---
locale: "en"
updated_at: "2025-10-27T22:49:41.786Z"
canonical: "https://www.isdecisions.com/en/userlock/docs/guides/sso/configure-the-applications/box"
---

# Enable Single Sign-On to Box with UserLock

Enable SSO authentication for Box users.

## Introduction

This guide explains how to integrate **Box** with **UserLock Single Sign-On (SSO)** using the SAML 2.0 protocol.

Once enabled, Box logins are authenticated by UserLock. This provides users with a consistent sign-in process and gives administrators the ability to enforce UserLock [access policies](/userlock/docs/reference/core-concepts/access-policies) (MFA, time, machine, or location restrictions) on SSO sessions.

🚩 **Before starting:**

- You need a **Box Enterprise admin account**.
- UserLock SSO must already be [installed and configured](/userlock/docs/guides/sso/install-configure-sso).

## Step 1. Enable Box in UserLock SSO

1. In the **UserLock console**, go to ⚙** Server settings ▸ Single Sign-On**
2. Click on the **Box** row.
3. Enter the **Email domain** to be used for user logins.
4. Save the profile.

![](https://a.storyblok.com/f/122374/607x770/c112205055/box-settings.PNG)

## Step 2. Submit the configuration request to Box

1. Go to **UserLock console▸ **⚙** Server Settings▸ Single Sign-On**
2. Click on **Download  ▸ Metadata file.**
3. Submit an SSO configuration request to Box following the official procedure:
👉 [Box Help: Setting Up SSO for Your Enterprise](https://support.box.com/hc/en-us/articles/360043696514-Setting-Up-Single-Sign-On-SSO-for-Your-Enterprise)
4. When asked to upload metadata, use the downloaded file.

![](https://a.storyblok.com/f/122374/858x1302/bbed83e7bf/box_questionnaire.png)

## Step 3. Configure Box for Single Sign-On

Once Box has enabled SSO for your account:

1. Connect to Box with an **Administrator account**.
2. Go to **Admin Console ▸ Enterprise Settings ▸ User Settings**.
  ![](https://a.storyblok.com/f/122374/200x378/194c16f2cb/box_menu.png)
3. Under **User Settings**, locate **Configure Single Sign On (SSO)** and select **SSO Test Mode**.
  ![](https://a.storyblok.com/f/122374/754x265/2184c82eea/box_configure_sso.png)
4. When SSO is ready, disconnect the session and try logging in via Single Sign-On.

> **Note**
>
> While in **SSO Test Mode**, users can still log in with their regular credentials.

## Troubleshooting

For common issues, see [Troubleshooting SSO](/userlock/docs/support/troubleshooting/sso-issues).
If the problem persists, please contact [IS Decisions Support](/support).

### Handling SSO unavailability  

Box does not provide a built-in fallback if SSO is unavailable. To prevent lockout, you can:  

- Contact Box support and request to temporarily switch your SSO configuration back to **Test Mode**
- Ensure that a **second SSO** **provider **is configured as a backup.

### Box authentication error

![](https://a.storyblok.com/f/122374/1318x634/195b7ed197/box_loggin.png)

When logging in, Box may receive the wrong email address from SSO if users have multiple accounts under the same email domain (e.g. `testuser@mydomain.com` and `myuser@mydomain.com`).

By default, SSO provides the first address in alphabetical order.

#### Workarounds

- Change the Box user account email to match the one sent by SSO.
- Remove unused duplicate email addresses from the user if not required by other apps.

## Next steps

You can extend the security of SSO sessions by applying UserLock access policies in addition to authentication.

- [Apply MFA on SaaS connections](/userlock/docs/guides/mfa-implementation/mfa-for-sso) to require stronger authentication.
- [Hour restrictions](/userlock/docs/reference/access-policies/time-restriction): define when users are allowed to connect.
- [Geolocation rules](/userlock/docs/reference/access-policies/geolocation): enforce access policies based on user location.
- [Session limits](/userlock/docs/reference/access-policies/session-limit): allow or deny SaaS logins entirely for specific users.