Admin and End User forums

Hello,I would like our users to be able to register a security key next to their authenticator app for 2FA purposes. Is there an admin setting which allows registering multiple 2FA options or is this limited to only a single method/type?Thank you,Rene

Hello,I’m looking for suggestions on how to best share the details of a Box Shield alert with an affected user.  For instance, if I want to share the details of an anomalous download alert with the user, including the list of folders.  There’s no way to report on it or export the alert, right?Thanks in advance for any help!

I am adding a user but it gives me an error “invitation available for freemium account holders”. Not sure what to do from there. Any help would be great!

Hi, store regulated customer documents in Box and need a written statement from Box Security for our vendor risk file regarding today’s PHP remote code execution vulnerabilities ( CVE-2026-109618 and CVE-2026-109619 ). Specifically:Does any component in Box’s service delivery path (upload handling, API, web application) run the PHP runtime (php-src, as opposed to HHVM)?   If so, has it been patched to the versions PHP released on October 21, and when was that completed?   Has Box identified any indication of exploitation attempts against its infrastructure prior to patching?A short written response would be appreciated. If Box has published or will publish a public advisory, a link to that is sufficient for questions 1 and 2. References:https://www.cve.org/CVERecord?id=CVE-2026-109618 https://www.cve.org/CVERecord?id=CVE-2026-109619 https://nvd.nist.gov/vuln/detail/CVE-2026-109618 https://nvd.nist.gov/vuln/detail/CVE-2026-109619 https://www.php.net/archive/2026.php#2026-10-20-1 https:/

We've done some testing to find out if Box AI Home has access to content via shared links. The result suggests that content recently access via shared link can be processed by a Box AI Home event when the user does not have collaborator access to the file.Below are the 4 tests that we performed. In all 4 instances, the user does not have collaborator access to any of the documents When the shared link is set to ‘invited people only’ AI Home cannot find the document When the document does not have a shared link enabled, AI home search does not surface it When a shared link is enabled but I have not accessed the document yet via the shared link, AI Home does not surface it when I search. When a shared link is enabled and I have accessed the document at least once via the shared link, AI Home search returns the document in search Is this behaviour expected and are there situations where content accessed recently via shared links can be included in files processed by Box AI Home?

How do I turn it off.  I bring up a document to reuse for something else.  I edit it and it automatically saves over the original document before I do “save as” for another location

Account Type: Enterprise PlusWe are currently migrating from SharePoint to Box using Shuttle. At around 7TB of files migrated, we received an email referencing the Fair Use Policy.Given that Enterprise Plus offers unlimited data, could you confirm if we might encounter any issues moving forward? We have already migrated 2024 and older data files and are planning to migrate 2025 files. We want to ensure it is safe to proceed despite receiving the Fair Use Policy notice.Thank you for your guidance. Email from Box below Dear Box admin,Thank you for your continued use of Box. We have detected a significant increase in bandwidth use to your account [removed by moderator] that exceeds the bandwidth limitations set forth in our Fair Use Policy (Section 1, article a) and violates the Box Terms of Service.As a result, to prevent abuse and ensure the integrity of the Box Service for all our users, we have implemented preventative measures to limit your bandwidth. We ask that you take the necessa

Just new and learning about box

Can access policies in Azure be created to only allow FedRAMP box accounts and block other accounts?

This link is brokenhttps://ucsf.box.com/s/<removedinformation>

Hi everyone,I have a question about Box permissions.I am an external user who receives access to Box content from multiple clients. I do not manage the Box environments or permission settings myself. I am simply the recipient of access that has been granted by different clients.Because multiple clients have shared content with the account I use, I can see folders and files from several different clients when I log in.My understanding is that I can see these folders only because they have been explicitly shared with my account.What I would like to confirm is whether those clients can see each other's content. For example, if both Client A and Client B share folders with the same external user account, can Client A see Client B's folders or files in any way without being explicitly granted access?Or are all folders and files isolated by permissions so that each client can only see the content shared directly with them?Thank you in advance for your help.

External partners can no longer open a Box folder I share with third parties outside my organization through a password-protected shared link. Until recently, they could open the link. Now the link redirects them to our enterprise Island Browser (which they have access to). Any suggestions?

I have a Managed User who has Viewer Uploader permissions for a root folder. However, when the user accesses any subfolder within that root folder, the New + button is grayed out, preventing the user from uploading files.This was not previously an issue for this user. I reviewed the user’s account settings, collaboration permissions, and folder-level permissions, but I can’t find any changes or restrictions that would explain why the upload option is now unavailable to anyone with ‘Viewer Uploader’ permissions.The user needs to upload files to the subfolders. Has anyone experienced this behavior or found another setting that may override Viewer Uploader permissions? 

I started the Box Certified Admin course, but it only allows you to complete the first module.  Does not continue where you left off, etc.  Disappointing  

I am unable to receive any 2FA codes to my email. It is the correct email but have not been getting anything even in my SPAM or junk email. What can I do to get into my account?

I’m trying to turn off Auto Enrollment and it wouldn’t let me do so.Not sure if it’s related to me not configuring DNS records on our domain.Also, what happens if I simply delete the domain on Enterprise Settings > Custom Set Up > Domain Management ??

Our company is currently utilizing Box under a monthly subscription and is in the trial phase of implementing the service. We have been in the process of migrating data, and to further validate data migration and other aspects, we are considering upgrading to a higher-tier plan and increasing the number of users.We have a campaign currently applied to our Business organization, which offers a significant discount. We would like to explore the possibility of leveraging this campaign period for our validation purposes.In this context, we have the following questions:License Cancellation and Plan DowngradeIs it possible to temporarily increase the number of licenses or upgrade to a higher-tier plan during the campaign period for testing, and subsequently decrease the number of licenses or downgrade the plan to an appropriate level after understanding our actual use cases?Estimated Processing TimeIf license cancellation or plan downgrade is possible, what is the estimated turnaround time (

I am the Primary Administrator of my business account, but my current session is trapped in a Free/Personal OAuth mapping loop.When I try to update my primary email from [removed by moderator] to [removed by moderator] , the web panel fails with: "The Box account is already linked to another Google account." Attempting to change or force a master password returns a 401 Unauthorized API error because no standalone password exists in the master database.Because of this loop, I am blocked from submitting a traditional help desk ticket. Can a Box Community Moderator please manually escalate this thread and create a backend support case so a Tier 2 technician can purge the broken Google social login mapping records on my profile?

I want to know if creating this workflow is even possible? I am running into many roadblocks1) check google calendar for event which triggers an automatic email reminder to vendor for COI renewal request 2) send email request or link request to vendor to upload the requested COI renewed file onto the website 3) if the file isn't uploaded in a week, send an email reminder to follow up 4) if the file is uploaded within a week, don't need to follow up with the vendor but checks for COI accuracy 5) email the insurance agent for verification of the COI that it's real<moderator note: title has been updated>

Is there a way for a co-admin to override an Enterprise setting on a folder? I would like to allow Editors on one folder to invite Collaborators. I’d rather not make the change for our entire instance.As a follow-up, if I deselect this Enterprise setting does it default to having “Only Owners and Co-owners can send collaborator invites”?

I used Box.com at my old law firm. I need to change my email account to be for my new law firm. When I go into account settings and try to link my new email, it says “You cannot use an email address from an unverified domain as your secondary email address. Ask your admin to validate the domain you want to use or contact your Box support representative.” I did not receive an email to verify my new email account. I checked my Spam and have not received it. I need help from a Box support representative. 

Hi,We're on a Business trial (Enterprise ID [removed by moderator] ) and are setting up the remote Box MCP server (https://mcp.box.com) for a third-party MCP client (ClickUp).In Admin Console → Integrations → Custom Box MCP Server → Configure → Additional Configuration, we created Integration Credentials. After that first save:The Save button stays disabled after we edit Redirect URIs or scopes, so changes are never saved. /api/oauth2/authorize with that client ID returns redirect_uri_mismatch for every redirect URI, so it looks like none is stored. The "Manage AI" scope from your MCP setup article isn't listed, and our Admin Console has no Box AI or Platform → Platform Apps sections.Could you check whats wrong and why we cannot save our changes?