Product Guides are now only available at docs.box.com. Check out all the details on what's changed.

Box Status
Print

Shield Frequently Asked Questions

has_image , Troubleshooting , Admin , Box Shield , Reference , Article , Product Utilization

Product basics

Access and permissions

Classification labels

Automated classification

AI Classification

Smart Access

Threat Detection

Shield lists

Information barriers

Microsoft Purview (MIP) integration

Trial, sandbox, and related products

API

Troubleshooting

Product basics

 

What is Box Shield?

Box Shield is Box's advanced security offering. It is meant to reduce risk and protect information flow: prevent accidental data leaks, detect compromised accounts and insider threats, and enforce security controls on sensitive content.

Shield includes:

  • Content classification — define and manage security classification labels, including automated classification, imported third-party classification, and classification-based access controls
  • Smart Access — classification-based access policies that restrict sharing, external collaboration, downloading, and related actions
  • Threat Detection — alerts on anomalous behavior, suspicious location and session activity, ransomware indicators, and malicious content (including deep learning-based malware detection)

Day-to-day admin work lives in Admin Console > Classification (labels and classification policies) and Admin Console > Shield (dashboard, detection rules, lists, and information barriers).

 

How is Box Shield different from Box Governance and Box Compliance?

They are related but not the same product.

  • Box Shield is classification labels, automated classification, Smart Access, threat detection, and (when entitled) information barriers.
  • Box Governance is retention, legal hold, and disposition. Retention can target Shield classification labels. Modern classification-based access control lives in Shield, not in current Governance.
  • Box Compliance is KeySafe, GxP Validation, and adjacent regulatory programs such as HIPAA BAAs.

A customer can need more than one. CrowdStrike Device Protection also documents Box Shield as a prerequisite.

 

Will Box automatically push Shield updates to me?

Yes.

 

 

Access and permissions

 

Who can configure Shield?

Primary admins can configure Shield in an account with the Box Shield add-on enabled.

Co-admins need explicit Shield permissions under Admin Console > Users & Groups > Managed Users > Roles and Access Permissions:

  • View Shield lists and alerts for your company — read-only access to Shield lists and alerts
  • Create, edit, and delete Shield configuration for your company — create, edit, and delete Shield detection rules, access policies, and information barriers

Creating, modifying, or deleting AI Classification policies also requires:

  • Create and edit metadata templates for your company
  • View Shield Dashboard for your company
  • Create, edit, and delete Shield configuration for your company

Admins and co-admins with Edit User Content permissions can always modify classification labels on files and folders. If they do that in the end-user app, they still need to be a collaborator (Owner, Co-owner, Editor, or Viewer Uploader).

 

How do I grant a co-admin Shield access?

  1. Admin Console > Users & Groups > Managed Users
  2. Open the co-admin
  3. Roles and Access Permissions > Edit
  4. Under Shield, check the view and/or create/edit/delete permissions needed
  5. Save

 

 

Classification labels

 

What is a classification label?

A classification label is a security identifier admins create for content in the enterprise. Labels are used to mark sensitivity and to attach Smart Access policies. Files and folders can have only one classification label at a time. External users can see labels only in file preview (top of the page and sidebar), along with applied restrictions.

Users see the label next to the file name in preview and under Details in the sidebar, plus a classification badge in list/grid view.

 

How do I create a classification label?

  1. Admin Console > Classification
  2. Click the Classification Labels tab
  3. Click Create New
  4. Enter the required label information
  5. Click Create

Limits: name 40 characters, description 300 characters, up to 25 labels.

 

Who can change a classification on a file or folder?

External users cannot change classification labels.

Among managed users, Classification Settings > Modification Permissions can allow:

  • Owner
  • Owner and Co-owner
  • Owner, Co-owner, and Editor (default)
  • Owner, Co-owner, Editor, and Viewer Uploader

To limit changes to Admins and Co-Admins only, turn off Allow additional user roles to modify classifications. Admins and Co-Admins with Edit User Content permissions can still modify labels.

 

Can users cascade a classification to a whole folder?

Yes. A content owner or co-owner can classify a folder and cascade the label to contents. While cascade is enabled, content added to the folder inherits the classification. Overwrite can replace existing classifications on contents. Cascade is usually immediate; very large folder trees can take longer.

 

What happens if I delete a classification label?

Deletion is permanent. Box removes that classification from all files and folders that had it. The operation cannot be undone and can take a short time if the label was widely applied.

 

 

Automated classification

 

How does automated classification work?

Classification policies automatically apply a chosen label when file type or content data-type conditions match. Admins configure policies under Admin Console > Classification > Classification Policies.

Enabling a policy begins applying it to existing content immediately. Disabling or deleting a policy does not remove labels already applied.

 

When does automated classification scan a file?

Classification events in folders covered by a policy include:

  • Upload a new file
  • Preview a file
  • Update (edit) a file
  • Download a file
  • Move or copy a file
  • Invite people to a file
  • Create a shared link, or change shared-link scope
  • Mark a file version current
  • Undelete a file from trash

 

What are the automated classification limits?

Item

Limit
Policy name 80 characters
Description 255 characters
Conditions per group in File Criteria 10
Groups in File Criteria per policy 3
Classification policies per enterprise 50 (AI Classification counts toward this)
Terms per entry 50
Characters per term 100

Data-type classification extracts up to 1 MB of text. If extraction exceeds 1 MB, Box scans only the first 1 MB. Automated classification does not support OCR, so text inside images is not extracted.

 

What happens if two classification policies match the same file?

Conflict handling is set per policy (overwrite vs skip files that already have a label). Separate from that, priority order decides which policy runs when multiple policies match: smaller Priority value wins. Changing priority order does not reclassify files that already have a label.

 

How do I show users what terms or info types matched?

  1. Admin Console > Content > Metadata
  2. Open Classification Policy Matches
  3. Set status to Visible and Save

Then, in the web app, select the file and open Metadata. The Auto Classification Policy section lists match counts.

 

 

AI Classification

 

What is AI Classification?

AI Classification (Shield Pro add-on) uses Box AI to apply classification labels from admin-written guidance. It can sit next to traditional policies that look for specific data types or extensions, and cover content those rules miss.

One AI Classification policy is allowed per enterprise. It counts toward the 50-policy limit. By default it is last in priority when other auto-classification policies exist.

 

What should I know before enabling AI Classification?

  • Content is scanned prospectively after the policy is enabled (classification events going forward)
  • Do not run large-scale migrations or Shuttle while AI Classification is enabled; contact the account team if you need bulk scanning
  • LLMs are non-deterministic; the Security Classification Agent may not always return the same label
  • You cannot duplicate an AI Classification policy
  • Disabling or deleting the policy does not remove labels already applied

 

How do I create an AI Classification policy?

  1. Admin Console > Classification
  2. Create > AI Classification Policy (hidden if a policy already exists)
  3. Select a classification label and describe the content that should receive it
  4. Optionally set Label Prioritization (needs at least two labels)
  5. Optionally test up to 10 files
  6. Apply to all folders or selected folders
  7. Choose conflict handling
  8. Save as Draft or Enable

Conflict handling options:

  • Skip files that already have a classification label (recommended) — overwrites labels applied by other classification policies; skips user, cascade, workflow, and MPIP-mapped labels
  • Overwrite any existing classification label — overwrites most existing labels, except a user override on the latest version, or an MPIP-mapped label when Prevent Modification is on

Overwriting is hard to undo. Box recommends overwrite only when guidance is trusted.

 

Does AI Classification support images and OCR?

Traditional automated classification does not support OCR.

AI Classification scans listed text extensions (2 MB or 100 KB extraction limits by type) and also supports a set of image types. For images it analyzes the whole image (text and objects), not OCR-style text extraction. Images are evaluated at a maximum of 2048 x 2048 pixels, which can hide fine detail on larger originals.

 

 

Smart Access

 

What is Smart Access?

Smart Access lets admins attach access policies to classification (including unclassified content). Shield then restricts sharing, viewing, downloading and printing, Box Sign requests, and how third-party integrations download or read content.

Limits: policy name 80 characters, description 255 characters, up to 26 policies (25 for classifications plus 1 for unclassified content).

 

What is monitoring mode vs enforce?

  • Enforce restrictions — restrictions apply immediately
  • Monitor restriction violations only — no end-user restriction; violations are available through the Event API

Monitoring is documented for:

  • External Collaboration Restriction
  • Download and Print Restriction
  • Integration Restriction
  • FTP Restriction

 

What security controls can I add to a policy?

  • External collaboration restriction
  • Shared link restriction
  • Download and print restriction
  • Integration restriction
  • FTP restriction
  • Watermarking
  • Box Sign request restriction

You can add one or more controls to a policy. External collaboration restriction can allow user exceptions with admin-defined business justifications; exceptions are logged.

 

When are download and print restrictions not fully enforced?

Download and Print Restriction is not supported in Box Notes, and that restrictions are not always enforced when:

  • Box Drive or Box Mobile already downloaded the file before the control was enabled (local copies can remain accessible)
  • A new control is activated or a classification (and therefore controls) changes; users may temporarily keep previously granted access
  • A control applies broadly to all non-classified content; users with prior access might keep temporary access
  • Preview-only collaborators can save files for offline use is enabled in Admin Console mobile settings

On Box Web App, restricted users lose Download, local editing via Drive/Tools/Sync/Office, and print options (including browser print). The same restriction applies to the Box Embed widget.

 

How does Integration Restriction treat Download vs Read?

Download and Read scopes are independent. You can allow an integration to download while blocking read, or the reverse.

The Read scope governs representation fetches through the partner integrations adapter and the Representation API (including the path used by the Box MCP server and standard API integrations). It does not govern Box AI endpoints such as /2.0/ai/ask and /2.0/ai/extract.

If Box shows no integrations to choose from, the organization may have more than 100 authorized apps.

 

How does Box Sign interact with Shield policies?

When Box Sign is enabled, users can still start signature requests on files that match policies with download/print, external collaboration, or shared-link restrictions, unless the Box Sign request restriction control is added.

Box Sign checks Box Sign security and watermarking controls when a file is selected. The sender can pick any destination folder for signing. After signing completes, Shield policies apply based on auto-classification.

 

Can I report on when a user changes a classification, or is restricted by an access policy?

Changes to classification (add, edit, delete) of a file or folder is a reported event in Box. Audit events for policy enforcement is not yet available, but is on our roadmap.

 

How quickly does Smart Access begin enforcing policies?

After you configure them, Shield immediately begins enforcing your access policies.

 

Can I configure a set of these access controls as a default for all content across my instance?

Yes. When you create an access policy, for Content Type select Apply to all content without classification, then define a combination of access controls. This may be an option if you want a baseline set of restrictions, and require your users to apply a less restrictive label to a file or folder (for example, "Public") before allowing an action such as externally sharing.

 

 

Threat Detection

 

What is Threat Detection?

Threat Detection rules watch for anomalous account activity and raise Shield notifications. Configure rules at Admin Console > Shield > Detection Rules. Alerts appear on Admin Console > Shield > Dashboard.

Documented rules:

  • Anomalous Download — unusual download behavior vs the user and peers (one rule per account). End users are not notified; no user restriction is applied
  • Malicious Content — malware via reputation and/or deep scan (one rule per account)
  • Suspicious Location — access from admin-defined locations, IPs, users/groups, or domains (up to 25 rules)
  • Suspicious Session — rapid location change plus signals such as unusual user agents and new IPs (one rule per account). End users are not notified; no user restriction is applied
  • Ransomware Activity — mass encryption / suspicious extensions; can terminate managed-user sessions

Risk scores range from 1 to 100. Suspicious Location scores map from the rule's priority (LOW 20, INFO 40, MED 60, HIGH 80, CRITICAL 100).

 

How do I create a detection rule?

  1. Admin Console > Shield > Detection Rules
  2. Enable the rule type
  3. Enter a rule name (max 80 characters) and optional description (max 255)
  4. Configure rule-specific settings
  5. Optionally enable Publish alerts to Box Event Stream, Send Notifications, and Box AI Threat Analysis

Email notifications can only go to co-admins who have at least one Shield permission enabled.

 

How does Malicious Content scanning work?

The rule scans uploads from managed, external, and anonymous users. Shield applies a metadata template on files flagged as malicious. Safe scans do not generate updates.

 

Reputation Scan

Deep Scan
Method Hash compared to 30+ vendor malware libraries Static analysis: unpacks files, looks for suspicious indicators
Triggers Upload; move/copy to another Box environment; periodic re-scan based on download activity Upload, download, preview, share, copy, move; also previously unscanned files on next preview/share/download/edit; scans external files accessed by managed users
Size All file sizes Up to 200 MB
Types All file types Listed archive, executable, document, graphic, disk image, and other types

Optional settings: Deep Scan file exclusions (up to 10,000 extensions; Box still deep-scans if the real type does not match the extension), restrict downloads, and a Deep Scan severity filter (default Medium and above).

If download restriction is on, users can still preview, share, and edit online; they cannot download or open with a desktop app. On Drive for macOS/Windows, download restrictions prevent opening, moving, or copying a malicious file.

 

How should we treat malware false positives?

  • Reputation Scan false positives are uncommon; treat those verdicts as higher priority
  • Deep Scan has a higher false-positive potential; only the creator/owner can fully validate intent
  • Admins can mark a file as safe (comment required) to lift download restrictions and the red preview banner, or later revert to malicious
  • Reduce noise with Deep Scan file exclusions or a higher severity filter
  • Use Preview on the alert to open the file in Content Manager and analyze in a sandbox if needed

 

What does Restrict Target User Access do on Suspicious Location?

For managed users, if the setting is enabled and they trigger the rule:

  • They are logged out of active sessions (web, Drive, mobile)
  • They cannot log in from a restricted location
  • They receive an email telling them to contact their Box admin

Restriction lasts until they log in from a location not defined in the rule. External users can still trigger alerts but are not restricted.

Box also documents:

  • Add the user to the rule's exemption list to restore access immediately
  • If the rule monitors only content with a specific classification, Shield will not block login from a restricted country
  • Box Sign recipients in restricted locations can still complete requests opened from email; they may be restricted if Sign requires a Box login
  • Exclude at least one Shield co-admin with create/edit/delete Shield configuration so the org is not locked out

 

What does ransomware session termination do?

When Terminate Target User Sessions is enabled, Box Shield can terminate all active sessions of a managed user as soon as a Ransomware Activity alert is generated. Admins can also click Terminate Sessions on the alert (disabled 29 days after the alert was created). After termination, the user can log back in. This is a one-time action, not a continuous block. It does not apply to external users.

 

Does Shield send alerts in real-time?

Most alerts, including Malware Detection and Suspicious Location, are near real-time and triggered as soon as Box detects an anomaly or suspicious behavior. For alerts that leverage machine learning, such as Anomalous Downloads and Suspicious Sessions, notifications are sent within 24 hours

 

How long does it take for Shield's machine learning to start working?

When you enable Shield for your instance, with existing content and activity Shield takes 24 hours or less to create the machine learning model that enables Shield to generate alerts.

 

For new users, how much time does Shield need to compile the profile of a person's normal activity?

Shield needs about two weeks to compile a statistically reliable profile.

 

For the Suspicious Session rule, how do you prevent false positives, such as my VPNs?

For Suspicious Sessions, Shield not only detects the rapid change in a user's location within a short period of time, but also considers additional signals including recency of the IP address for a given enterprise, user agent strings, application types, and context about IP addresses.

 

Does syncing to Box Drive or Box Sync count as download activity for Threat Detection?

No. But downloading from Box Drive to a local machine counts as download behavior.

 

Can I adjust the threshold of deviation from normal activity that triggers alerts?

No, Shield does not enable you to adjust deviation thresholds. However, Shield's machine learning creates a dynamic and adaptive threshold that changes with time and activity.

When receiving alerts, can I define alert priorities and filter alerts?

Yes, when you define a detection rule, you can define the rule's Alert Priority Level:

  • Informational
  • Low
  • Medium
  • High
  • Critical

You can also filter in the Dashboard by priority, rule type, and time span.

 

Can I specify which user accounts to monitor?

In a future release, Box will enable you to specify the users that you want Shield to monitor in the Anomalous Download detection rule.

 

Can Shield send alerts to my mobile device?

Yes. When you configure a Threat Detection rule, just provide the email address to which you want Shield to send alert notifications.

 

 

Shield lists

 

What are Shield lists?

Reusable lists of locations, domains, integrations, host IP addresses, or email addresses. Use them as allowlists or denylists in Threat Detection and Smart Access.

List type

Used in
Locations Suspicious Location detection rules
IP addresses Suspicious Location detection rules
Domains External collaboration restriction
Email addresses External collaboration restriction
Integrations Integration restriction

Create lists at Admin Console > Shield > Lists.

Limits: 10,000 items per list; 100 lists per enterprise; 1,000,000 items across all lists; 20 lists per policy.

 

 

Information barriers

 

What is an information barrier?

An information barrier is an ethical wall: segments of users (and optionally Hubs), plus can access / cannot access relationships between segments. Restrictions are based on content owner. A user can belong to only one segment. Add users individually, not groups. Co-admins cannot add the primary admin to a segment; only the primary admin can add themselves.

Limits: one information barrier per enterprise; up to 10 segments; up to 10,000 users per segment. Relationships are one-way; set Cannot Access on both sides for a two-way wall.

Information barriers are enabled per organization. Contact Box Support. They are not available in Shield trials; test in a sandbox instead.

 

What happens when we enable an information barrier?

Statuses: Draft, Pending (new access already restricted; violating collaborations being removed), Enabled, Disabled.

Before enablement, Box requires a Collaborations report and a collaboration impact report showing collaborations that will be permanently removed.

After enablement, blocked users cannot preview, share, edit, delete, be invited, follow shared links, upload, or see names/snippets of content owned by a restricted segment. New violating collaborations, moves/copies, uploads, group adds, and Box Sign requests to conflicting segments are blocked.

 

How do information barriers affect Hubs?

Items in Hubs respect barriers. Hubs can be assigned to segments. End users cannot share a hub in violation, cannot access a hub via a public shared link, and cannot upload to a hub outside their segment. They can join hubs with no segment or a permitted segment. New hubs are added to the creator's segment if they have one.

Shared-link access to hubs is checked live. Anonymous users are exempt because they have no segment. Violating collaborations are removed.

 

Are file requests covered by information barriers?

File requests submitted by users logged in to a Box account are not included in information barrier restriction checks.

 

 

Microsoft Purview (MIP) integration

 

How does Microsoft sensitivity-label mapping work?

Microsoft Information Protection / Microsoft Purview Information Protection integration maps Microsoft sensitivity labels (including encrypted labels) to Box classification labels when files and new versions are uploaded or updated. Mapping should happen almost immediately after upload or update.

Before enabling in Box, register the Box for MIP app in Azure AD and grant the required permissions.

In Admin Console > Classification > Classification Settings:

  • Enable Integration
  • Optionally Prevent Modifications so mapped labels cannot be changed by users, folder cascade, or auto-classification
  • Optionally Set Default Mapping for unmapped Microsoft labels
  • Map each Microsoft label to a Box label
  • Save

If you disable the integration, Box does not retain mapping selections.

 

 

Trial, sandbox, and related products

 

Can we trial Shield without affecting all users?

When criteria are met, Box offers a 30-day Shield trial (POC). Trial mode lets selected users test classification-based controls in production without changing the experience for most managed users. Create new trial labels even if production already has classifications (for example [TEST CONFIDENTIAL]). Trial users can classify files or folders they own.

Box recommends applying trial labels only to previously unclassified content. If a trial user classifies a previously classified file, non-trial users will not see a classification on that file.

When the trial ends, trial classification labels and cascading rules are permanently deleted; that content becomes unclassified. Information barriers are not available in trial; use a developer sandbox to test barriers.

 

Can we test Shield in a sandbox?

Sandboxes on Business and above can reflect production add-ons, including Shield, after an admin Syncs the sandbox with production (Admin Console > Platform). Up to ten developer sandboxes per enterprise.

 

Does Box Forms work with Shield?

No. A form submission is not Box content. Public docs say submissions use different data handling from files and folders, and that Box Forms is not fully interoperable with Box Shield, Box Governance, Box Zones, or Box KeySafe. That gap can affect programs that depend on those services, including CJIS, ITAR, GxP, and FINRA Broker-Dealer requirements.

 

 

API

 

How do classifications work in the API?

Classifications use the metadata template enterprise.securityClassification-6VMVochwUWo. Applying a classification attaches an instance of that template and selects one label from Box__Security__Classification__Key.

Developer docs describe this as part of Governance and Shield. Typical operations:

  • List labels: GET /2.0/metadata_templates/enterprise/securityClassification-6VMVochwUWo/schema
  • Apply to a file: POST /2.0/files/{file_id}/metadata/enterprise/securityClassification-6VMVochwUWo
  • Update: JSON Patch PUT on the same resource, replacing /BoxSecurityClassificationKey

Smart Access monitoring violations and some Shield alerts can be consumed via the Events API / Event Stream when Publish alerts to Box Event Stream is enabled.

 

 

Troubleshooting

 

Users cannot collaborate externally on a classified file.

Expected if a Smart Access policy includes External collaboration restriction in enforce mode. Check the file's classification, the policy's domain/user lists, whether monitoring vs enforce is set, and whether business-justification exceptions are allowed. Confirm the user is not hitting an information barrier instead.

 

Users still have a local copy after we enabled download restriction.

Expected for Drive and Mobile files downloaded before the control. Recreate the restriction expectation: disable local copies, re-download after the policy, or have users delete cached files. Also check the preview-only offline-save mobile setting.

 

A user was locked out after a Suspicious Location alert.

If Restrict Target User Access is on, they stay blocked until they log in from an allowed location. Add them to the rule's user exemption list for immediate restore. Confirm a Shield co-admin is excluded so admins are not all locked out. External users should not be session-blocked by this setting.

 

Auto-classification did not label a scanned PDF or image.

Traditional automated classification does not use OCR. Use AI Classification (Shield Pro) for supported image types, or classify manually / via cascade. For text files, confirm the extension is in the supported list and that matching text is in the first 1 MB (or AI extraction limit).

 

We enabled a classification policy and old files did not change labels after we reordered priority.

Expected. After a new priority order takes effect, Box does not reclassify files that already have a label. Re-trigger a classification event (for example preview) only helps if conflict handling and remaining policies still apply.

 

A co-admin cannot see Shield or cannot save policies.

Confirm the enterprise has the Shield add-on. Confirm the co-admin has Create, edit, and delete Shield configuration for your company (and metadata + View Shield Dashboard for AI Classification). Confirm they are not on a Business plan that lacks granular co-admin permissions.

 

 

Related articles