Box 2-step login verification, also known as two-factor authentication (2FA), enables you to increase your content security and better protect your enterprise's content from unauthorized external access. You can enable or disable 2-step login verification for
- All of your organization's managed users.
- All of your organization's external collaborators, or just for specific external collaborators based on their domains or their email addresses.
This topic describes how to configure 2-step login verification for your managed users and for your external collaborators.
For options on setting up specific enterprise requirements with 2-step authentication, see Enterprise Settings: Security Tab – Box Support
Configuring 2-Step Login Verification for your Managed Users
- Go to Admin Console > Enterprise Settings > Security.
- In the 2-Step Login Verification section, check Require all managed uses to have additional verification for unrecognized logins.
- At the top of the page, click Save.
Note
When you enable 2-step verification for logins, people must log in again through the Web app to set up the association with their mobile phone. If they do not first log into their account through the Web app, they can't use any mobile device to access Box.
After the initial successful login, Box will remember the browser and you will not be prompted for 2FA if you need to log in again. Only clearing the browser's cache and cookies will re-prompt 2FA.
If Single Sign On (SSO) is enabled for your account, you will not be able to enable 2-step login verification here because it is configured by your SSO provider. Go to Admin Console > Enterprise Settings > User Settings tab to access single sign-on settings.
Note
When you enable and save this setting, Box sends email notifications to all of your existing managed users, alerting them to log in and complete the setup of 2-step verification for their account
If someone loses their phone or for some other reason cannot access the confirmation codes sent to their mobile device, you can exempt this individual from the 2-Step login verification requirement. Someone who's exempted is able to log in successfully with only their Box password.
Configuring 2-Step Login Verification for External Collaborators
After you enforce 2FA, external collaborators must enroll in 2FA with Box to access your enterprise's shared content. External collaborators who are already enrolled in 2FA with Box, or who are using an SSO provider to access their Box account, can continue to access the shared content.
- Go to Admin Console > Enterprise Settings > Security.
- In the 2-Step Login Verification section, under External Users, click Configure.
- In the 2-Step Verification for External Collaborators dialog box, select whether to disable 2-step login, enable 2-step login for all external collaborators, or enable for or except for a defined set of external collaborators. If you enable 2-step login, also select when it will be enforced. For more details, see the 2-Step Verification section in Enterprise Settings: Security Settings.
- Click Save.
- At the top of the page, click Save.
The External Collaborator's Experience with 2FA for External Collaborators
It's important to know how 2FA affects external collaborators. When you enforce 2FA, external collaborators can have different experiences, as summarized in this table.
| External collaborator | Experience | To gain access to shared content |
|---|---|---|
| Is enrolled in 2FA with Box | Can access shared content if enrolled with required authentication method | N/A |
| Uses SSO to log into Box | Can access shared content | N/A |
|
|
|
|
|
|
|
Receives an invitation email to accept the collaboration invite by signing up for a new Box account
|
|
Only users that do not have 2FA or SSO enabled for their accounts will receive the email notification. Users that already have 2FA enabled or are in an SSO-enabled or SSO-required EID will not receive the email notification to set up 2FA.
The Managed User's Experience with 2FA for External Collaborators
Note
Content owners that have active collaborations with external collaborators receive an email notification about the external collaborator accepting (again) the collaboration as they enable 2FA on their account.
Under the hood, turning on 2FA for External Collaborators will flip any file or folder collaborations with an external user who do not already has 2FA set up in a "pending" state. Once they turn on 2FA on their account, it automatically accepts all collaborations again from your enterprise, which in turn sends out invitation acceptance emails to those content owners.
Further, if your enterprise turns on 2FA, then subsequently decides to disable 2FA, any collaborators who'd been moved into a pending status remain as pending and have 30 days to accept the invitation before it expires.
This can be a large number of emails depending on the number of external collaborators your users may be collaborating with and we would advise to communicate about this policy enforcement to avoid confusion and review existing collaborations prior to enforcement.