Skip to main content
Solved

Multiple 2FA methods

  • May 11, 2026 8:41 AM UTC
  • 3 replies
  • 330 views
  • Translate All

Hello,

I would like our users to be able to register a security key next to their authenticator app for 2FA purposes. Is there an admin setting which allows registering multiple 2FA options or is this limited to only a single method/type?

Thank you,

Rene

Best answer by Jill

Hi ​@ReneC, 

 

Welcome to Box Community and glad to assist! 

 

Admins can allow multiple 2FA methods for managed users, but each user can enroll only one primary method for their individual Box account.
 

To get as close as possible to your goal for managed users: You can set Allow all methods or limit to selected methods

  1. Go to Admin Console > Enterprise Settings > Security.
  2. Enable Require multi-factor authentication for all managed users.
  3. Under Authentication Method, choose Limit to selected methods.
  4. Select:
    • Security Key and Authenticator app (TOTP) if you want to allow either of those stronger methods for managed users.
  5. Optionally set Authentication Frequency to Every login or a custom frequency.

 

Thanks for posting! 

View original

    3 replies

    • Jill
    • Community Manager
    • Answer
    • May 12, 2026 9:34 PM UTC

    Hi ​@ReneC, 

     

    Welcome to Box Community and glad to assist! 

     

    Admins can allow multiple 2FA methods for managed users, but each user can enroll only one primary method for their individual Box account.
     

    To get as close as possible to your goal for managed users: You can set Allow all methods or limit to selected methods

    1. Go to Admin Console > Enterprise Settings > Security.
    2. Enable Require multi-factor authentication for all managed users.
    3. Under Authentication Method, choose Limit to selected methods.
    4. Select:
      • Security Key and Authenticator app (TOTP) if you want to allow either of those stronger methods for managed users.
    5. Optionally set Authentication Frequency to Every login or a custom frequency.

     

    Thanks for posting! 

    Translate
      • ReneC
      • Author
      • New Participant
      • May 12, 2026 10:41 PM UTC

      Thank you Jill. will double-check the current security settings. And would appreciate if supporting multiple 2FA methods for end users can be added to the feature list for a future release.

      Thank you for your reply!

      Translate
        Jey Bueno Box
        Forum|alt.badge.img
        • Jey Bueno Box
        • Community Manager
        • Oct 24, 2026 1:08 AM UTC

        Bumping this thread to share some best practices and training resources for anyone still looking into this configuration!


        Since users can only have one active 2FA method, here's what we'd suggest for your organization:

        1. Set your admin policy to Allow all methods: this gives users the flexibility to choose between a security key or an authenticator app based on their preference or device availability.
        2. Encourage users to save their backup codes: Box provides backup codes when setting up authenticator app, SMS, or security key MFA. These serve as a fallback if the primary MFA device is unavailable (lost, stolen, no signal, etc.).
        3. Recommend security keys for high-risk users: for users handling sensitive content, security keys offer the strongest protection.
           

        To help your team get the most out of Box's security features, here are some relevant resources from Box Education:

        💡 Explore the full catalog at training.box.com to find the most current security and admin courses.

        Translate
        Terms of ServiceAccessibility statement