Employee Is Asked to Use an Authenticator to Access Box.com

👋 Hi ​@Jberebit, welcome to the Box Community!

The sudden prompt for a six-digit authenticator code or authenticator app is due to a security feature implemented by Box to protect administrative accounts from unauthorized access and attacks.

Even if you have confirmed that organization-wide two-step verification (2FA) is disabled, Box enforces mandatory Multi-Factor Authentication (MFA) checks for Admins and Co-Admins when they attempt to perform critical administrative actions in the Admin Console.

These critical actions include:

1. Modifying MFA settings: Adding, changing, or deleting multi-factor authentication settings for both managed and external users.
2. Modifying SSO settings: Enabling, disabling, or changing the Single Sign-On (SSO) Required settings for the organization.
3. Zero trust protections: Actions designed to prevent bad actors from leveraging compromised admin accounts to create new admins or add/remove domains.

When an Admin or Co-Admin performs any of these actions, they will be required to perform multi-factor authentication (MFA) to complete the action, based on the following:

• If the Admin or Co-Admin is enrolled in MFA, they will be presented with the challenge based on their authentication method.
• If the Admin or Co-Admin is not enrolled in MFA, they will be presented with an email MFA challenge. At this stage, upon completing the challenge successfully, they will NOT be enrolled in MFA.
• If the Admin or Co-Admin is SSO enabled, they will be presented with an email MFA challenge.

Resources:

• Multi-Factor Authentication Required for Admin Console Critical Actions
• New admin MFA requirements for changing SSO settings

Please coordinate with your co-admin to verify the specific action they are attempting to perform. If you require further assistance regarding this matter, please submit a support ticket to our Product Support team. Thank you!