Box should partner with identity providers like ID.me and Login.gov, allowing for enterprises to ensure a smooth and secure login process for managed users and external collaborators alike . Users should be able to use these credentials to access Box.

This is especially important to reduce the risk of unverified external collaborators accessing sensitive enterprise content. Ideally, admins can enforce these IdP logins for external collaborators (similarly to how the current 2FA setting for external collaborators works). These two identity providers can require IAL2/AAL2 identity verification and authentication in accordance with NIST 800-63-3 standards.