Recommended Box Settings – mxHero Help Center

When mxHERO replaces attachments with Box links, the links can only be as open as your Box enterprise settings allow. This page lists the Box Admin Console settings that let mxHERO links work for your recipients while keeping sharing under control. Review them after you connect Box and before you turn on rules for real users.

Before you begin

You need Box Admin (or a co-admin with permission to change enterprise settings).
Connect Box first. See Connecting Box.

Decide which link types your rules will use. Each mxHERO Security Definition maps to a Box shared-link or collaboration setting:

mxHERO link access	Box equivalent	Box setting it depends on
Accessible to anyone (Public links)	Shared link: People with the link	Public shared links allowed
Accessible to people in the organization (Company)	Shared link: People in your company	Company links allowed; definition of "company"
Accessible to the recipients of the email	Recipient is invited as a collaborator on a folder	External collaboration allowed
Accessible to the folder collaborators (no shared link)	No shared link; access through folder collaboration	Collaboration settings

See Link Security Options by Provider and Security Definitions and Policies.

All settings below are in the Box Admin Console › Enterprise Settings › Content & Sharing tab. Box renames screens from time to time; see Box's admin documentation for the current location.

Summary

Area	Recommended
Shared links	Allowed for folders, files and hubs
Default link access	People in your company
Link permissions	Can view and download (maximum)
External collaboration	Allowed (flexible or restricted to allowed domains)
Ownership transfer	Restricted
Invite links	Disabled
Auto-expiration of shared links	30–60 days (all links); 7–30 days (public links)
Owners can change expiration	Allowed

1. Shared links

Setting	Recommended	Why
Allow shared links for	Folders, files, and hubs	mxHERO creates file links, and folder links when a rule uses Link to folder.
Definition of company	Users with email domain for most organizations; Enterprise ID if you run several Box enterprises	Controls who counts as "company" for Company links.
People who can access shared links	Allow People with the link, People in your company and People in this folder	Public (People with the link) is needed for Public and Password-protected links to external recipients who don't have Box accounts.
Default access for shared links	People in your company (higher security), or People with the link if you share externally most of the time	mxHERO sets the access each link needs, so an internal default doesn't block mxHERO links.
Shared link permissions	Maximum Can view and download; default Can view only or Can view and download	mxHERO sets download per Security Definition (prevent download is supported for Public and Company links).

Important: If you turn off public shared links (People with the link), mxHERO Public and Password-protected links to external recipients won't open. Use Company links or recipient (collaborator) links instead, or allow public links.

2. Custom shared links

Setting	Recommended
Allow custom shared link URLs	Disabled
Show your custom domain in shared link URLs	Enabled (optional)

mxHERO doesn't need custom (vanity) link URLs.

3. Collaboration

These settings matter when rules use Accessible to the recipients of the email links or folder collaboration.

Setting	Recommended	Why
Available roles	Viewer, Previewer, Editor; avoid Co-owner for regular users	Recipient links default to Viewer. In a Box Security Definition you can choose Co-owner, Editor, Viewer or Previewer.
Default collaboration role	Viewer
Restrict invites	Enabled (only owners, co-owners and admins can invite)	mxHERO invites recipients through the storage account that owns the folder, so this doesn't block mxHERO.
Enable invite links	Disabled
Enable group invites	Enabled
Restrict ownership transfer	Enabled
Move and copy content	Prevent collaborators from moving or copying content to folders with higher permissions
External collaboration	Allowed: either any external user (flexible, most common with mxHERO), or only allowed domains (restricted, for regulated environments)	Recipient links add the external recipient as a collaborator. If their domain isn't allowed, they can't open the link.

4. Shared link auto-expiration

This setting is the most important one to get right.

Setting	Recommended
Disable all shared links after	30–60 days
Disable public shared links after	7–30 days
Notify item owners before expiration	7 days
Allow owners to modify expiration	Enabled

Warning: Make sure every expiration you set in an mxHERO Security Definition is within the range your Box enterprise allows. If a rule asks for a longer expiration (or no expiration) than Box allows, Box rejects the link setting: the file is uploaded and the link appears in the email, but recipients can't open it. In Email Flow Logs this shows as a link-sharing error mentioning unshared_at.

Important: Keep Allow owners to modify expiration enabled. If it's disabled, the expiration of existing links can no longer be changed, which can block mxHERO from updating link settings.

5. Other link options

mxHERO can apply these per Security Definition, as long as Box allows them:

Password-protected links: mxHERO generates the password and sends it to the recipient in a separate email. Available for Public links on Box.
Prevent download (view only): available for Public and Company links.
Link expiration: set in days.

Verify

Create a test rule with a Security Definition that uses the link type you plan to use (for example, Public links that expire in 7 days).
Send a test email with an attachment to an external mailbox that has no Box account.
Open the link from that mailbox and confirm the file opens (and downloads, if allowed).
In Box, check the file's shared link: access level and expiration should match your Security Definition.
Check Email Flow Logs for link-sharing errors.

Troubleshooting

Symptom	Cause	Fix
External recipients see "access denied" on a Public link	Public shared links are turned off in Box	Allow People with the link, or switch the rule to Company or recipient links.
Link in the email doesn't open; Email Flow Logs mention `unshared_at`	Requested expiration is longer than the Box enterprise allows	Shorten the expiration in the Security Definition, or extend Box's auto-expiration limit.
Recipient link fails for some external domains	External collaboration is restricted to allowed domains	Add the recipient's domain, or use another link type for those recipients.
Company link opens for some internal users only	"Definition of company" doesn't include all your email domains	Use Enterprise ID, or add the missing domains.