What Is Customer Lockbox In Office 365?

“Customer Lockbox” –This terminology was something new to me until I heard it at Microsoft Tech Summit this year. There was a session which I was attending on Office 365 and the speaker was talking about this feature. Sadly, only a few folks in the room were aware of it and I was one among those who hadn’t heard that term before.

Anyway, now that I’m aware of it, I decided to write an article on it so that my readers will get to understand about this cool feature in Office 365 and they can start using it in their Office 365 tenants.

So what is Customer Lockbox?

Roughly around couple of years back Microsoft had come up with this feature to maximize data security and privacy for Office 365 customers by ensuring that there’s zero interaction with the customer’s content by Microsoft engineers.

Almost all the service operations performed by Microsoft are either fully automated so there is no human interaction, or the human involvement is abstracted away from the customer’s content that’s stored in Office 365.

Only during some circumstances where something is broken in your tenant and you raise a support case for that, Microsoft engineers access your content to fix it. So with this feature, Microsoft enforces access control through multiple levels of approval, providing just-in-time access with limited and time-bound authorization. In addition to that, all access control activities performed by the Microsoft engineer does gets logged and audited.

The below mentioned image depicts the complete approval process

So with this feature, Microsoft has given their assurance to its customers that their content will not be accessed by Microsoft employees without their explicit approval. It brings customers into the access approval process, requiring the customer to provide explicit approval of access to their content by a Microsoft employee for service operations.

Now that we have understood about this feature, let's take a look on how this complete process works ….

Let’s consider a scenario wherein something is broken in SharePoint Online or Exchange Online and you raised a support case for that. The engineer, upon reviewing your request, feels that he/she might need access to your Exchange/SharePoint Online content to fix it .So this is how the process flows when you have Customer Lockbox turned on in your tenant.