Skip to main content
Read on to learn how to configure MDM with Box.

​
Microsoft Intune

Microsoft Intune is one of the most popular Enterprise Mobility Management (EMM) providers. For iOS, the enterprise admin (EA) can obtain Box integrations (Box for EMM, Box Mobile) using the public App Store. When the EA acquires one of the integrations, they can provision it through the admin console in Microsoft Intune. For Android, an admin has to first connect to the managed Google Play store and approve the Company Portal integration.

​
iOS

Start with adding a new policy:
      1. Add app configuration policies for managed iOS/iPadOS devices.
      2. Choose Box for EMM or Box Mobile as the Targeted App.
      3. Use the configuration designer and enter the general and Intune-specific configuration keys/values.
If you’re using Intune for MAM and a third-party provider for MDM that doesn’t have User Principal Name as its variable, try using Email variable instead.

​
Add a new protection policy

Proceed to add a new protection policy for your integration. Choose the Box for EMM/Box Mobile as the public app. Select all the appropriate settings in next steps. Before you save your changes, make sure that all the settings are correct and assigned to the right group.
If you can’t edit Office files in Box for EMM (for example after enabling the Office Co-Authoring feature), enable saving to Box in Intune in the protection policy. To do so, select Box in the Allow users to save copies to selected services setting*.*Check the Microsoft documentation to make sure that the setting name is up to date.

​
Box configuration

Box for EMM is restricted to only MDM managed devices - it’s a default feature in Box for EMM. The users can log into Box for EMM only if their account was provisioned with the Microsoft Intune admin console. They have to use their enterprise credentials.
You can make sure that users access Box through Box for EMM. To do so:
      1. Go to the Admin console > Integrations.
      2. Find iOS in the Box Official Clients section.
      3. Disable the following integrations by toggling the radio button next to them:
        1. Box for iPhone
        2. Box for iPad
      4. Scroll down to Mobile web and accessibility and disable Box.com mobile site. Make sure that Box for iPhone (EMM) and Box for iPad (EMM) are enabled.
If you deployed any other Box integrations, or you have an Android solution, check if you want to disable any additional integrations.
Changing the above settings prevents the enterprise’s users from accessing the regular (unmanaged) Box for Mobile and mobile site. Make sure you notify your Box users before taking this action.

​
Android

Start with connecting your Intune account to the Android Enterprise account. For more information, see Android Enterprise documentation and Intune documentation. Then, approve your company portal in the managed Google Play store and confirm that it works. Ensure that all approved integrations are synced and have the policies/assignments set up for them.

​
Integration configuration policy

Enter the general and Intune-specific configuration keys and their values in configuration settings. Validate whether Box for Mobile is visible in the Play Store. Download it and check if it’s available in Workspace. Your users can now open the integration and log in.

​
User scenarios

​
Workspace ONE (AirWatch)

Learn how to configure MDM with Workspace ONE (AirWatch).

​
iOS

  1. After receiving the key value pair from Box, the EA should obtain the Box for EMM integration.
  2. Add Box for EMM or Box for Mobile in your EMM console.
  3. After the integration is loaded, enable the following deployment setting:
    1. Remove or Unenroll
    2. Prevent Application Backup
    3. Application Tunneling
  4. Disable the following deployment setting:
    1. Make Application MDM Managed if User Installed
    2. Application Configuration
Enter the general key-value pairs required for Workspace ONE.

​
Android

Add the integration in the Workspace ONE admin console.
  1. After the integration is loaded, configure the settings.
  2. Check the following policies:
    1. Remove on Unenroll: strongly recommended by Box. By checking this option you can remove a user’s account in the Box admin console when you’re retiring them. Doing so prevents the user from accessing the integration, as Box for Mobile and Box for EMM automatically log out users whose MDM profiles have been removed.
    2. Send Application Configuration,
    3. Application uses the AirWatch SDK.
  3. Add configuration keys:
    1. First key as Management ID,
    2. Second key as Public ID - enter the key - value pair provided by Box,
    3. OPTIONAL: you can add a third configuration key as EmailAddress. This option configures users’ AirWatch email address to pre-populate on the Box for Mobile or Box for EMM login page.
If the integration was uploaded previously but not configured as above, edit the deployment settings.
Android Enterprise requires account integration in the AirWatch console before any devices can be configured. Then you need to register a device and push the integration to the device.

​
User scenarios

​
MaaS360

Learn how to configure MDM with MaaS360.
Sending the Public ID on Android is handled through an EMM client installed on the device. It is separate from the Box mobile integration.

​
iOS

When you receive the Public ID from Box (step 2 in the process flow), follow these steps:
  1. Go to the MaaS360 admin console.
  2. Add Box for EMM/Box for Mobile from the iTunes store.
  3. Add the required and MaaS360-specific key-value pairs as configuration.
Box for EMM/Box for Mobile is now added to the App Catalog. Select the target devices to distribute the integration to users. If prompted, enter the EA password.
Make sure that the device to which the integration is being distributed is managed by an MDM policy. If a new policy is required, add it in the MaaS360 admin console. Newly created policies have to be applied to the required users and devices.

​
Android

When you receive the Public ID from Box (step 2 in the process flow), follow these steps:
  1. Contact Box Product Support for your enterprise, who provide Box for EMM directly.
  2. Go to MaaS360 and add the integration. For more information, see Adding apps to the App Catalog
  3. Upload the .apk file provided by Box Product Support. If prompted, enter the MaaS360 password.
Box for EMM/Box for Mobile is now successfully added to the MaaS360 App Catalog. After adding the integration to the catalog, you need to select the WorkPlace Persona policy in MaaS360. If a new policy is required, add it. For more information, see MaaS360 security policies overview Edit the WorkPlace Persona policy and enter the Public ID. For more information, see Configuring policy settings for an Android device.

​
User scenarios

​
Ivanti EPMM (previously MobileIron Core)

Learn how to configure MDM with MobileIron (Ivanti). Before you start configuration of Box for EMM for iOS or Android, you need to:
  1. Contact Box Product Support and inform them you want to deploy Box for EMM with Ivanti EPMM.
  2. Ivanti provides the API hostname (URL), user ID, and password for Ivanti account to Box Product Support, which Box needs to access the Ivanti APIs.
  3. Create a MobileIron user.
  4. Assign correct roles to the user.
  5. Send Box Product Support the user ID and password you created in the previous steps.
  6. Send Box Product Support the Fully-Qualified Domain Name (FQDN) for your Ivanti EPMM server or the URL for your Connected Cloud tenant.
  7. Box Product Support registers this information in your Box enterprise account, and provides you with a .plist file containing a Public ID to use in Ivanti EPMM.

​
Mobile integration configuration details

  1. Add Box for EMM integration in Ivanti. For more information, see Admin Portal workspace.
  2. Create a managed integration configuration, using the general key-value pairs provided in the integration configuration section.
  3. Edit the settings - recommended options are:
    1. Prevent backup of the app data,
    2. Remove app when MDM profile is removed,
    3. Remove app when the device is quarantined or signed out.
  4. For more information, see Managed App Settings.
  5. Edit Box for EMM and apply labels to it.
  6. Publish the integration.
  7. Create a new action to selectively wipe Box for EMM data for non-compliant devices.

​
Ivanti Neurons for MDM (previously MobileIron Cloud)

Learn how to configure MDM with Ivanti Neurons for MDM.
  1. Import the Box for EMM integration to the Ivanti App Catalog.
  2. Choose which users to distribute Box for EMM to.
  3. For Box for EMM, configure:
    1. app installation,
    2. app settings,
  4. Create a managed app configuration, using the general key-value pairs.
  5. Choose which users to distribute the configuration to.

​
User scenarios - Ivanti EPMM and Ivanti Neurons

​
Citrix XenMobile

Learn how to configure MDM with Citrix XenMobile.
  1. Provision the Box for EMM integration on Citrix XenMobile server. For more information, see Add apps.
  2. Configure settings for Box for EMM. For more information, see Configure app settings for iOS apps or Configure app settings for Google Play apps.
  3. Enter com.box.mdmios in the Identifier field.
  4. Enter the following text in the Dictionary content field: <plist version=“1.0”> <dict> <key>Public ID</key> <string>Enter_Your_Public_Id_Here</string> <key>com.box.mdm.oneTimeToken</key> <string>string>DEVICE_UDIDDEVICE\_UDID</string> </dict> </plist>
Remember to replace the {Enter_Your_Public_Id_Here} string with your actual Public ID.
  1. Choose the delivery groups.
  2. Edit each delivery group and make sure the Box for EMM Config policy shows up.

​
User scenarios

Last modified on July 13, 2026