Action Required
We're introducing a security enhancement to the Box for Salesforce integration designed to strengthen user authentication and help protect your organization from unauthorized authentication requests. As part of this enhancement, we're introducing additional validation of the Salesforce URLs that can be used with your Box for Salesforce integration.
What you need to do
To continue using the Box for Salesforce integration without disruption after the enforcement date, a Box Admin must add the Salesforce URL(s) used by your organization to the Allowed Salesforce URLs configuration in the Box Admin Console:
Box Admin Console → Box for Salesforce → Configuration → Restrict OAuth redirects to specific Salesforce web addresses
Who can make the change?
A Box admin, or a co-admin whose permissions include managing integrations. It is a Box-side configuration change — nothing needs to be changed in Salesforce.
Which URLs should be added?
Add every Salesforce URL your users authenticate from when using Box for Salesforce. This typically includes your production org and any sandbox or developer orgs where the integration is used.
To find example of the correct URL, open the Salesforce page where you use Box for Salesforce components and copy the domain from your browser’s address bar. Alternatively, you can find your Salesforce My Domain under Salesforce → Setup → Settings → Company Settings → My Domain.
Add a separate entry for each org you use. A few examples:
- Production:
https://acme.my.salesforce.com;https://acme.lightning.force.com - Sandbox (e.g., UAT):
https://acme--uat.sandbox.my.salesforce.com;https://acme--uat.sandbox.lightning.force.com
Please complete this configuration by January 13, 2027.
Why this is important
This update strengthens the security of the Box for Salesforce authentication flow by giving your organization greater control over which Salesforce URLs are trusted for the integration. By explicitly identifying the Salesforce URLs authorized to work with the integration, you help ensure that authentication requests are coming from Salesforce environments your organization has intentionally configured, providing an additional layer of protection for your users and content.
What happens next
Beginning January 13, 2027, Box will enforce the enhanced security controls for Box for Salesforce. If organizations do not complete the required configuration by that date, users will no longer be able to use the Box for Salesforce integration. If you have already completed the configuration, no further action is required.
We recommend working with your Box and Salesforce administrators to review your configuration and complete this update before the enforcement date.