> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Asana

*This article applies to Asana connections created after September 2025 (the Domain ID under your Lumos domain shows* `asana_ics`*). If your Domain ID shows* `asana.com`*, your connection uses the archived pre-September-2025 setup. The main differences are noted inline below.*

## After this article

You will be able to connect Asana to Lumos to sync users, teams, team roles, and licenses, and to provision access, deprovision users, and (on Enterprise+ plans) track last-login activity.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| :- | :- | :- | :- | :- |
| Users | Account | Yes | Yes | User account records |
| Team | Permission | Yes | Yes | Teams in Asana |
| Team Role | Permission | Yes | Yes | Team roles in Asana |
| License | License | Yes | Yes | License access in Asana |

| Deprovisioning Action | Type | Description |
| :- | :- | :- |
| Delete | User | Deletes the user in Asana |

**Activity tracking:** supported on Enterprise+ (and legacy Enterprise) only. Lumos fetches last-login timestamps through the Audit Log Events endpoint. A Service Account Token must be configured (regular OAuth is not sufficient).

*Pre-September-2025 connections:* user status maps Active to **Active** and Inactive to **Deprovisioned**. Entitlements are **Role** (Admin, Member, or Guest, from the `is_admin`/`is_guest` fields, defaulting to Member) and **License** (Paid if Admin or Member, otherwise Free). Deprovisioning removes the user from the workspace and reclaims a license.

## Required plan and roles

* **Asana plan:** you need at least the **Asana Premium** plan to connect this integration. Full functionality requires the **Enterprise+** tier. Service Account Token generation (needed for SCIM provisioning and activity tracking) requires the Enterprise or Enterprise+ tier.
* **Asana role:** your Asana user should be a **workspace Admin** with access to the admin console.
* **Scope:** `default`, which provides access to all endpoints documented in the Asana API. This is the only scope the integration uses.
* **Permission scoping:** the connection reads user, team, and role data and, when you use provisioning, writes workspace/team membership and user lifecycle changes. Provisioning and activity tracking additionally require a **Service Account Token** (the service account's personal access token), not just the OAuth app.

## Read-only access vs provisioning

**Is read-only possible?** No. Asana's OAuth application connects with a single `default` scope that covers every endpoint the API exposes, including the ones that add and remove workspace and team membership. No narrower, read-only scope is documented for this connection.

**What full provisioning requires.** The OAuth application, created with Full Permissions and the `default` scope, covers user, team, and license provisioning through the steps below. A separate Service Account Token is required only for SCIM-based user deletion and for Enterprise+ activity tracking.

**Watch out for.** Deleting a user in Asana requires the Service Account Token, available only on the Enterprise or Enterprise+ tier. Without it, the connection can provision and update access but cannot delete users. Activity tracking has the same Enterprise+ and Service Account Token requirement. Pre-September-2025 connections, where the Domain ID shows `asana.com`, use the older Organization/Workspace ID setup noted in the Instructions below instead of this OAuth flow.

## Instructions

**Phase 1: Create an OAuth application in Asana**

1. In Asana, go to **Settings → Integrations → Asana** and create an **OAuth Application** with **Full Permissions**.
2. Set the callback URL to `https://app.lumosidentity.com/integrations/ics_oauth2_callback`.
3. Copy the **Client ID** and **Client Secret**.
4. Enable the application for **All Workspaces**.

**Phase 2: Gather your Workspace ID and Service Account Token**

1. Find your **Workspace ID** in either the main workspace URL (`https://app.asana.com/0/{workspace_id}/home`) or the Admin console URL (`https://app.asana.com/admin/{workspace_id}/members`). If you have multiple workspaces, make sure you're in the correct workspace before copying the ID. To switch workspaces, click your profile icon in the top-right corner and select the workspace from the dropdown menu under **Account**.
2. (Enterprise/Enterprise+ only) Open the Asana **Service Accounts** page, create or select a service account, and copy its token. This is required for SCIM provisioning and activity tracking.

**Phase 3: Connect in Lumos**

1. Find the Asana card in your Lumos integrations (reconnect an existing card or add a new one).
2. Enter the **Client ID**, **Client Secret**, **Workspace ID**, and (optionally) the **Service Account Token**.
3. Click **Connect**.

*Pre-September-2025 connections (*`asana.com`*):* setup only required the **Organization / Workspace ID**, copied from the admin console URL (e.g. `https://app.asana.com/admin/119770928333333/settings` gives ID `119770928333333`). The Organization ID in the URL can differ from the Domain ID shown in Asana. Use the URL value.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**"Your account doesn't have the required permissions to access integrate with Asana".** Your Asana integration credentials are invalid. Reconnect the Asana integration in Lumos.

**"Your account doesn't have access to the provided workspace id...".** Your Asana user does not have admin access to the Organization/Workspace ID you entered. Reconnect using an Asana user with admin access to that workspace.

**"Your account isn't part of the workspace...".** The Asana integration user is not a member of the configured workspace. Reconnect with an admin user that belongs to the workspace.

**Activity tracking shows no data.** Confirm a Service Account Token is configured on the connection (regular OAuth is not enough) and that your Asana plan is Enterprise+ or legacy Enterprise.