Skip to main content

​
After this article

You will be able to connect Front to Lumos to sync Front users and their roles, and to suspend or deprovision Front users from Lumos workflows.

​
Capabilities

Front user status maps to Lumos account status: active → Active, inactive → Deprovisioned, deleted (Front no longer returns the user) → Deprovisioned. Note that both suspend and deprovision result in a Deprovisioned status in Lumos.

​
Required plan and roles

  • Front plan: at least the Front Scale plan is required. SCIM must be available and enabled in your Front instance.
  • Front role: the connecting Front user must be a Company Admin.
  • Authentication: a Front SCIM bearer token. The token grants user management through Front’s SCIM API, which Lumos uses for both sync and the suspend/deprovision actions. There’s no read-only token variant for this connector.

​
Read-only access vs provisioning

Is read-only possible? No. Front connects with a single SCIM bearer token that grants the same user-management access Lumos uses for both sync and the suspend/deprovision actions. There’s no read-only token variant for this connector. What full provisioning requires. The same Front Scale-plan (or higher) SCIM bearer token generated by a Company Admin, entered on the connector card. It supports both syncing users and roles and the Suspend and Deprovision actions described above. Watch out for. Suspend and Deprovision are only available for Offboarding, Access Reviews, and License Management workflows, not for AppStore requests. Both actions map the account to a Deprovisioned status in Lumos, even though Suspend only disables the account in Front rather than deleting it, so check which action ran before assuming a user was fully removed from Front.

​
Instructions

Phase 1: Prepare Front
  1. As a Company Admin, confirm SCIM has been enabled in Front (available on the Scale plan and above).
  2. Generate a SCIM bearer token in Front and save it.
    1. Make sure to have an Enterprise subscription for Frontapp before proceeding
    2. Ensure SCIM has been enabled for your account ( contact support for this).
    3. Generate a SCIM bearer token (Team > App Integration > SCIM). This token is used to authenticate your requests.
Phase 2: Connect in Lumos
  1. Find the Front card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Choose a unique identifier for this integration (e.g. lumos-frontapp-1) and enter it in the App Instance Identifier field.
  3. Paste the SCIM bearer token into the API Key field.
  4. Click Connect.

​
API Endpoints Used

​
Troubleshooting

Connection fails. Confirm your Front plan includes SCIM (Scale plan or above), that SCIM is enabled, and that the token is a SCIM bearer token generated by a Company Admin. Also make sure the App Instance Identifier you chose is unique. Suspended users show as Deprovisioned in Lumos. This is expected: Front reports suspended users as inactive, and Lumos maps both inactive and deleted users to the Deprovisioned status for this integration. Suspend/deprovision unavailable in the AppStore context. Suspend and deprovision are supported for Offboarding, Access Reviews, and License Management workflows only, not for AppStore requests.