Skip to main content
This article applies to Box connections created after August 2025, where the Domain ID under your Lumos domain shows box_ics. If your Domain ID shows box.com, you have a legacy connection, and the legacy-specific notes are called out inline.

​
After this article

You’ll be able to connect Box to Lumos to sync and provision users, groups, and roles, deactivate or delete Box users during offboarding, and transfer a departing user’s Box content to another employee.

​
Capabilities

User status mapping:
  • Box active maps to Lumos Active
  • Box inactive maps to Lumos Suspended
  • A user deleted (no longer returned by Box) maps to Lumos Deprovisioned
Activity tracking. Supported (Last Login). Lumos fetches LOGIN events from the Box admin events stream. On connection it pulls the last 6 months of admin logs.

​
Required plan and roles

  • Box plan: there’s no minimum Box plan requirement to connect.
  • Box role: the Box user connecting the integration must be a Box Admin.
  • OAuth scopes requested during setup (all required):
  • Permission scoping: you can only connect this integration with provisioning enabled. There’s no read-only mode.
  • For Box user APIs, both the authorizing user and the app need permission to manage users across the entire enterprise. This is another reason the connecting user must be a full Admin. Co-admins with partial user management scopes can hit authorization errors.

​
Read-only access vs provisioning

Is read-only possible? No. Box can only be connected with provisioning enabled, there’s no read-only mode. What full provisioning requires. OAuth authorization from a Box Admin, granting manage_managed_users, manage_groups, manage_enterprise_properties, and write access to all files and folders (needed to transfer a departing user’s content). Follow the steps below to connect and grant access as an Admin. Watch out for. Both the authorizing user and the app need permission to manage users across the entire enterprise, so a co-admin with only partial user-management scopes can hit authorization errors even though a full Admin would not. Box refuses to delete a user whose account still has content, so transfer their data first, Lumos does this automatically during Offboarding when Transfer Data is available.

​
Instructions

  1. Find the Box card in your Lumos integrations. Reconnect an existing card or add a new one.
  2. (Legacy pre-August-2025 connections only) Choose the Integration with Transfer Data option. Choose Default only if you never want Lumos to transfer a departing user’s files to another employee. Choosing Default means the data-transfer capability isn’t available later.
  3. Click Connect Box.
  4. Log into Box as an Admin and authorize the requested OAuth scopes (Grant access to Box).

​
API Endpoints Used

​
Troubleshooting

“You cannot authorize Lumos” when connecting. The Box account used isn’t a Box Admin. Reconnect using an Admin account. Delete or deprovision fails. Box refuses to delete a user whose account still has content. Transfer the user’s data to another user first. Lumos does this automatically when you choose Deprovision with Transfer Data during Offboarding. Outside offboarding, transfer manually or through an Inactivity Workflow. “Transfer Data” option is missing when setting up a workflow. On legacy connections, your Box admin chose Default instead of Integration with Transfer Data when connecting. Reconnect Box and choose the Transfer Data option. Transfer Data appears to hang or time out. Box’s transfer API is synchronous and can take a long time for large accounts. Lumos times out after 5 seconds, but the request keeps running to completion on the Box side. Box admins get an email when a transfer succeeds but not when it errors, so verify completion in Box for large transfers. Transfer fails for the receiving user. The receiving user must have access to Relay (or Relay Lite) and to the files and folders being transferred. Deactivated a user but the license wasn’t freed. Deactivation marks the user Inactive without reclaiming the license. Only deleting the user reclaims it.