Lockbox

Announcing Customer Lockbox for Microsoft 365

Customer Lockbox gives you an additional layer of control over ‘back door’ access to your company’s documents and folders. In the (very) rare event that Microsoft engineers need to view your company’s content when solving a problem, the Customer Lockbox will give you even greater control over what that engineer does when they’re inside your systems. This does, however, come at a cost.

Customer Lockbox was announced in April 2015, before being released this past December. While Microsoft have consistently maintained that they don’t snoop on your content and that the cloud is totally private, Edward Snowden’s leaks revealed that the company has in the past given the NSA back-door access to their services. Some customers were, understandably, pretty spooked by this kind of possibility – which is part of the reason Microsoft created their Office 365 Trust Center.

Web Camera

Microsoft 365 Customer Lockbox: Business Case

If you don’t have Customer Lockbox, this doesn’t mean Microsoft can read any of your content whenever they like. There are very few occasions when the firm would want to view your data, and no Microsoft employee has standing access to your data in Office 365.

At present, most engineering and maintenance in Office 365 is done remotely and impersonally. Updates and fixes are fed through to your systems automatically, and Microsoft admins should really have no reason to access your environment.

Nonetheless, there’s the odd situation that arises which calls for a Microsoft engineer to enter your environment and view content. For this to happen, you – or someone on your team – needs to contact Microsoft and ask for help.

Now, at present, the process goes like this:

  • You call or email Microsoft, explaining the problem.
  • An engineer is notified and he or she attempts to troubleshoot your problem.
  • If the engineer realizes that they’re going to have to enter your environment, they have to request access from senior Microsoft staff who will make sure this is the only possible solution.
  • The engineer then has a limited timeframe to enter your environment and solve the problem.

Access Granted

What Customer Lockbox Offers

Simply put, Customer Lockbox means that whenever Microsoft wants to access your content, they have to notify you and gain your express consent. Procedures will follow the process outlined above within Microsoft, but the engineer dealing with your specific problem will also have to email you first and make sure you’re absolutely happy for them to enter your environment.

Customer Lockbox assumes you’ll take some responsibility; once a Microsoft engineer has contacted you to ask for access, you have 12 hours to reply or else the request will be cancelled and the engineer won’t be able to work on your problem. So, no hanging around!

Frequently asked questions

Who is notified when there is a request to access a customer’s content?

Administrators in the customer’s Office 365 environment are notified via email that there is a request for access. The Office 365 Admin Center portal will also display requests that have been submitted to the customer for approval.

Who can approve or reject these requests in a customer’s organization?

Administrators in the customer’s Office 365 environment can approve or reject Customer Lockbox requests.

Under what circumstances do Microsoft engineers need access to customer’s content?

No one at Microsoft has standing access to customer content in Office 365. Furthermore, Office 365 services are being engineered so that people performing service operations never have access to customer content. Therefore, we believe that the only scenario where a Microsoft engineer will need to access customer content is when the customer asks us to do so.

What happens if a customer rejects the Microsoft engineer’s access to content?

Microsoft can only proceed following approval of a Customer Lockbox request. If a customer rejects a Customer Lockbox request, no access to customer content will occur. If a user was experiencing a service issue that required Microsoft to access customer content in order to resolve (though such circumstances are expected to be extremely rare), then the service issue might simply persist. Microsoft would inform the customer of this outcome.

What happens to a Customer Lockbox request that was not acted upon by the customer in a timely manner?

Customer Lockbox requests have a default lifetime of 12 hours, after which they expire. Expired requests do not result in access to customer content.

How do I purchase Customer Lockbox for Office 365?

Customer Lockbox for Office 365 will be available as part of a new premium Office 365 Enterprise Suite called E5.

More about Microsoft Office 365

Other Addon Features