Multi-Factor Authentication Set Up for Your Account

Multi-factor authentication (MFA) is a security mechanism where users must provide two or more pieces of evidence, or factors, before being allowed access to a product or service, such as Box. Most common is 2-factor authentication (2FA), where users are required to authenticate from 2 of:

If your organization does not require single sign-on (SSO) for authentication, Box enables users to set up 2-factor authentication for their accounts. The first factor is a password. The second factor is a one-time password (OTP), which is the possession factor. You can choose authenticator apps, SMS, security key, or email for the second factor.

• SMS is short message service, the text messaging you use on your phone, and receives one-time passwords created from a secure random generator.

• A security key is a physical device used as the possession factor in multi‑factor authentication. Security keys compatible with Box must support the FIDO2/WebAuth standard. To authenticate, you insert the key into a USB port or tap it using NFC, then press the key’s button. Security keys work offline and help prevent phishing by validating the website you’re logging in to. Supported security keys include (but are not limited to):  

  • Yubikey/Yubico
  • Google Titan
  • Feitian
  • Nitrokey

  • For troubleshooting tips, see Security Key MFA Troubleshooting

    Note: FIDO2/WebAuth passkey authentication is supported in an MFA flow in the Box mobile application. However, passkey authentication in a single sign-on (SSO) flow is not currently supported in the Box mobile application.

• Authenticator apps use algorithms to generate one-time passwords, which are are unique random passwords generated on demand by authenticator applications. These one-time passwords expire after a defined period of time, often a number of seconds or minutes. Box 2FA supports authenticator apps that are compliant with the TOTP (time-based one-time password) algorithm, which is defined by the Internet Engineering Task Force specification, IETF-6238. Applications that follow this specification include Google Authenticator, Microsoft Authenticator, Authy, Duo, and LastPass, however, your administrator may require that you use a specific TOTP-compliant authenticator app.
• Email, similar to OTP authentication, sends a code to the user's selected email to access their Box account. This method ties login access to a user's email, preventing access from former users. 

Enabling Multi-factor Authentication

You can enable only one of authenticator app, security key, email, or SMS for 2-factor authentication, and only if your organization does not require single sign-on (SSO) for authentication. If it does, the 2-Step Verification section is not visible in your account settings.

To enable security key multi-factor authentication for your individual account: 

1. Go to Account Settings > Account.
2. In the 2-Step Verification section, click Set Up. (Note: You will not see this section if your organization requires single sign-on (SSO) for authentication.)
3. Select Security Key and click Next.
4. Follow the instructions to insert the security key and touch or enable NFC, then click Submit.
5. Copy the backup codes. Once copied, paste them into a file only you have access to and save the file somewhere secure. 
6. Click Complete.

To enable authentication app multi-factor authentication for your individual account:

1. Go to Account Settings > Account.
2. In the 2-Step Verification section, click Set Up. (Note: You will not see this section if your organization requires single sign-on (SSO) for authentication.)
3. Select Authentication App and click Next.
4. Open the authentication app on your phone and scan the QR code. (You can also enter the secret key located under the QR code into the authenticator app manually.)
5. Enter the code you received in the authenticator app and click Submit.
6. Enter a phone number for verification, which would be used by Box support to verify your identity in the case where you are not able to authenticate in the app, and click Submit.
7. Copy the backup codes. Once copied, paste them into a file only you have access to and save the file somewhere secure. 
8. Click Complete.

To enable email multi-factor authentication for your individual account:

1. Go to Account Settings > Account. 
2. In the 2-Step Verification section, click Set Up.
3. Click Set Up.
4. Select Email and click Next.
   • The following window confirms you’ll use email MFA to sign in. Click Submit to continue.
5. Select the email you’d like to use for the Box login.
6. Enter the code sent to the email you selected for MFA.

After setting up MFA with your email, you're notified that email MFA is required the next time you login.

To enable SMS multi-factor authentication for your individual account:

1. Go to Account Settings > Account.
2. In the 2-Step Verification section, click Set Up.
3. Select SMS Text Message and click Next.
4. Enter your phone number and click Continue. Some countries do not support 2FA via SMS.
5. Enter the code you received as a text message and click Submit.
6. Copy the backup codes. Once copied, paste them into a file only you have access to and save the file somewhere secure.
7. Click Complete.

Removing Multi-factor Authentication

To remove a multi-factor authentication method from your individual account:

1. Click on your account icon in the top-right corner of the page, and select Account Settings.
2. Under the Account tab, scroll to the Authentication section.
3. Click Remove next to the authentication method you want to remove, then click Remove in the confirmation dialog box.

If you're locked out of your account

If you find yourself locked out of your account due to a changed phone number, lost security key, or for some other reason cannot access the confirmation codes sent to your mobile device, please contact your primary admin, who can disable 2FA on yourƒ account. Business Plus and Enterprise admins can use the instant login feature in the Admin Console to disable 2FA in a user's Account Settings.

If you are having issues with your existing security key enrollment, make sure that: 

• You are using the same security key that you originally enrolled with
• Your security key meets the FIDO2/WebAuth standard
• Your security key meets the browser and operating system requirements: 

N/A signifies that the operating system doesn’t support the web browser. 

If you are in a Personal, Starter or Business account, please reach out to Box Product Support for assistance.