SSOGEN / SSO Applications / Box SSO: Sign In to Box Through SSOGEN
Integration
Box SSO: Sign In to Box Through SSOGEN
Box SSO with SSOGEN is a staged rollout. Box support connects SSOGEN to your enterprise, SSO Test Mode lets people try it while passwords still work, and SSO Required makes SSOGEN the only way in.
Box SSO with SSOGEN means people open Box from their SSOGEN My Apps, or select Continue on your company’s Box address, and land in their files signed in. Box is the SAML 2.0 service provider. SSOGEN is the identity provider and applies your sign-in policy, including a second factor, before Box sees anyone.
This page explains what Box requires and how to roll SSO out safely. The click-by-click setup, with Box’s fixed entity ID and ACS URL, is in Single sign-on for Box with SSOGEN.
What Box asks of an identity provider
| Box requirement | How SSOGEN meets it |
|---|---|
| Box Business or Enterprise, not in a trial | A Box plan question, outside SSOGEN |
| SAML 2.0 | SSOGEN is a SAML 2.0 identity provider |
| SP-initiated sign-in | Every sign-in starts at Box. The My Apps tile opens your Box address, which sends the person to SSOGEN. |
| The user’s email address in the assertion | Identify the person by: email — mail address |
| First and last name, for accounts created on first sign-in | Attributes firstName ← given_name and lastName ← family_name |
| An entity ID that is unique within Box | SSOGEN’s IdP entity ID is built from your own SSOGEN address |
The SSOGEN App gallery has a Box card. It opens the registration wizard with the name, icon and protocol filled in and links to Box’s own guide.
Roll out in three stages
- Connect. Box’s self-service screen, Configure Single Sign-On (SSO) for All Users, lists a fixed set of identity providers. For SSOGEN, send SSOGEN’s metadata file and the attribute names on Box’s SSO Setup Support Form. Box Product Support configures the connection and replies.
- Test. In Admin Console, Enterprise Settings, User Settings, turn on SSO Test Mode. People can sign in through SSOGEN or with their Box password. Ask a few people to sign out and back in through SSOGEN.
- Require. Turn off test mode and turn on SSO Required. Box treats this as a critical action and asks the admin for multi-factor authentication. From then on, SSOGEN is the only way in.
Box warns that skipping the test can lock you out. In SSOGEN, run Test on the application first: the assertion card shows the email Box will receive, so a mismatch shows up before stage 3.
New users on first sign-in
Box can create an account the first time a person signs in, as long as the assertion carries the email, first name and last name. New accounts take the defaults under Enterprise Settings, User Settings, New User Defaults. Box support turns this on.
Box points out the consequence: anyone who receives an assertion can get an account. In SSOGEN that decision is the Assignments tab. Only assigned people and members of assigned groups receive a Box assertion, so the group you assign is the list of people who may have Box accounts.
When someone leaves
- Unassign the person or remove them from the assigned group, and the Box tile disappears from My Apps.
- Disable user in SSOGEN, and the person cannot sign in to SSOGEN, so no new Box session can start.
- With SSO Required on, no Box password remains as a way around SSOGEN.
Questions people ask
What is Box?
Box is a cloud content management service: companies store, share and work on files in it, and Box Drive puts those files on the desktop. Box Business and Enterprise accounts can hand sign-in to a SAML 2.0 identity provider such as SSOGEN.
What is an SSO when signing in to Box?
Single sign-on means Box does not check a password itself. Box sends the person to SSOGEN, SSOGEN confirms who they are under your sign-in policy, and Box accepts SSOGEN’s signed SAML assertion. People sign in once and open Box from My Apps without a second password.
Is SSO safe for Box?
Yes. SSO with SSOGEN puts every Box sign-in under one policy, with a second factor where you require it. With SSO Required on, no separate Box password exists to phish or reuse, and removing a person in SSOGEN closes their access to Box at once.
Does Box Drive sign in through SSOGEN?
Yes. Box Drive signs in the same way as the browser: Box sends the person to SSOGEN, and SSOGEN sends them back signed in. The Box setup guide covers the sign-in test and certificate rotation.
Where to go next
- Hub. The SSO applications hub has the protocol comparison and the other guides.
- The SSOGEN screens. Register a SAML application and Assign people, set the sign-in policy, test and activate describe every step.
- More collaboration apps. Slack SSO follows the same pattern for chat.
Sources, all read 2026-11-15 (Box Support):