Enable Single Sign-On to Box with UserLock

Centralize Box authentication with UserLock SSO to streamline user access and maintain control over corporate accounts.

Published September 30, 2025
Useful resources

Introduction

This guide explains how to integrate Box with UserLock Single Sign-On (SSO) using the SAML 2.0 protocol.

Once enabled, Box logins are authenticated by UserLock. This provides users with a consistent sign-in process and gives administrators the ability to enforce UserLock access policies (MFA, time, machine, or location restrictions) on SSO sessions.

🚩️ Before starting:

Step 1. Enable Box in UserLock SSO

  1. In the UserLock console, go to ⚙️ Server settings ▸ Single Sign-On

  2. Click on the Box row.

  3. Enter the Email domain to be used for user logins.

  4. Save the profile.

Step 2. Submit the configuration request to Box

  1. Go to UserLock console▸ ⚙️ Server Settings▸ Single Sign-On

  2. Click on Download ▸ Metadata file.

  3. Submit an SSO configuration request to Box following the official procedure:
    👉️ Box Help: Setting Up SSO for Your Enterprise

  4. When asked to upload metadata, use the downloaded file.

Step 3. Configure Box for Single Sign-On

Once Box has enabled SSO for your account:

  1. Connect to Box with an Administrator account.

  2. Go to Admin Console ▸ Enterprise Settings ▸ User Settings.

  3. Under User Settings, locate Configure Single Sign On (SSO) and select SSO Test Mode.

  4. When SSO is ready, disconnect the session and try logging in via Single Sign-On.

Note

While in SSO Test Mode, users can still log in with their regular credentials.

Troubleshooting

For common issues, see Troubleshooting SSO.
If the problem persists, please contact IS Decisions Support.

Handling SSO unavailability

Box does not provide a built-in fallback if SSO is unavailable. To prevent lockout, you can:

  • Contact Box support and request to temporarily switch your SSO configuration back to Test Mode

  • Ensure that a second SSO provider is configured as a backup.

Box authentication error

When logging in, Box may receive the wrong email address from SSO if users have multiple accounts under the same email domain (e.g. testuser@mydomain.com and myuser@mydomain.com).

By default, SSO provides the first address in alphabetical order.

Workarounds

  • Change the Box user account email to match the one sent by SSO.

  • Remove unused duplicate email addresses from the user if not required by other apps.

Next steps

You can extend the security of SSO sessions by applying UserLock access policies in addition to authentication.