> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Delinea Secret Server Cloud

*Lumos supports 2 integrations for Delinea Secret Server: **Delinea Secret Server** (on-premise, via the Lumos on-premise agent, read-only) and **Delinea Secret Server (Cloud)** (covered in this article), which connects directly and supports provisioning.*

## After this article

You will be able to connect Delinea Secret Server Cloud to Lumos to sync users, secret permissions, user groups, and user roles, and to provision and deprovision access.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | Yes | User account records. Lumos can create, deactivate, reactivate, and delete users |
| Secret Permissions | Permission | Yes | Yes | Permissions on secrets and folders. Lumos can grant and revoke them at a specific access level |
| User Groups | Permission | Yes | Yes | Groups in Delinea. Lumos can add and remove members |
| User Roles | Permission | Yes | Yes | Roles in Delinea. Lumos can assign and remove them |

**Provisioning behavior:**

* **Create:** requires a username, password, display name, and email. Lumos first searches Delinea for the username (the lookup also matches display name and email). If a matching user already exists, Lumos links that account instead of creating a duplicate. New users are created enabled.
* **Secret and folder permissions:** Lumos grants access at the access level encoded in the entitlement (for example View or Edit). Folder grants set the same level for the folder and the secrets inside it. When revoking, Lumos looks up the permission record first. If it's already gone, the revoke is a safe no-op.
* **Groups and roles:** Lumos adds or removes the user directly on the user's group and role lists.
* **Reactivate:** Lumos re-enables a deactivated user by setting `enabled` back to true.

| Deprovisioning Action | Type | Description |
| - | - | - |
| Deactivate | User | Sets `enabled` to false for the user |
| Delete | User | Hard deletes the user. Lumos checks the user still exists first, so deleting an already-deleted user returns success |

## Required plan and roles

* **Availability:** this integration is in **Early Access**. Reach out to Lumos support to enable it for your tenant.
* **Delinea account:** a dedicated **service user**, authenticated via the OAuth2 password grant flow (Lumos exchanges the username/password for API access tokens).
* **Secret Server role permissions** (assign a role with all of these to the service user):
  * **Administer Users**: sync and provision user accounts
  * **Administer Groups**: sync and provision group membership
  * **Administer Role Assignment**: sync and provision role assignments
  * **Administer Folders**: read folder structure for secret permissions
  * **View Secret**: read secrets for permission sync
  * **Bypass Direct API Authentication Restriction**: required for non-interactive API login
* **Folder access:** the service user needs **Owner** access on the Root Folder, propagated to all subfolders and secrets.
* **Permission scoping:** this connector provisions as well as syncs, so the Administer permissions above are required. There is no read-only variant of the Cloud connector (use the on-premise integration for read-only).
* **Product scope:** this connector works with Delinea **Secret Server Cloud** (Delinea's classic PAM). The newer **Delinea Platform** identity-security product is not supported.

## Instructions

**Phase 1: Create the service user in Delinea**

1. In the Platform UI, go to **Access → Users**, click **More** (top-right) → **Add service user**. Fill in the **Username**, **Display name**, and **Set password** fields, assign the user to the appropriate group, and save.
2. In Secret Server, go to **Admin → Roles** and create a role with these permissions: **Administer Users**, **Administer Groups**, **Administer Role Assignment**, **Administer Folders**, **View Secret**, and **Bypass Direct API Authentication Restriction**. Assign this role to the service user.
3. On the **Root Folder → Permissions** tab, add the service user with **Owner** access and select **Set permissions on all subfolders** and **Set permissions on all secrets**.

**Phase 2: Connect in Lumos**

1. Find the Delinea Secret Server (Cloud) card in your Lumos integrations (Early Access, contact support if you don't see it).
2. Enter the **Account Name** (your unique identifier, e.g. your company or environment name), the service user's **Username**, and its **Password**.
3. Click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**"Failed to connect" even though users synced.** A connection failure reported after a successful user sync usually means the entitlement (folder/secret permission) sync step failed, not the credentials. This was historically a connector-side defect in the folder-permissions call (since fixed, with no customer configuration change required). If it recurs, verify the service user's role permissions and Root Folder Owner access, then contact Lumos support.

**API login fails for the service user.** Ensure the role assigned to the service user includes **Bypass Direct API Authentication Restriction**. Without it, non-interactive API login is blocked.

**You are on Delinea Platform.** The connector supports Secret Server Cloud only. Delinea Platform is not supported, even where connector wording may hint at it.

**Secret permissions missing from sync.** Confirm the Root Folder Owner permission was propagated with both **Set permissions on all subfolders** and **Set permissions on all secrets** selected.