Disabled by Administrator: Cannot Use Application

One of the key advantages of using Box is how easily we integrate with third-party services that allow you to leverage many different tool sets on your Box content. In some cases, when you attempt to use one of these applications, you may see the error below:

"Disabled by Administrator: This application cannot be used because it is not allowed by your Box administrator. If you have any questions, please contact your administrator at [your Box Admin's email]."

Environment

Anyone using third-party applications with Box.

Resolution Steps for an End-User

If you are an end user experiencing this problem, you will need to reach out to your Box Administrator referenced in the error message.

Resolution Steps for a Box Administrator

Published Applications

1. Navigate to the Admin Console > Apps.
2. Scroll to the bottom of the page for Individual Application Controls and search for the name of the application. 
3. If the app is listed in the search results, make sure the status is set to Available. The page will auto-save and the end-user can now access the app.

Unpublished Applications

If the app is not listed in the search results, it is called an Unpublished Application, an app that is not publicly available in our App Gallery. In this case, follow the steps below:

1. In the Apps tab, locate Custom Apps tab and click the Settings button.
   
   
   
   Disable unpublished apps by default option will be enabled if you are experiencing this issue. You will need to add the app's API key to the allowlist.
   
   
   • If this is an internal application, you should ask the app developer for this value from the configuration tab of the developer console (aka client ID).
   • Otherwise, the needed value can be found on the Disabled by Administrator error message page by navigating to the URL. For example:
     • https://app.box.com/api/oauth2/authorize?response_type=code&client_id=[CLIENT_ID_of_App]&state=security_token%3DKnhMJatFipTAnM0nHlZA
   • The value you need is after "client_id=". 

1. Copy-paste the client_id (also called the API Key) into the exceptions box for Unpublished Applications.
2. Click Save. The end-user should now be able to work with the Application.

Root Cause

For security reasons, some Box admin teams prefer to limit the applications end-users can connect to Box. With the two primary options in the Third Party Applications section, Admins can mass disable apps and will need to allowlist the individual apps as the request comes up.