> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Front

## After this article

You will be able to connect Front to Lumos to sync Front users and their roles, and to suspend or deprovision Front users from Lumos workflows.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | No | User accounts |
| Roles | Permission | Yes | No | Whether the user is a Front **Admin** or **Member** |

| AppStore | Offboarding | Access Reviews | License Management |
| - | - | - | - |
| No | Yes | Yes | Yes |

| Deprovisioning Action | Type | Description |
| - | - | - |
| Suspend | User | Disables the user's account in Front (sets the `active` attribute to `false`), preventing login and reclaiming a license. Lumos account status becomes **Deprovisioned** |
| Deprovision | User | Permanently removes the user **and their data** from Front and reclaims the license. Lumos account status becomes **Deprovisioned** |

Front user status maps to Lumos account status: `active` → Active, `inactive` → Deprovisioned, deleted (Front no longer returns the user) → Deprovisioned. Note that both suspend and deprovision result in a **Deprovisioned** status in Lumos.

## Required plan and roles

* **Front plan:** at least the **Front Scale plan** is required. SCIM must be available and **enabled** in your Front instance.
* **Front role:** the connecting Front user must be a **Company Admin**.
* **Authentication:** a Front **SCIM bearer token**. The token grants user management through Front's SCIM API, which Lumos uses for both sync and the suspend/deprovision actions. There's no read-only token variant for this connector.

## Read-only access vs provisioning

**Is read-only possible?** No. Front connects with a single SCIM bearer token that grants the same user-management access Lumos uses for both sync and the suspend/deprovision actions. There's no read-only token variant for this connector.

**What full provisioning requires.** The same Front Scale-plan (or higher) SCIM bearer token generated by a Company Admin, entered on the connector card. It supports both syncing users and roles and the Suspend and Deprovision actions described above.

**Watch out for.** Suspend and Deprovision are only available for Offboarding, Access Reviews, and License Management workflows, not for AppStore requests. Both actions map the account to a Deprovisioned status in Lumos, even though Suspend only disables the account in Front rather than deleting it, so check which action ran before assuming a user was fully removed from Front.

## Instructions

**Phase 1: Prepare Front**

1. As a Company Admin, confirm SCIM has been enabled in Front (available on the Scale plan and above).
2. Generate a SCIM bearer token in Front and save it.
   1. Make sure to have an Enterprise subscription for Frontapp before proceeding
   2. Ensure SCIM has been enabled for your account ([ contact support](https://help.frontapp.com/category/contact-us) for this).
   3. Generate a SCIM bearer token (Team > App Integration > SCIM). This token is used to authenticate your requests.

**Phase 2: Connect in Lumos**

1. Find the Front card in your Lumos integrations (reconnect an existing card or add a new one).
2. Choose a unique identifier for this integration (e.g. `lumos-frontapp-1`) and enter it in the **App Instance Identifier** field.
3. Paste the SCIM bearer token into the **API Key** field.
4. Click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Connection fails**. Confirm your Front plan includes SCIM (Scale plan or above), that SCIM is enabled, and that the token is a SCIM bearer token generated by a Company Admin. Also make sure the **App Instance Identifier** you chose is unique.

**Suspended users show as Deprovisioned in Lumos**. This is expected: Front reports suspended users as `inactive`, and Lumos maps both `inactive` and deleted users to the **Deprovisioned** status for this integration.

**Suspend/deprovision unavailable in the AppStore context**. Suspend and deprovision are supported for Offboarding, Access Reviews, and License Management workflows only, not for AppStore requests.