Print

Deploying Box for Teams in your Enterprise

  • Posted Updated

With the Box for Microsoft Teams integration, your organization can use the content stored in Box through the familiar interface of Microsoft Teams.  People can share and access content stored in Box directly from within Microsoft Teams – without flipping back and forth between programs.  This streamlines administration, saves workers time, and facilitates team collaboration. 

The Box for Teams integration enables automatic creation of a Box folder for each Team and Channel.  All content shared via Teams resides in this Box folder.  In addition, content permissions are mapped between Box and Teams automatically.  This means people cannot access shared content unless they have permission to do so AND belong to the Channel in which it was shared.

 

Note

Team owners can also opt to select an existing folder, or create a new one, to use as the default Channel folder, instead of the one Box creates automatically.

 

You can enable Box for Teams for your entire organization via your Box Admin Console.  Also, when you install this integration, Box provides you with several security settings that control how Box for Teams behaves, and that significantly reduce the amount of manual work required to get started. 

Broadly, there are 4 procedures to follow when you deploy the Box for Teams integration in your enterprise:

  1. Give API Consent for Box and Microsoft to share data
  2. Configure Microsoft 365 Permissions
  3. Authorize Microsoft in the Box Admin Console
  4. Add the Box application to your Teams

You must complete all 4 procedures.

Below we provide context for each procedure, and then break each down into its individual steps.

 

Before you begin:

Copy this Microsoft Teams Application ID and store it wherever it is convenient.  You will need this ID in Step 3:  

nqq9pg38gpjntlvce1toixicuc91sxyw

 

Step One: Give API Consent for Box and Microsoft to share data

  • What this is:  For Microsoft to give consent to Box to call the Microsoft Graph API.
  • Who must do this:  Microsoft Azure Administrator.
  • What this does:  Enables Box to receive and send API calls to Microsoft.  It enables features such as automatic folder creation and permission mapping.

To do this:

  1. Log in to your Azure portal as an administrator.
  2. Grant Box permissions to your Microsoft Tenant.  To do this by navigating to microsoft.com and clicking Accept.
Permission Description

Read all users' full profile

(User.Read.all)

Allows the app to read user profiles without a signed in user.

Used to associate the user's Microsoft ID with Box ID

List of Users in a Channel and collaborate them to a Channel Folder

Read all groups

(Group.Read.All)

Allows the app to read group properties and memberships, and read the calendar and conversations for all groups, without a signed-in user.

App install in Box Admin Console - when you input your Tenant ID in the Box Admin console, we run specific scripting in the background to link the MSFT Tenant ID with the Box EID.

Detect when a new Team is created and read Team Name and ID to create Service Account folder in Box and map the folder to that Team and subsequent channels

Read all group memberships

(GroupMember.Read.All)

 Allows the app to read memberships and basic group properties for all groups without a signed-in user.

Create tabs in Microsoft Teams

(TeamsTab.Create)

 Detect when a new Channel/Chat is created and auto generate the Box Files Tab, without a signed-in user. This does not grant the ability to read, modify or delete tabs after they are created, or give access to the content inside the tabs.

Read tabs in Microsoft Teams.

(TeamsTab.Read.All)

 Ability to detect if a Box Files tab already exists in a Teams Channel/Chat by reading the names and settings of tabs inside any team/chat in Microsoft Teams, without a signed-in user. This does not give access to the content inside the tabs.

Read and write tabs in Microsoft Teams.

(TeamsTab.ReadWrite.All)

Read and write tabs in any team in Microsoft Teams, without a signed-in user. This does not give access to the content inside the tabs.

Used to autogenerate Box Files tab upon installation of the Box for Teams app to a Team/Chat

Used to autogenerate Box Files tab when user creates a new Channel within a Team that has the Box integration installed

Get a list of all teams

(Team.ReadBasic.All)

Provides a list of all teams, without a signed-in user.

Ability for Box to detect when a new Team is created and initiate auto-installation of Box for Teams for that Team

This will remove the burden for users to manually install Box for Teams to their Team

Read the names and descriptions of all channels

(Channel.ReadBasic.All)

Read all channel names and channel descriptions, without a signed-in user (no access to messaging).

Ability for Box to detect when a new Channel within a Team is created and initiate auto-installation of Box for Teams for that Channel

This will remove the burden for users to manually install Box for Teams to their Team

Read names and members of all chat threads

(Chat.ReadBasic.All)

Read names and members of all one-to-one and group chats in Microsoft Teams, without a signed-in user (No access to messaging)

Ability for Box to detect when a new Chat is created and initiate auto-installation of Box for Teams for that Chat

Ability for Box to detect if Box is already installed to a Chat, and if yes, no further action required by Box

This will remove the burden for users to manually install Box for Teams when initiating ad hoc chat conversations (e.g., 1:1 Chats, Group chats)

Manage Teams apps for all chats

(TeamsAppInstallation.ReadWriteForChat.All)

Allows the app to read, install, upgrade, and uninstall Teams apps in any chat, without a signed-in user. Does not give the ability to read application-specific settings.

Permission gives ability to read/write and delete Box apps at chat level

Manage Teams apps for all teams

(TeamsAppInstallation.ReadWriteForTeam.All)

Allows the app to read, install, upgrade, and uninstall Teams apps in any team, without a signed-in user. Does not give the ability to read application-specific settings.

Permission gives ability to read/write and delete apps in a specified Team.

Sign in and read user profile

(User.Read)

Allows users to sign-in to the app, and allows the app to read the profile of signed-in users. It also allows the app to read basic company information of signed-in users.

Used to associate the user's Microsoft ID with Box ID

List of Users in a Channel and collaborate them to a Channel Folder

 

Step Two: Configure Microsoft 365 Permissions

  • What this is:  Sets up permissions to allow Teams users to install 3rd-party applications. (You may have to add Box for Teams to your allow list.)
  • Who must do this:  Microsoft 365 Administrator.
  • What this does:  Gives people access to Box for Teams as an option.

To do this:

  1. Log in to the Microsoft Admin Portal.
  2. Navigate to the Microsoft Teams Admin Center.  To do this, from the lefthand navigation pane, go to Admin Centers > Teams.  (You may also need to click Show All.)

Box_for_Teams-MSAdminCenter.png

  1. From the Teams Admin Center lefthand navigation, go to Teams apps > Permission Policies.

Box_for_Teams-AppPermissionPolicies.png

  1. Click Org-wide app settings to display the Org-wide app settings pane. 
  2. In the Third party apps section, verify that Allow third party or custom apps is on.  Then click Save.
    • If this setting is off, click to move the slider to the right. 

Box_for_Teams-AppSettings.png

Step Three: Authorize Microsoft in the Box Admin Console

  • What this is:  Authorizes your Microsoft Tenant with Box.
  • Who must do this:  Box Administrator.
  • What this does:  Enables communication between your specific Microsoft Teams Tenant and Box; allows for automatic folder creation and user permission mapping. 

To do this:

  1. Ensure you have completed the first two sets of procedures.  You will also need to revisit the Microsoft Teams Application ID you stored before you began.
  2. From the Box Admin Console, click Apps.  When the Apps screen displays, click the Custom Apps tab. 
  3. In the Custom Apps screen, click Authorize New App.  The App Authorization window displays.
  4. In the Client ID box, paste in the Microsoft Teams Application ID you stored earlier.  
    •  For reference, here it is, again:  nqq9pg38gpjntlvce1toixicuc91sxyw
  5. Click Next.  Then click Authorize.  The Custom Apps screen redisplays.  Box for Microsoft Teams now displays in the list of apps.
  6. From your Admin Console, in the lefthand navigation, click Apps.  When the Box Apps screen displays, scroll down to Individual Application Controls, clear the search filter and then search for Microsoft Teams.

Box_for_Teams-AppsAndIntegrations.png

Note

The search filter displays immediately to the right of the search box.  If the filter displays filter applied, click Clear Filters.

  1. Verify the Teams status is Available. If it’s disabled, under the Status column, click the corresponding down arrow and then click Available.
  2. Hover over the Teams row to display the Configure button.  Then click Configure.  The Configure Box for Microsoft Teams window opens.

BoxForTeams-AppControlConfigureBoxForTeams.png

BoxForTeams-ConfigureBoxForTeamsWindow.png

  1. In the Microsoft 365 Tenant ID box, paste your unique Microsoft 365 Tenant ID.  To retrieve this ID:
    1. Log in to the Microsoft Azure portal as a Global or User Management Admin.
    2. Navigate to Azure Active Directory.
    3. In the lefthand navigation, click Manage.  Then click Properties. 
      • The Microsoft Tenant ID displays in the Directory ID box.
      • Verify you have completed Step Two, above.  If you have not yet done so, Box cannot process your Tenant ID. 
  1. Decide whether you want Teams to display a thumbnail image of the file being shared.  
    • If you want thumbnail images to display, to the right of Enable Document Thumbnails, click the slider to move it to the right.
    • If you preserve the default setting of Off, Teams displays generic file type icons instead of thumbnail images
  2. Decide whether to permit all channel members to view file information.
    • When someone shares a file or folder in a Channel or direct message, members view either a content card displaying information about the shared file, or a generic link icon.  Whether they view a content card or a generic icon depends on this configuration.  To display information about the file only to channel or message members who ALSO have permission to view the actual content, next to Enable permission check before showing file/folder name and file type, click the slider to move it to the right.  In other words, you can view the content card information only if:
      • you are logged into Box
      • you have access to the file
      • the Box permission check is on
    • Channel/message members who do not have permission to access the file see only a generic link icon.
    • If you preserve the default setting of Off, everyone in the Channel can view the full content card. However, they still cannot access the content, itself, unless they have permission in Box to do so.
  1. Configure the Box for Teams admin and security settings.  See Step 4, below.
  2. Click Save.

 

Step Four: Add the Box Application to your Teams

  • What this is:  Deploys the Box for Teams integration to a Team and associated channels.  People can now add the Box application to their Teams and begin using it.
  • Who must do this:  Team owner in Microsoft Teams.
  • What this does:  Allows all channels and users within the Team to access the Box for Teams integration functionality.

To do this:

  1. From your Teams application, in the lefthand navigation click Apps.
  2. Search for Box.
  3. Click either:
    • Add to a Team
    • Add to a Chat
  4. Locate the Team or Chat to which you want to add the app.  Then click Set up.
  5. When the app is installed, Team members have access to the Box integration.

 

Important -- To Avoid Confusion

When Box displays in your Apps search, do not click Open.  Instead, click the adjacent down arrow and then click add Box to a Team.  When Box is added to a Team, it begins working automatically for Team chats.  

 

Note

People can pin the app to the app bar for easier access. (Instructions for pinning the app are in Using the Box for Teams integration.)  When one member of a Channel does this, the Box Files tab becomes available for all Channel members.  However, you cannot add the Box Files tab to a chat.

 

 

What do people in your organization see?

If you have fully installed the Box for Teams integration, individuals in your organization receive the following:

          • a welcome message explaining basic functionality.
          • a Box icon in their message extension tray for uploading / sharing of files.
          • a Box Files tab for access to all content associated with the specific Team Channel to which it belongs.

BoxForTeams-WelcomeMessage.png

If you have not fully installed the integration directly to your Teams and Channel, then people must click the ellipsis (…) to view the application tray icons, and then click Box.

BoxForTeams-ApplicationTrayWindow.png

Then, when they click Box, Box prompts them to sign in.

BoxForTeams-InstallTeamFolder.png

 

Important

After you enable Box for Teams for your organization, it actually installs on a team-by-team basis.  You only need one member of a team to install the integration – it can be any team member – at which point the integration becomes available for every member of that team.

 

Related Links

Introducing Box for Microsoft Teams

Comparing the First and Second Versions of Box for Teams

Using Box for Teams

Assigning a Default Box Folder to a Teams Channel

Logging in to Box for Teams for the First Time

Understanding how Content and Thumbnail Permissions Control Display

Box for Teams FAQ

Box for Microsoft Teams - Earlier Version

 

 

tech_writers_swarm_kb

Related articles