Product Guides are now only available at docs.box.com. Check out all the details on what's changed.

Box Status
Print

Troubleshooting Box for EMM “Error: invalid_client”

Troubleshooting

Overview of Problem

When SSO login is attempted using Microsoft Entra ID on Box for EMM, the error message “Application Error. Error: invalid_client” appears, and login fails.

This can occur for more than one reason. Check the scenarios below.

1.png

Scenario 1: Entra ID UPN is not registered on the Box account

Occurrence Conditions

  • In the Admin Console > Enterprise Settings > Mobile tab, the option Intune Mobile Application Management (Intune MAM) is enabled.
  • SSO is configured with a Microsoft Entra ID.
  • Box for EMM version 5.34 or later is in use.
  • The primary or secondary email address for the Box account does not contain the Microsoft Entra ID user principal name (UPN).

Root Cause

With the enhanced support for Microsoft Entra ID conditional access (You can get the details of the release here) , the login flow for mobile apps in the MAM environment has been strengthened.

Therefore, if the above conditions apply, the Microsoft Entra ID UPN must be registered as either the primary or secondary email address of the Box account.

Process for Resolution

Add the Microsoft Entra ID UPN to the Box account as a secondary email address.

When SSO Required is Disabled

You can add a secondary email address from the user’s account settings. For more information, see https://support.box.com/hc/en-us/articles/360044196513-Manage-Account-Settings#h_01GKJF7FP5E54W06XSHYK5MG28.

When SSO Required is Enabled and Cannot be Disabled

You can add a secondary email address by using the Box API.

The following is an example command using the Box CLI.

Preparation

  • Check the managed domain

    From Admin Console > Enterprise Settings > Custom Settings tab > Domain Management, check whether the Microsoft Entra ID UPN domain is registered as a managed domain.

  • Set up the Box CLI

    For more information, see https://developer.box.com/guides/cli/cli-docs/jwt-cli/.

    Make sure that the app access level is set to App + Enterprise.

    Make sure that the scope includes Manage users.

  • Prepare the user’s User ID and additional email address

Instructions

  1. Verify you have completed the above preparation process.
  2. When the relevant email address domain is not registered as a managed domain and user email verification is not required, add the domain and complete the verification process.

  3. Run the command below. Replace <User ID> with the user’s User ID, and <UPN email address> with the secondary email address to be added.

    box users:email-aliases:add <User ID> <UPN email address> --confirm

    When using the “--confirm” option, the domain of the secondary email address to be added must be registered as a managed domain for the Box tenant.

    If the domain is not registered as a managed domain, do not use the “--confirm” option; instead, the user must verify the address through a confirmation email.

  4. Finally, verify that the secondary email address has been added to the user.

Temporary Workaround (Not recommended depending on the environment)

By disabling the option Enterprise Settings > Mobile > Intune Mobile Application Management (Intune MAM) in the Box Admin Console, you can use the conventional login flow.

However, this may disable app-based conditional access security features.

 

Scenario 2: Entra ID tenant mismatch

Occurrence Conditions

  • In the Admin Console > Enterprise Settings > Mobile tab, the option Intune Mobile Application Management (Intune MAM) is enabled.
  • SSO is configured with Microsoft Entra ID.
  • One or more of the following apply:
    • The enterprise uses more than one identity provider (IdP) for a single Box enterprise; and/or
    • The enterprise uses a custom SSO discovery / landing page during browser SSO; and/or
    • Affected users sign in with a Microsoft account that belongs to an external Microsoft Entra ID (for example, a guest or external user).
  • Box for EMM version 5.34 or later is in use.

Root Cause

When Intune MAM is enabled, Box for EMM validates the Microsoft Entra ID token during login. As part of this validation, Box checks that the token’s issuer (iss) matches the Entra tenant associated with the enterprise’s SSO configuration on the Box side.

That expected Entra tenant is determined from the enterprise SSO configuration managed by Box (customers cannot view or change this value in the Admin Console).

Issuer validation fails — and Box for EMM login can fail with Error: invalid_client — when the Entra tenant that issued the user’s token does not match the Entra tenant expected by Box. Common examples include:

  • The enterprise uses multiple IdPs for a single Box enterprise, or a custom SSO discovery / landing page, so users may authenticate against a different Entra tenant than the one associated with the Box-side SSO configuration.
  • A user signs in with a Microsoft account from an external Microsoft Entra ID (for example, a guest or external user). That account’s tenant ID (iss) does not match the expected Entra ID for the Box enterprise, so login is blocked.

Note: With Intune MAM enabled, Box for EMM currently expects a single Entra tenant for this login path. The Box enterprise and the Microsoft Entra ID used for Box for EMM login must be aligned 1:1. Multi-IdP or discovery-page setups are not supported for this login path at this time.

Process for Resolution

With Intune MAM enabled, Box for EMM currently requires a 1:1 relationship between the Box enterprise and the Microsoft Entra ID used for login. The Entra tenant that issues the user’s token must match the Entra ID associated with the Box enterprise SSO configuration.

  • Use a single Microsoft Entra ID for Box for EMM / Intune MAM login. Do not rely on a multi-IdP discovery / landing page for this path and instead use a 1:1 Box-to-Entra ID configuration.
  • Ensure affected users sign in with accounts that belong to that same Entra tenant — not an external or guest Microsoft Entra ID whose tenant differs from the expected one.

Temporary Workaround (Not recommended depending on the environment)

If you cannot move to a 1:1 Box-to-Entra ID configuration, see "Temporary Workaround (Not recommended depending on the environment)" under Scenario 1.

 

When the Above Method Does not Resolve the Issue

Contact Box Support with the following information:

Related articles