Box Status
Print

Configuring Two-Step Login Verification (2FA/MFA)

has_image , 2fa , Article , New , Instruction , Secure

Box 2-step login verification, also known as two-factor authentication (2FA) or multi-factor authentication (MFA), enables you to increase your content security and better protect your enterprise's content from unauthorized external access. You can enable or disable 2-step login verification for

  • All of your organization's managed users.
  • All of your organization's external collaborators, or just for specific external collaborators based on their domains or their email addresses.

This topic describes how to configure 2-step login verification for your managed users and for your external collaborators.

For options on setting up specific enterprise requirements with 2-step authentication, see Enterprise Settings: Security Tab – Box Support

Note

Making changes to your 2FA/MFA settings for managed users is considered a "critical action" in the Admin Console, and for security reasons, requires MFA also for the Admin performing the action.

Configuring 2-Step Login Verification for your Managed Users

  1. Go to Admin Console > Enterprise Settings > Security.
  2. In the 2-Step Login Verification section, check Require all managed uses to have additional verification for unrecognized logins.
  3. At the top of the page, click Save.
    When you enable and save this setting, Box sends email notifications to all of your existing managed users, alerting them to log in and complete the setup of 2-step verification for their account.
  4. Use MFA to authenticate this change:
    • If you are already enrolled in the MFA, you need to authenticate the change using your chosen MFA method.
    • If you are not enrolled in any MFA, Box will send you a verification code by email. Use this code to authenticate.
  5. When you enter the correct code, your configuration or other changes are saved. If the code is incorrect, you receive an error message.

Note
When you enable 2-step verification for logins, people must log in again through the Web app to set up the association with their mobile phone. If they do not first log into their account through the Web app, they can't use any mobile device to access Box.

After the initial successful login, Box will remember the browser and you will not be prompted for 2FA if you need to log in again. Only clearing the browser's cache and cookies will re-prompt 2FA.

 

If Single Sign On (SSO) is enabled for your account, you will not be able to enable 2-step login verification here because it is configured by your SSO provider. Go to Admin Console > Enterprise Settings > User Settings tab to access single sign-on settings. 

 

Note
When you enable and save this setting, Box sends email notifications to all of your existing managed users, alerting them to log in and complete the setup of 2-step verification for their account

 

If someone loses their phone or for some other reason cannot access the confirmation codes sent to their mobile device, you can exempt this individual from the 2-Step login verification requirement. Someone who's exempted is able to log in successfully with only their Box password.

 

Configuring 2-Step Login Verification for External Collaborators

After you enforce 2FA, external collaborators must enroll in 2FA with Box to access your enterprise's shared content. External collaborators who are already enrolled in 2FA with Box, or who are using an SSO provider to access their Box account, can continue to access the shared content.

Note

Making changes to your 2FA/MFA settings for external users is considered a "critical action" in the Admin Console, and for security reasons, requires MFA also for the Admin performing the action.

  1. Go to Admin Console > Enterprise Settings > Security.
  2. In the 2-Step Login Verification section, under External Users, click Configure.
  3. In the 2-Step Verification for External Collaborators dialog box, select whether to disable 2-step login, enable 2-step login for all external collaborators, or enable for or except for a defined set of external collaborators. If you enable 2-step login, also select when it will be enforced. For more details, see the 2-Step Verification section in Enterprise Settings: Security Settings.  
  4. Click Save. 
  5. Use MFA to authenticate this change, using the method described in Multi-Factor Authentication Required for Admin Console Critical Actions.
  6. At the top of the page, click Save.

The External Collaborator's Experience with 2FA for External Collaborators

It's important to know how 2FA affects external collaborators. When you enforce 2FA, external collaborators can have different experiences, as summarized in this table.

External collaborator Experience To gain access to shared content
Is enrolled in 2FA with Box Can access shared content if enrolled with required authentication method N/A
Uses SSO to log into Box Can access shared content N/A
  • Is not enrolled in 2FA with Box and does not use SSO
  • Previously collaborated on shared folders
  • Cannot access your enterprise's shared content
  • Can access all folders from outside of your enterprise
  • In the Box account window, set up 2FA from the pending invitations panel under ACTION REQUIRED in the All Files page, or from the Account Settings page.
  • Is not enrolled in 2FA with Box and does not use SSO
  • Is invited to a new collaboration
  • Cannot access your enterprise's newly shared content
  • Can access all folders from outside of your enterprise
  • In the Box account window, set up 2FA from the pending invitations panel under ACTION REQUIRED in the All Files page, or from the Account Settings page.
  • Does not have a Box account
  • Is invited to a new collaboration

Receives an invitation email to accept the collaboration invite by signing up for a new Box account

 

 
  1. Register for a new Box account
  2. In the Box account window, set up 2FA from the pending invitations panel under ACTION REQUIRED in the All Files page, or from the Account Settings page.

 

Only users that do not have 2FA or SSO enabled for their accounts will receive the email notification. Users that already have 2FA enabled or are in an SSO-enabled or SSO-required EID will not receive the email notification to set up 2FA.

The Managed User's Experience with 2FA for External Collaborators

Note
 Content owners that have active collaborations with external collaborators receive an email notification about the external collaborator accepting (again) the collaboration as they enable 2FA on their account.

Under the hood, turning on 2FA for External Collaborators will flip any file or folder collaborations with an external user who do not already has 2FA set up in a "pending" state. Once they turn on 2FA on their account, it automatically accepts all collaborations again from your enterprise, which in turn sends out invitation acceptance emails to those content owners.

Further, if your enterprise turns on 2FA, then subsequently decides to disable 2FA, any collaborators who'd been moved into a pending status remain as pending and have 30 days to accept the invitation before it expires.

This can be a large number of emails depending on the number of external collaborators your users may be collaborating with and we would advise to communicate about this policy enforcement to avoid confusion and review existing collaborations prior to enforcement.

Related articles