one of our named approvers says yes, and here’s the log”.

Customer Lockbox licensing and prerequisites

It isn’t in every plan. Check licensing before you spend twenty minutes hunting for a setting that isn’t there.

Plan	Customer Lockbox
Microsoft 365 E5 and Office 365 E5	Included
Microsoft 365 A5 and Office 365 A5 (education)	Included
Microsoft 365 G5 and Office 365 G5 (government)	Included
Other enterprise plans, such as E3	Available with an Information Protection and Compliance or Advanced Compliance add-on
Microsoft 365 A1 and A3	Not included

The education licence tables on Microsoft Learn list it under A5 only, so an A3 school needs an add-on or an upgrade. Licensing pages change more often than the staffroom kettle, so confirm with your licensing partner before buying anything.

What you need	Why
A qualifying licence	No licence, no setting
Global Administrator	To decide who gets the approver role
Customer Lockbox Access Approver (or Global Administrator)	To turn the feature on and approve or deny requests
Audit Reader or Audit Manager role group in Microsoft Purview	To search the audit log in the portal
View-Only Audit Logs or Audit Logs role in Exchange Online	To run Search-UnifiedAuditLog in PowerShell
At least two named approvers with MFA	So a request isn’t missed while someone is on leave

How to set up Microsoft 365 Customer Lockbox in 5 steps

Step 1: Pick your approvers

Choose at least two people who understand your data and can respond within 12 hours. In a school, that might be the network manager and a senior technician, not the head teacher who checks email twice a week.

Global Administrators can approve too, but don’t create extra Global Administrators just for this. The dedicated role exists so you don’t have to.

Step 2: Assign the Customer Lockbox Access Approver role

1. Sign in to the Microsoft 365 admin centre as a Global Administrator.
2. Go to Roles > Role assignments and select the Microsoft Entra ID tab.
3. Search for Customer Lockbox Access Approver and open the role.
4. On the Assigned tab, select Add users or Add groups.
5. Pick your approvers, then select Add.

The Customer Lockbox Access Approver role receives the email notifications, approves and denies requests, and can turn Customer Lockbox on or off. Only Global Administrators can reset the passwords of people who hold it, which is a nice touch.

If you use Microsoft Entra PIM, you can make the assignment eligible. An eligible role isn’t active until someone activates it, so I keep at least one approver permanently active to make sure the notification reaches a real person.

Step 3: Turn on Customer Lockbox

1. In the Microsoft 365 admin centre, go to Settings > Org settings.
2. Open the Security & privacy tab and select Customer Lockbox.
3. Tick Require approval for all data access requests.
4. Select Save.

That’s it. From now on, Microsoft needs your organisation’s approval before accessing content in the covered services.

Step 4: Check the Customer Lockbox Requests page

Go to Support > Customer Lockbox Requests. This is where pending and past requests live, and where your approvers will make their decisions.

There’s no button to generate a test request. Requests only appear when a Microsoft engineer raises one during a real support case, so a blank page is normal and might stay that way for years.

Step 5: Write a one-page approval runbook

The worst time to decide your approval rules is when a request arrives at 4:55pm on a Friday. Write them down now, on one page, and share it with every approver.

• Who approves, and who covers holidays and sickness.
• How to check a request matches a ticket you raised.
• What counts as proportionate for the service and duration requested.
• When to deny and ask Microsoft Support for more detail.
• Where to record the decision and the audit check afterwards.

How to review a Customer Lockbox request

When the notification arrives, don’t work from the email. Open the Microsoft 365 admin centre yourself and go to Support > Customer Lockbox Requests.

Select the request and check it against this list before you go anywhere near Approve.

Check	What good looks like
Service request number	Matches a ticket your organisation raised
Service	Matches the problem, for example Exchange for a mailbox issue
Duration	No longer than the job needs, and never more than 4 hours
Start time	Fits when you expect the engineer to work
Ticket notes	Explain why content access is needed

If anything doesn’t line up, deny it. You can contact Microsoft Support with the service request number for more detail, and the engineer can raise a fresh request.

You can also do this in Exchange Online PowerShell. Get-AccessToCustomerDataRequest lists requests, and Set-AccessToCustomerDataRequest approves, denies or cancels them.

Connect-ExchangeOnline

# List pending Lockbox requests
Get-AccessToCustomerDataRequest -ApprovalStatus Pending

# Inspect one request in detail
Get-AccessToCustomerDataRequest -RequestId EXSR123456 | Format-List

# Deny it, with a comment for the audit trail
Set-AccessToCustomerDataRequest -ApprovalDecision Deny -RequestId EXSR123456 -Comment "No matching ticket raised by IT"

Prove it worked: audit Microsoft 365 Customer Lockbox activity

Approving a request shouldn’t be the end of the story. Once the support case closes, check the audit log to see what took place.

In the Microsoft Purview portal

1. Sign in to the Microsoft Purview portal with an account in the Audit Reader or Audit Manager role group.
2. Select Solutions > Audit.
3. Set a date and time range (UTC) covering the request, and leave Activities and Users blank.
4. Select Search and wait for the job to finish.
5. Look for the Set-AccessToCustomerDataRequest activity. That’s the approve or deny decision.
6. Look for records where the user is Microsoft Operator. Those are actions the engineer performed after approval.

With Exchange Online PowerShell

PowerShell is quicker if you only want the Lockbox records. You need the ExchangeOnlineManagement module and the View-Only Audit Logs or Audit Logs role in Exchange Online.

# Install-Module ExchangeOnlineManagement -Scope CurrentUser
Connect-ExchangeOnline

$start = (Get-Date).AddDays(-30)
$end   = Get-Date

# Approve or deny decisions made by your approvers
Search-UnifiedAuditLog -StartDate $start -EndDate $end -Operations Set-AccessToCustomerDataRequest -ResultSize 5000 |
    Select-Object CreationDate, Operations, AuditData |
    Format-List

# Actions performed by Microsoft engineers after approval
Search-UnifiedAuditLog -StartDate $start -EndDate $end -UserIds "Microsoft Operator" -ResultSize 5000 |
    Select-Object CreationDate, Operations, AuditData |
    Export-Csv -Path .\CustomerLockbox-MicrosoftOperator.csv -NoTypeInformation

By default the cmdlet returns 100 records, and ResultSize tops out at 5,000. That’s plenty here, because Lockbox requests should be rare events. The AuditData column is JSON, so pipe it through ConvertFrom-Json if you want the individual fields.

Keep a copy of the export with the support ticket. Audit (Standard) records only last 180 days, and governors have a habit of asking about things from last year.

Customer Lockbox gotchas

No built-in alert. There’s no built-in option to alert you when a request is approved. If you want one, build a policy in Microsoft Defender for Cloud Apps or schedule the PowerShell above.

The 12-hour clock. A request that sits unanswered expires and the support case stalls. Half-term and the Christmas break are exactly when this bites, so make sure someone is covering.

Global Administrators get the emails too. Every Global Administrator is notified and can approve, which is another reason to keep that list short. Your break glass accounts should never be the ones clicking Approve.

Law enforcement. Lockbox doesn’t cover requests from law enforcement or other third parties. Those follow Microsoft’s separate legal processes.

It controls Microsoft staff, not yours. It does nothing about people already inside your tenant. For that, see my guide to insider threats in Office 365.

Denying has a cost. If you deny a request the engineer genuinely needs, the service issue may persist. Deny when something looks wrong, not by reflex.

Not to be confused with: Azure and Power Platform Customer Lockbox

Microsoft uses the Customer Lockbox name for three separate features. They share an idea, but the settings, approvers and timings differ.

Feature	Where you turn it on	Who approves	Request window
Microsoft 365 Customer Lockbox	Microsoft 365 admin centre	Customer Lockbox Access Approver or Global Administrator	12 hours
Customer Lockbox for Microsoft Azure	Azure portal (needs a Developer support plan or higher)	Subscription Owner, Azure Customer Lockbox Approver for Subscription, or Global Administrator for tenant requests	4 days
Power Platform and Dynamics 365	Power Platform admin centre, managed environments only	Power Platform administrators	4 days

Turning one on doesn’t switch on the others. If your school runs Azure workloads or Power Apps, check each one separately.

Should you turn on Customer Lockbox?

If you already pay for E5 or A5, yes. It costs nothing extra, takes five minutes and gives you a logged, explicit decision every time Microsoft needs to see your content.

If you’re on E3 or A3, I wouldn’t buy an add-on for Customer Lockbox alone. It makes more sense as part of a wider compliance bundle, especially if you handle safeguarding or SEN data.

Either way, name your approvers, write the runbook and check the audit log after every request. Then put the kettle on, because there’s a good chance nothing will happen for months, and that’s the whole point.

Customer Lockbox FAQs

Further reading

• Microsoft Purview Customer Lockbox (Microsoft Learn)
• Customer Lockbox Access Approver role reference (Microsoft Learn)
• Search the audit log in Microsoft Purview (Microsoft Learn)
• Search-UnifiedAuditLog cmdlet reference (Microsoft Learn)
• Customer Lockbox for Microsoft Azure (Microsoft Learn)
• Break glass account setup for Microsoft 365
• Microsoft Entra PIM for secure admin access
• Insider threats in Office 365 and how to stop them

Found this useful? Buy me a coffee, and if you handle subject access requests, have a look at Redact Ninja for redacting PDFs without sending files to a server.