Customer Lockbox

Customer Lockbox is a Microsoft 365 feature that requires explicit customer approval before Microsoft engineers can access tenant content data during a support case. Without Customer Lockbox, Microsoft's just-in-time access controls (Lockbox itself, in a different sense) protect content data internally but don't surface the request to the customer. With Customer Lockbox enabled, the customer admin receives a request in the Microsoft 365 admin center showing the engineer's name, the access needed, and a justification — and must approve or deny before any content access occurs. Available with Microsoft 365 E5 and as a standalone add-on. Important for regulated industries where third-party access must be audited and approved.