Action Required
We're introducing a security enhancement to the Box for Salesforce integration designed to strengthen user authentication and help protect your organization from unauthorized authentication requests. As part of this enhancement, we're introducing additional validation of the Salesforce URLs that can be used with your Box for Salesforce integration.
This is advance notice, the configuration option is not available yet, and no action is required today. You will receive an email when it's ready to set up.
What you need to do
When this enhancement is available, to continue using the Box for Salesforce integration without disruption after the enforcement date, a Box Admin must add the Salesforce URL(s) used by your organization to the Allowed Salesforce URLs configuration in the Box Admin Console:
Box Admin Console → Box for Salesforce → Configuration → Restrict OAuth redirects to specific Salesforce web addresses
Please complete this configuration by January 13, 2027.
Why this is important
This update strengthens the security of the Box for Salesforce authentication flow by giving your organization greater control over which Salesforce URLs are trusted for the integration. By explicitly identifying the Salesforce URLs authorized to work with the integration, you help ensure that authentication requests are coming from Salesforce environments your organization has intentionally configured, providing an additional layer of protection for your users and content.
What happens next
You will receive an email when this security enhancement is live; at that time, please complete the required configuration. Beginning January 13, 2027, Box will enforce the enhanced security controls for Box for Salesforce. If organizations do not complete the required configuration by that date, users will no longer be able to use the Box for Salesforce integration. If you have already completed the configuration, no further action is required.
We recommend working with your Box and Salesforce administrators to review your configuration and complete this update before the enforcement date.