Skip to main content
This article applies to Asana connections created after September 2025 (the Domain ID under your Lumos domain shows asana_ics). If your Domain ID shows asana.com, your connection uses the archived pre-September-2025 setup. The main differences are noted inline below.

​
After this article

You will be able to connect Asana to Lumos to sync users, teams, team roles, and licenses, and to provision access, deprovision users, and (on Enterprise+ plans) track last-login activity.

​
Capabilities

Activity tracking: supported on Enterprise+ (and legacy Enterprise) only. Lumos fetches last-login timestamps through the Audit Log Events endpoint. A Service Account Token must be configured (regular OAuth is not sufficient). Pre-September-2025 connections: user status maps Active to Active and Inactive to Deprovisioned. Entitlements are Role (Admin, Member, or Guest, from the is_admin/is_guest fields, defaulting to Member) and License (Paid if Admin or Member, otherwise Free). Deprovisioning removes the user from the workspace and reclaims a license.

​
Required plan and roles

  • Asana plan: you need at least the Asana Premium plan to connect this integration. Full functionality requires the Enterprise+ tier. Service Account Token generation (needed for SCIM provisioning and activity tracking) requires the Enterprise or Enterprise+ tier.
  • Asana role: your Asana user should be a workspace Admin with access to the admin console.
  • Scope: default, which provides access to all endpoints documented in the Asana API. This is the only scope the integration uses.
  • Permission scoping: the connection reads user, team, and role data and, when you use provisioning, writes workspace/team membership and user lifecycle changes. Provisioning and activity tracking additionally require a Service Account Token (the service account’s personal access token), not just the OAuth app.

​
Read-only access vs provisioning

Is read-only possible? No. Asana’s OAuth application connects with a single default scope that covers every endpoint the API exposes, including the ones that add and remove workspace and team membership. No narrower, read-only scope is documented for this connection. What full provisioning requires. The OAuth application, created with Full Permissions and the default scope, covers user, team, and license provisioning through the steps below. A separate Service Account Token is required only for SCIM-based user deletion and for Enterprise+ activity tracking. Watch out for. Deleting a user in Asana requires the Service Account Token, available only on the Enterprise or Enterprise+ tier. Without it, the connection can provision and update access but cannot delete users. Activity tracking has the same Enterprise+ and Service Account Token requirement. Pre-September-2025 connections, where the Domain ID shows asana.com, use the older Organization/Workspace ID setup noted in the Instructions below instead of this OAuth flow.

​
Instructions

Phase 1: Create an OAuth application in Asana
  1. In Asana, go to Settings → Integrations → Asana and create an OAuth Application with Full Permissions.
  2. Set the callback URL to https://app.lumosidentity.com/integrations/ics_oauth2_callback.
  3. Copy the Client ID and Client Secret.
  4. Enable the application for All Workspaces.
Phase 2: Gather your Workspace ID and Service Account Token
  1. Find your Workspace ID in either the main workspace URL (https://app.asana.com/0/{workspace_id}/home) or the Admin console URL (https://app.asana.com/admin/{workspace_id}/members). If you have multiple workspaces, make sure you’re in the correct workspace before copying the ID. To switch workspaces, click your profile icon in the top-right corner and select the workspace from the dropdown menu under Account.
  2. (Enterprise/Enterprise+ only) Open the Asana Service Accounts page, create or select a service account, and copy its token. This is required for SCIM provisioning and activity tracking.
Phase 3: Connect in Lumos
  1. Find the Asana card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Enter the Client ID, Client Secret, Workspace ID, and (optionally) the Service Account Token.
  3. Click Connect.
Pre-September-2025 connections (asana.com): setup only required the Organization / Workspace ID, copied from the admin console URL (e.g. https://app.asana.com/admin/119770928333333/settings gives ID 119770928333333). The Organization ID in the URL can differ from the Domain ID shown in Asana. Use the URL value.

​
API Endpoints Used

​
Troubleshooting

“Your account doesn’t have the required permissions to access integrate with Asana”. Your Asana integration credentials are invalid. Reconnect the Asana integration in Lumos. “Your account doesn’t have access to the provided workspace id…”. Your Asana user does not have admin access to the Organization/Workspace ID you entered. Reconnect using an Asana user with admin access to that workspace. “Your account isn’t part of the workspace…”. The Asana integration user is not a member of the configured workspace. Reconnect with an admin user that belongs to the workspace. Activity tracking shows no data. Confirm a Service Account Token is configured on the connection (regular OAuth is not enough) and that your Asana plan is Enterprise+ or legacy Enterprise.