> ## Documentation Index > Fetch the complete documentation index at: https://docs.lumos.com/llms.txt > Use this file to discover all available pages before exploring further. # Box *This article applies to Box connections created after August 2025, where the Domain ID under your Lumos domain shows* `box_ics`*. If your Domain ID shows* `box.com`*, you have a legacy connection, and the legacy-specific notes are called out inline.* ## After this article You'll be able to connect Box to Lumos to sync and provision users, groups, and roles, deactivate or delete Box users during offboarding, and transfer a departing user's Box content to another employee. ## Capabilities | Functionality | Type | Sync | Provision | Description | | :- | :- | :- | :- | :- | | Users | Account | Yes | Yes | User accounts | | Groups | Permission | Yes | No | Groups in Box | | Group Roles | Permission | Yes | Yes | Group memberships and roles in Box | | Roles | Permission | Yes | Yes | Box roles (only the admin role can be assigned) | | Deprovisioning Action | Type | Description | | :- | :- | :- | | Deactivate | User | Marks the user **Inactive** in Box (Lumos status: Suspended). Doesn't reclaim a license. | | Delete | User | Deletes the user in Box (Lumos status: Deprovisioned). Fails if the user's account still has content, so transfer data first. Reclaims a license. | | Transfer Data | User | Transfers the user's Box content to a target user. Runs during Offboarding (when choosing Deprovision) or in Inactivity Workflows, but not in Access Reviews. The receiving user must have **Relay or Relay Lite** access and access to the files and folders involved. | **User status mapping:** * Box `active` maps to Lumos Active * Box `inactive` maps to Lumos Suspended * A user deleted (no longer returned by Box) maps to Lumos Deprovisioned **Activity tracking.** Supported (Last Login). Lumos fetches LOGIN events from the Box admin events stream. On connection it pulls the last 6 months of admin logs. ## Required plan and roles * **Box plan:** there's no minimum Box plan requirement to connect. * **Box role:** the Box user connecting the integration must be a Box Admin. * **OAuth scopes requested during setup (all required):** | Scope | Purpose | | :- | :- | | `manage_managed_users` | Create, update, deactivate, and delete managed users | | `manage_groups` | Read groups and manage group memberships | | `manage_enterprise_properties` | Read enterprise-level settings and events (activity tracking) | | Write all files and folders stored in Box | Required for transferring a departing user's content | * **Permission scoping:** you can only connect this integration with provisioning enabled. There's no read-only mode. * For Box user APIs, both the authorizing user and the app need permission to manage users across the entire enterprise. This is another reason the connecting user must be a full Admin. Co-admins with partial user management scopes can hit authorization errors. ## Read-only access vs provisioning **Is read-only possible?** No. Box can only be connected with provisioning enabled, there's no read-only mode. **What full provisioning requires.** OAuth authorization from a Box Admin, granting `manage_managed_users`, `manage_groups`, `manage_enterprise_properties`, and write access to all files and folders (needed to transfer a departing user's content). Follow the steps below to connect and grant access as an Admin. **Watch out for.** Both the authorizing user and the app need permission to manage users across the entire enterprise, so a co-admin with only partial user-management scopes can hit authorization errors even though a full Admin would not. Box refuses to delete a user whose account still has content, so transfer their data first, Lumos does this automatically during Offboarding when Transfer Data is available. ## Instructions 1. Find the Box card in your Lumos integrations. Reconnect an existing card or add a new one. 2. *(Legacy pre-August-2025 connections only)* Choose the **Integration with Transfer Data** option. Choose **Default** only if you never want Lumos to transfer a departing user's files to another employee. Choosing Default means the data-transfer capability isn't available later. 3. Click **Connect Box**. 4. Log into Box as an Admin and authorize the requested OAuth scopes (**Grant access to Box**). ## API Endpoints Used The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them. ## Troubleshooting **"You cannot authorize Lumos" when connecting.** The Box account used isn't a Box Admin. Reconnect using an Admin account. **Delete or deprovision fails.** Box refuses to delete a user whose account still has content. Transfer the user's data to another user first. Lumos does this automatically when you choose Deprovision with Transfer Data during Offboarding. Outside offboarding, transfer manually or through an Inactivity Workflow. **"Transfer Data" option is missing when setting up a workflow.** On legacy connections, your Box admin chose **Default** instead of **Integration with Transfer Data** when connecting. Reconnect Box and choose the Transfer Data option. **Transfer Data appears to hang or time out.** Box's transfer API is synchronous and can take a long time for large accounts. Lumos times out after 5 seconds, but the request keeps running to completion on the Box side. Box admins get an email when a transfer succeeds but not when it errors, so verify completion in Box for large transfers. **Transfer fails for the receiving user.** The receiving user must have access to Relay (or Relay Lite) and to the files and folders being transferred. **Deactivated a user but the license wasn't freed.** Deactivation marks the user Inactive without reclaiming the license. Only deleting the user reclaims it.