Skip to main content
This article applies to Dropbox connections created after August 2025 (the Domain ID under your Lumos domain shows dropbox_ics). If your Domain ID shows dropbox.com, your connection uses the legacy pre-August-2025 OAuth setup, and the differences are noted inline below.

​
After this article

You will be able to connect Dropbox to Lumos to sync team members, their roles, and last login activity, and to provision users, suspend or remove them, transfer their files, and revoke their sessions during offboarding.

​
Capabilities

Deprovisioning actions are available via Offboarding, Access Reviews, and License Management, not via AppStore. User status mapping (from profile.status.tag): active maps to Active, suspended maps to Suspended, and removed or no longer returned by Dropbox maps to Deprovisioned. Last login: derived from login_success events in the team activity log. On first sync Lumos checks the previous 90 days, and each subsequent sync reads events since the last sync. A blank value means the user hadn’t logged in within 90 days before the integration was connected.

​
Required plan and roles

  • Dropbox plan: a Dropbox Business or Enterprise subscription is required for full functionality. The connector uses the Dropbox Business (team) API, which free accounts do not have.
  • Dropbox role: log in with a team admin account when authorizing the connection.
  • App scopes (added to your app in the Dropbox Developer Portal). These seven are the full set the integration requests:
    • team_info.read: basic team info (names, user count, team settings), used to validate credentials
    • members.read: read team membership, used for account sync, role entitlements, and entitlement associations
    • events.read: team activity logs, used for last-login tracking
    • members.write: manage team membership (create, suspend/unsuspend, role changes, data transfer)
    • members.delete: remove and recover team members’ accounts
    • sessions.list: list a member’s linked apps and device sessions, used by Release Resources
    • sessions.modify: revoke linked apps and device sessions, used by Release Resources
  • Read-only option: for a sync-only connection, add just team_info.read, members.read, and events.read.
  • Scopes you may see elsewhere: account_info.read and team_data.member appear in some Dropbox app permission guidance, but this integration does not request them and no capability depends on them. Adding them does no harm and omitting them does not break sync.
  • Legacy (dropbox.com) connections: these use the Lumos OAuth app and there’s nothing to configure in the Developer Portal, so the scope choices above do not apply.

​
Read-only access vs provisioning

Is read-only possible? Yes. Dropbox’s OAuth scopes split cleanly into read and write, and every scope the integration uses for syncing is a read scope, so a connection can be limited to visibility only. What read-only requires. In the Dropbox Developer Portal app, add only the team_info.read, members.read, and events.read scopes, then follow the steps below. Those three cover credential validation, account and role sync, entitlement associations, and last login. This option only applies to connections created after August 2025 (Domain ID dropbox_ics). What full provisioning requires. The same Developer Portal app with the write scopes added on top: members.write for creating accounts, suspending and unsuspending them, changing roles, and transferring data, members.delete for removing accounts, and sessions.list plus sessions.modify for Release Resources. You also need a Dropbox Business or Enterprise subscription and a team admin account to authorize the connection. Watch out for. sessions.list is not a sync scope. It is paired with sessions.modify for the Release Resources offboarding action, so leave both off if you want a read-only connection and add both if you want that action. Legacy connections (Domain ID shows dropbox.com) use the Lumos OAuth app, which has no read-only option and nothing to configure in the Developer Portal. Moving from read-only to full provisioning on a dropbox_ics connection means adding the missing scopes to your Developer Portal app and reconnecting, since a connection set up with only the read scopes will fail on write actions until you do.

​
Instructions

Phase 1: Create an app in the Dropbox Developer Portal Legacy (dropbox.com) connections skip this phase. Go straight to Phase 2 and complete the OAuth flow.
  1. In the Dropbox Developer Portal, create a new app.
  2. Copy the App Key and App Secret. These are the Client ID and Client Secret values for Lumos.
  3. On the app’s Permissions tab, add the required scopes: events.read, members.delete, members.read, members.write, sessions.list, sessions.modify, team_info.read (or the sync-only subset above: team_info.read, members.read, events.read).
  4. Add the redirect URI https://app.lumosidentity.com/integrations/ics_oauth2_callback.
Phase 2: Connect in Lumos
  1. In Lumos, go to Settings → Integrations → Dropbox (reconnect an existing card or add a new one).
  2. Enter the Client ID (App Key) and Client Secret (App Secret).
  3. Click Connect, log in with a Dropbox admin account, approve the requested permissions, and confirm the connection.

​
API Endpoints Used

​
Troubleshooting

Connection fails or team endpoints return errors. The connector requires the Dropbox Business API, and free or individual Dropbox accounts cannot connect. Confirm your Business/Enterprise subscription and that you authorized with a team admin account. Provisioning or deprovisioning fails on a read-only connection. Write actions need members.write (create, suspend, unsuspend, role change, transfer data), members.delete (remove), and sessions.list plus sessions.modify (Release Resources) on the Developer Portal app. Add the scopes and reconnect. A suspended user still consumes a license. Suspend (Deactivate) does not reclaim the license. Only Delete (removal from the team) does. A user was removed by mistake. Removed Dropbox accounts are recoverable for 7 days, or until they are permanently deleted or their data is transferred, whichever comes first. Last Login is blank for some users. Lumos only sees successful logins from the last 90 days before the integration was first connected. Users with no logins in that window show no value until they next log in.