> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Box

> Connect Box to Iru Compliance through OAuth to collect enterprise file and folder inventory, user and group access, and sharing-policy configuration.

### About Box

Iru uses **OAuth 2.0** (**authorization code**) to read **files**, **folders**, **users**, **groups**, and **enterprise** metadata. The **authorizing Box user** must be able to see the content your audit program cares about - prefer **admin-level** visibility when you need org-wide evidence.

### How It Works

Iru uses Box’s **OAuth 2.0 authorization code** grant. You sign in at Box through the wizard’s **popup**, review scopes, and approve access; Box returns a code that Iru exchanges for tokens used on subsequent REST calls.

| Detail             | Value                                     |
| ------------------ | ----------------------------------------- |
| **Category**       | Cloud storage                             |
| **Authentication** | OAuth 2.0                                 |
| **Typical plans**  | Business or Enterprise (full API surface) |

Scopes commonly include **read** access to files/folders plus **enterprise** administration where applicable - exact strings appear on Box’s consent screen.

Official references: [OAuth 2.0](https://developer.box.com/guides/authentication/oauth2/), [Scopes](https://developer.box.com/guides/api-calls/permissions-and-errors/scopes/), [Developer docs](https://developer.box.com/).

### Prerequisites

* Browser **popups** allowed for your Iru domain.
* A Box account with sufficient rights for the folders and users under review.

### Connect Box to Iru

<Tabs>
  <Tab title="Box">
    <Note>
      Complete this tab before you enable **Box** in **Iru Compliance**, so the right user is ready for OAuth.
    </Note>

    <Steps>
      <Step title="Sign in to Box">
        Open [box.com](https://www.box.com) and sign in with the account you will use in the OAuth popup (prefer **co-admin** or **admin** visibility for org-wide evidence).
      </Step>

      <Step title="Confirm enterprise visibility">
        Browse **Admin Console** (or equivalent) and spot-check **users**, **groups**, and **folders** your audit program must cover. If this user cannot see an object in Box, Iru cannot read it either.
      </Step>

      <Step title="Review OAuth scopes">
        Skim Box’s [OAuth 2.0](https://developer.box.com/guides/authentication/oauth2/) and [Scopes](https://developer.box.com/guides/api-calls/permissions-and-errors/scopes/) docs so the consent screen matches your expectations.
      </Step>

      <Step title="Allow pop-ups for Iru">
        In the browser profile you will use for Compliance, allow **pop-ups** for your **Iru** hostname so the Box consent window is not blocked.
      </Step>
    </Steps>

    <Note>
      Continue on the [**Iru Compliance**](#iru-compliance) tab.
    </Note>
  </Tab>

  <Tab title="Iru Compliance">
    <Note>
      Finish the [**Box**](#box) tab first.
    </Note>

    <Steps>
      <Step title="Open Sources">
        In Iru Compliance, on the left navigation bar, expand **Compliance** and select **Sources**.

        <Frame>
          <img src="https://mintcdn.com/iru/7HsGH7lnQ8GpVmI0/assets/media/images/iru-navigation-compliance-sources.png?fit=max&auto=format&n=7HsGH7lnQ8GpVmI0&q=85&s=595982441fd777b333b3ecfea24adc24" alt="Left navigation: Compliance expanded, Sources selected" width="424" height="1056" data-path="assets/media/images/iru-navigation-compliance-sources.png" />
        </Frame>
      </Step>

      <Step title="Turn on Box">
        Find **Box** (use **Category** or **Search by name or description**). On that card, turn on the **toggle**. A browser tab or window may open for the connector wizard.
      </Step>

      <Step title="Start OAuth from the wizard">
        Choose **Launch OAuth** (or the equivalent control) in the connector wizard.
      </Step>

      <Step title="Sign in to Box and approve">
        Complete Box login, review scopes, and select **Grant access to Box** (wording may read **Grant**). Close the popup when the wizard tells you to.
      </Step>

      <Step title="Finish the connection">
        When the Box popup closes and Iru finishes the token exchange, the wizard shows **Connection Configured**.
      </Step>

      <Step title="Confirm the source is Active">
        Close the **Iru is requesting access to external services** browser tab, then return to **Compliance** → **Sources** and confirm the **Box** card is **Active**.
      </Step>
    </Steps>
  </Tab>
</Tabs>

### Troubleshooting

<AccordionGroup>
  <Accordion title="Nothing opens when you turn the source on">
    Check **pop-up blocker** settings for the Iru site and try again.
  </Accordion>

  <Accordion title="Popup blocked">
    Allow popups; toggle source off/on.
  </Accordion>

  <Accordion title="Insufficient permissions">
    Re-authorize with a user who can access missing enterprise objects.
  </Accordion>

  <Accordion title="Stale refresh">
    Access tokens are short-lived; Iru refreshes automatically - if refresh fails after **60 days** idle or consent changes, **re-authorize**.
  </Accordion>
</AccordionGroup>

### Considerations

<CardGroup cols={2}>
  <Card title="Tokens are tied to the authorizing…" icon="circle-info">
    Tokens are tied to the authorizing user - **deactivation** may break sync until someone reconnects.
  </Card>
</CardGroup>

### Related Articles

<CardGroup cols={2}>
  <Card title="Sources Management" icon="plug" href="/en/compliance/sources-management">
    Browse and manage every Compliance source.
  </Card>

  <Card title="Getting Started With Compliance" icon="rocket" href="/en/compliance/getting-started-with-compliance">
    Frameworks, actions, and **Artifacts**.
  </Card>

  <Card title="Iru Overview" icon="layer-group" href="/en/iru/platform-overview/iru-overview">
    How Endpoint, Compliance, and Identity fit together.
  </Card>

  <Card title="Artifacts Management" icon="folder-open" href="/en/compliance/artifacts-management">
    Upload, review, and organize evidence from sources and actions.
  </Card>
</CardGroup>