Enterprise Settings: Security Tab

Available only if you have defined a custom URL for your enterprise, which you do in Enterprise Settings > Custom Setup > Company Profile > Custom Subdomain.

Allows people in your enterprise to create their own managed user Box accounts, as well as allowing admins to create managed user accounts. This can be a good option if you’re not concerned about your seat count. If you enable this option, you may also want to enable the Account Creation Notification option.

Determines if an email notification is sent to all Box admins and co-admins in your enterprise when a managed user account is created. When you select this option, also select the notification frequency:

• Immediately (default): To have a notification sent as soon as a managed user account is created.
• In daily summary emails: To have a notification sent once per day with a list of all managed user accounts created during the past day.

You may not want to select this option if you have not selected the Self signup option because without self signup, only admins can create managed user accounts.

Select this option to prevent users from changing the email address in their managed user account. 

Determines is an email notification is sent to the primary Box admin in your enterprise after a set number of failed login attempts over any amount of time of a managed user account.

When you select this option, select also how many failed login attempts must occur before a notification is sent. You can select any number from 3 (default) to 8.

Managed Users

Determines if 2-step verification must be used for all managed users. When you enable this option, you must also select an Authentication Method for managed users.

When you enable Require 2-step verification for all managed users, you must select a 2FA authentication method:

• Authenticator app (TOTP): The default and recommended option, requires managed users to authenticate using a one-time password generated by the TOTP algorithm in an authenticator app.
• Text message (SMS), authenticator app (TOTP), or Email: Allows managed users to authenticate by either a one-time password sent by SMS, which is less secure, or by using a one-time password generated by the TOTP algorithm in an authenticator app, or sending a code to the user's email for logging into a Box account.

External Collaborators

Determines if 2-step verification must be used for all external collaborators. When you enable this option, you must also select an Authentication Method for external collaborators.

When you enable Require 2-step verification for external collaborators, you must select a 2FA authentication method:

• Authenticator app (TOTP): The default and recommended option, requires external collaborators to authenticate using a one-time password generated by the TOTP algorithm in an authenticator app. 
• Text message (SMS), authenticator app (TOTP) or Email: Allows external collaborators to authenticate by either a one-time password sent by SMS, which is less secure, by using a one-time password generated by the TOTP algorithm in an authenticator app, or sending a code to the user's email for logging into a Box account.

You can also click Configure to configure which external collaborators require 2-step verification and when 2-step verification is required. If you do not define any additional configuration when you select 2-step verification for external collaborators, it will be required for all external collaborators and as soon as you save your settings.

Determines which external collaborators will require 2-step verification and when 2-step verification will be enforced. This dialog box has 2 sections, one where you select who 2-step verification will be enabled for and one where you select when it will be enforced.

Enable for...

Select from:

• Enable for all external collaborators: To require 2-step verification for all external collaborators.
• Enable only for select domains or users: To require 2-step verification for only external collaborators in the Domains field.
• Enable for all external collaborators except select domains or users: To require 2-step verification for all external collaborators except those entered in the Domains field.

Domains

When Enable only for select domains or users or Enable for all external collaborators except select domains or users is selected, a Domains field will appear. Enter one or more valid email addresses or domains. Press Enter after entering each email address or domain.

Enforcement...

Select from:

• Enforce immediately: To require 2-step verification for the external collaborators you define to begin as soon as you save 2-Step Login Verification settings.
• Enforce on a future date and send notification warnings to existing affected users: To require 2-step verification for the external collaborators you define to begin on the Enforcement Date you select. 

If you select Enforce on a future date and send notification warnings to existing affected users, notification email messages will be sent out to all external collaborators affected, which means:

• If Enable only for select domains or users is selected, notification email messages will be sent to any email addresses listed in the Domains field plus all email addresses from any domain in the Domains field that exist as external collaborators in your Box enterprise. 
• If Enable for all external collaborators except select domains or users is selected, notification email messages will be sent to all external collaborators except the ones whose email is specifically listed in the Domains field or who have email addresses from any domains listed.

If you select Enforce immediately, Box sends an email to external collaborators and enforces 2FA immediately. Depending on the number of external collaborators, activation of enforcement may take a few minutes. While enforcement activation is in progress, you cannot edit the configuration. If you try to edit the configuration before enforcement is active, Box displays a warning message.

If you select Enforce on a future date and send notification warnings to existing affected users, external collaborators affected by the configuration receive up to 3 notifications:

1. Within a few hours after you click Save.
2. One week before enforcing 2FA.
3. One day before enforcing 2FA.

External collaborators can enroll in 2FA before the 2FA requirement is enforced. You can edit the 2FA configuration, including the enforcement date, any time before the configured enforcement date.

If any additional external collaborators are added in your Box enterprise before the selected date and will be affected by this configuration, they will also receive a notification email message with information about the future 2-step verification requirement.

Notes

• To change the enforcement date, you must first disable 2FA.
• Edits to an existing configuration are enforced immediately.
• In the Security Logs report, Box includes a record of all configuration changes made by admins. You can generate the Security Logs report from the Reports window of the Admin Console.
• After setting 2FA configuration as Enforce on a future date, admins can subsequently either change the enforcement date or cancel altogether.
• If folders with external collaborators are deleted up to two weeks before the 2FA enforcement date, collaborators will receive 2FA notification warnings even after the folders have been deleted.

Defines the minimum number of characters required for passwords. Select from:

• 6
• 7
• 8 (default)
• 10
• 12

Determines if numbers (numerals, characters from 0 to 9) are required for passwords, and if so, the minimum number required. This counts towards the minimum number of characters required. Select from:

• 1
• 2 (default)

This option is cleared as its default value.

Determines if special characters (non alpha-numeric characters such as ! @ / $ &) are required for passwords, and if so, the minimum number required. This counts towards the minimum number of characters required. Select from:

• 1 (default)
• 2

This option is cleared as its default value.

Determines if at least one of the alphabetic characters required for passwords must be uppercase (a capital letter).

This option is cleared as its default value.

Determines whether you prevent users from choosing common words or email addresses as passwords. 

Using common words or words in the dictionary or using email addresses makes it easier for unwanted users to guess passwords and to log in to your users' accounts. Box recommends selecting this option (its default value), which will make your users' accounts more secure.

Determines if you require users to reset their passwords every selected time period. If selected, on the next login after the time period selected past a user's previous password reset, the user will be asked to reset their password before they will be allowed to log in. If enabled, select from:

• 30 days (default)
• 60 days
• 90 days

Click to require all users and admins to change their passwords immediately.

Determines if users are prevented from reusing passwords. If enabled, you can select any number from 4 (default) through 12.

Determines if all of your enterprise Box admins will receive an email when a user requests a forgotten password email.

This option is cleared as its default value.

Determines if all your enterprise Box admins will receive an email when a user changes their password in their Account Settings.

This option is cleared as its default value.

Determines if external collaborator accounts require strong passwords. With this setting enabled, passwords from external collaborators have to meet certain security criteria before the user will be able to access the content owned by your organization.

A "strong" password is not the same as the one you define in the Password Requirements section, but it does meet the following requirements:

• At least 8 characters
• Include numerals, uppercase letters or special characters

This option is cleared as its default value. Box will send an email notification to new and existing external collaborators when you enable this setting, and they need to log in and change their password to access content owned by your organization.

Determines if your managed users can access Box via unencrypted FTP. (Note that your managed users automatically can access Box via encrypted FTP, or FTPS.)

This option is cleared as its default value.

Determines the amount of time that managed users can be logged in to the Box web app with no activity, defined as any explicit user action, before being logged out automatically. The logout will occur upon the next user action after session expiration. Select from:

• Default (14 days)
• 10 minutes
• 15 minutes
• 30 minutes
• 1 hour
• 2 hours
• 8 hours
• 12 hours
• 24 hours
• 48 hours
• 14 days
• 30 days