Issue
Login fails on an Entra ID-joined machine.
The following message appears: “This device must be joined to an approved domain to access Box.”
The target domain is specified in the device trust setting “Device Ownership Requirements.”
Root Cause
In an Entra ID domain environment, Box Device Trust validates devices using the Entra ID tenant ID, not the traditional domain name. If the domain name is configured, the device may not be identified correctly.
Resolution
- Log in to the Box Admin Console, then go to Enterprise Settings > Device Protection > Device Trust.
- Select the policy and click Edit.
- Locate the Device Ownership Requirements item.
- Delete the current domain name and enter the tenant ID.
- Click Save.
Reference website: Enterprise Settings: Device Protection Tab