Action Required
We're introducing a security enhancement to the Box for Salesforce integration designed to strengthen user authentication and help protect your organization from unauthorized authentication requests. As part of this enhancement, we're introducing additional validation of the Salesforce URLs that can be used with your Box for Salesforce integration.
What you need to do
To continue using the Box for Salesforce integration without disruption after the enforcement date, a Box Admin must add the Salesforce URL(s) used by your organization to the Allowed Salesforce URLs configuration in the Box Admin Console:
Box Admin Console → Box for Salesforce → Configuration → Restrict OAuth redirects to specific Salesforce web addresses
Who can make the change?
A Box admin, or a co-admin whose permissions include managing integrations. It is a Box-side configuration change — nothing needs to be changed in Salesforce.
Which URLs should be added?
Every Salesforce address your users authenticate from. In practice that usually means your production Salesforce address, including a custom My Domain address if you use one; any sandbox or developer org where the integration is used.
Please complete this configuration by January 13, 2027.
Why this is important
This update strengthens the security of the Box for Salesforce authentication flow by giving your organization greater control over which Salesforce URLs are trusted for the integration. By explicitly identifying the Salesforce URLs authorized to work with the integration, you help ensure that authentication requests are coming from Salesforce environments your organization has intentionally configured, providing an additional layer of protection for your users and content.
What happens next
Beginning January 13, 2027, Box will enforce the enhanced security controls for Box for Salesforce. If organizations do not complete the required configuration by that date, users will no longer be able to use the Box for Salesforce integration. If you have already completed the configuration, no further action is required.
We recommend working with your Box and Salesforce administrators to review your configuration and complete this update before the enforcement date.