> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Dropbox

> This article applies to Dropbox connections created **after August 2025** (the Domain ID under your Lumos domain shows `dropbox_ics`). If your Domain ID shows `dropbox.com`, your connection uses the legacy pre-August-2025 OAuth setup, and the differences are noted inline below.

## After this article

You will be able to connect Dropbox to Lumos to sync team members, their roles, and last login activity, and to provision users, suspend or remove them, transfer their files, and revoke their sessions during offboarding.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | Yes | Team member account records |
| Roles | Permission | Yes | Yes | Whether the user is a Team Admin or Member (from the member's `role` field) |

| Deprovisioning Action | Type | Description |
| - | - | - |
| Deactivate | User | Suspends the account and deletes the user's data on linked devices (not in the cloud). Does **not** reclaim a license. |
| Delete | User | Removes the user from your team and reclaims a license. Removed accounts are recoverable for 7 days (or until permanently deleted/transferred). |
| Transfer Data | User | Transfers all of the removed user's files to another member. Only available when choosing Deprovision during Offboarding. If the transfer fails, Lumos still continues deprovisioning. |
| Release Resources | User | Signs the user out of all web, mobile, and desktop sessions and revokes all of their linked apps (not team-linked apps). Offboarding only. |

Deprovisioning actions are available via Offboarding, Access Reviews, and License Management, not via AppStore.

**User status mapping** (from `profile.status.tag`): `active` maps to Active, `suspended` maps to Suspended, and `removed` or no longer returned by Dropbox maps to Deprovisioned.

**Last login:** derived from `login_success` events in the team activity log. On first sync Lumos checks the previous 90 days, and each subsequent sync reads events since the last sync. A blank value means the user hadn't logged in within 90 days before the integration was connected.

## Required plan and roles

* **Dropbox plan:** a **Dropbox Business or Enterprise** subscription is required for full functionality. The connector uses the Dropbox Business (team) API, which free accounts do not have.
* **Dropbox role:** log in with a **team admin** account when authorizing the connection.
* **App scopes** (added to your app in the Dropbox Developer Portal). These seven are the full set the integration requests:
  * `team_info.read`: basic team info (names, user count, team settings), used to validate credentials
  * `members.read`: read team membership, used for account sync, role entitlements, and entitlement associations
  * `events.read`: team activity logs, used for last-login tracking
  * `members.write`: manage team membership (create, suspend/unsuspend, role changes, data transfer)
  * `members.delete`: remove and recover team members' accounts
  * `sessions.list`: list a member's linked apps and device sessions, used by Release Resources
  * `sessions.modify`: revoke linked apps and device sessions, used by Release Resources
* **Read-only option:** for a sync-only connection, add just `team_info.read`, `members.read`, and `events.read`.
* **Scopes you may see elsewhere:** `account_info.read` and `team_data.member` appear in some Dropbox app permission guidance, but this integration does not request them and no capability depends on them. Adding them does no harm and omitting them does not break sync.
* **Legacy (`dropbox.com`) connections:** these use the Lumos OAuth app and there's nothing to configure in the Developer Portal, so the scope choices above do not apply.

## Read-only access vs provisioning

**Is read-only possible?** Yes. Dropbox's OAuth scopes split cleanly into read and write, and every scope the integration uses for syncing is a read scope, so a connection can be limited to visibility only.

**What read-only requires.** In the Dropbox Developer Portal app, add only the `team_info.read`, `members.read`, and `events.read` scopes, then follow the steps below. Those three cover credential validation, account and role sync, entitlement associations, and last login. This option only applies to connections created after August 2025 (Domain ID `dropbox_ics`).

**What full provisioning requires.** The same Developer Portal app with the write scopes added on top: `members.write` for creating accounts, suspending and unsuspending them, changing roles, and transferring data, `members.delete` for removing accounts, and `sessions.list` plus `sessions.modify` for Release Resources. You also need a Dropbox Business or Enterprise subscription and a team admin account to authorize the connection.

**Watch out for.** `sessions.list` is not a sync scope. It is paired with `sessions.modify` for the Release Resources offboarding action, so leave both off if you want a read-only connection and add both if you want that action. Legacy connections (Domain ID shows `dropbox.com`) use the Lumos OAuth app, which has no read-only option and nothing to configure in the Developer Portal. Moving from read-only to full provisioning on a `dropbox_ics` connection means adding the missing scopes to your Developer Portal app and reconnecting, since a connection set up with only the read scopes will fail on write actions until you do.

## Instructions

**Phase 1: Create an app in the Dropbox Developer Portal**

*Legacy (`dropbox.com`) connections skip this phase. Go straight to Phase 2 and complete the OAuth flow.*

1. In the [Dropbox Developer Portal](https://www.dropbox.com/developers), create a new app.
2. Copy the **App Key** and **App Secret**. These are the **Client ID** and **Client Secret** values for Lumos.
3. On the app's **Permissions** tab, add the required scopes: `events.read`, `members.delete`, `members.read`, `members.write`, `sessions.list`, `sessions.modify`, `team_info.read` (or the sync-only subset above: `team_info.read`, `members.read`, `events.read`).
4. Add the redirect URI `https://app.lumosidentity.com/integrations/ics_oauth2_callback`.

**Phase 2: Connect in Lumos**

1. In Lumos, go to **Settings → Integrations → Dropbox** (reconnect an existing card or add a new one).
2. Enter the **Client ID** (App Key) and **Client Secret** (App Secret).
3. Click **Connect**, log in with a Dropbox admin account, approve the requested permissions, and confirm the connection.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Connection fails or team endpoints return errors**. The connector requires the Dropbox Business API, and free or individual Dropbox accounts cannot connect. Confirm your Business/Enterprise subscription and that you authorized with a team admin account.

**Provisioning or deprovisioning fails on a read-only connection**. Write actions need `members.write` (create, suspend, unsuspend, role change, transfer data), `members.delete` (remove), and `sessions.list` plus `sessions.modify` (Release Resources) on the Developer Portal app. Add the scopes and reconnect.

**A suspended user still consumes a license**. Suspend (Deactivate) does not reclaim the license. Only Delete (removal from the team) does.

**A user was removed by mistake**. Removed Dropbox accounts are recoverable for 7 days, or until they are permanently deleted or their data is transferred, whichever comes first.

**Last Login is blank for some users**. Lumos only sees successful logins from the last 90 days before the integration was first connected. Users with no logins in that window show no value until they next log in.