> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CrowdStrike

*This article covers both CrowdStrike connectors. The standard connector is read-only. The **CrowdStrike (Multi-Auth)** connector uses the same Falcon API client credentials and adds provisioning.*

<Note>
  The CrowdStrike (Multi-Auth) connector is in Early Access. Contact your Lumos team to have it enabled for your domain.
</Note>

## After this article

You'll be able to connect CrowdStrike to Lumos for visibility and Access Reviews, and, with the CrowdStrike (Multi-Auth) connector, to provision Falcon users and their roles from Lumos.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | Yes (Multi-Auth only) | Falcon user accounts. The Multi-Auth connector can create and manage them |
| Roles | Permission | Yes | Yes (Multi-Auth only) | Falcon roles and the users holding them. The Multi-Auth connector can assign and unassign roles |

### Activity Tracking

Status: Supported. Lumos reads the last login for each Falcon user. Last login is the only activity signal available from CrowdStrike.

## Required plan and roles

* **CrowdStrike access:** you'll need credentials from your CrowdStrike Falcon environment to authorize the connection.
* **For provisioning (Multi-Auth connector):** the API client also needs the **User Management: Write** scope.

## Read-only access vs provisioning

**Is read-only possible?** Yes. The standard CrowdStrike connector is read-only: it reads users, the roles they hold, and their last login. The CrowdStrike (Multi-Auth) connector adds provisioning; connect it with read scopes only to keep it read-only.

**What read-only requires.** An API client created in the Falcon console under **Support** > **API Clients and Keys** > **Add new API client**, with the **read** scopes for **User Management** and **API Integrations** enabled. Creating it generates a Client ID and a Client Secret, and the same screen shows your API base URL. Enter all three on the connection card and follow the steps below.

**What full provisioning requires.** The CrowdStrike (Multi-Auth) connector with an API client that has the read scopes above plus the **User Management: Write** scope.

**Watch out for.** Check three things on the credential. The Client Secret is shown only once when you create the API client, so capture it then. The API base URL belongs in its own field and is not the Client ID, which is a 32-character alphanumeric string rather than a URL or hostname. The base URL must also match the CrowdStrike cloud your tenant runs in. You can find the cloud in the subdomain of your Falcon console address. Use the plain `api.crowdstrike.com` address when there is no region subdomain. On the standard connector, granting scopes beyond the two read scopes above does not add any capability in Lumos; provisioning requires the CrowdStrike (Multi-Auth) connector with the **User Management: Write** scope.

## Instructions

**Phase 1: Connect in Lumos**

1. Find the CrowdStrike card in your Lumos integrations.
2. Enter the credentials shown on the connection card.
3. Click **Connect**.

## Troubleshooting

**Connection fails.** Confirm the credentials you entered are valid in your CrowdStrike Falcon environment and haven't been revoked, then reconnect.

**Connection fails with a message naming a different API base URL.** Your Falcon tenant lives in another CrowdStrike cloud. Enter the base URL from the message in the **API base URL** field and connect again. On the CrowdStrike (Multi-Auth) connector this check runs when you click **Connect**, so the mismatch is caught before the connection is saved.