Skip to main content

​
After this article

You’ll be able to connect Kandji to Lumos to sync users, groups, and managed devices for visibility and Access Reviews.

​
Capabilities

​
Required plan and roles

  • Kandji role: an administrator in Kandji. You need admin privileges to reach the API Token settings and create tokens.
  • Required API permissions: the token must include at minimum List Users to read user information and List Devices to read managed device information.
  • Permission scoping: this is a read-only integration. Lumos syncs users, groups, and devices but does not provision or deprovision anything in Kandji.

​
Read-only access vs provisioning

Is read-only possible? Yes. This connector is read-only in every configuration. Lumos syncs users, groups, and devices but does not provision or deprovision anything in Kandji. What read-only requires. An API token scoped to at least List Users and List Devices (a full-access token also works), plus your client subdomain and region. Follow the steps below. Watch out for. If you use Kandji SCIM, you also need the separate SCIM API token for that field. A token missing either List Users or List Devices causes an “Insufficient permissions” error during setup.

​
Instructions

Phase 1: Create API tokens in Kandji
  1. In Kandji, create an API token with at least the List Users and List Devices permissions. A full-access token also works. Copy the token.
  2. If you use Kandji SCIM, also copy your SCIM API token.
  3. Note your client subdomain, the subdomain only, without https:// or .kandji.io.
  4. Note your Kandji region.
Phase 2: Connect in Lumos
  1. Find the Kandji card in your Lumos integrations. Reconnect an existing card or add a new one.
  2. Provide the Token, Region, SCIM API Token, and Client Subdomain.
  3. Click Connect.

​
API Endpoints Used

​
Troubleshooting

“Authentication failed” when connecting. Verify the API token is correct and hasn’t been revoked or expired. Make sure it has full access or all required permissions. Check the subdomain is entered without https:// or .kandji.io. If it still fails, regenerate the token. “Insufficient permissions” during setup. Confirm you have admin privileges in Kandji and that your account can reach the API Token settings. Verify the token includes read permissions for devices and users, or create a new token with full access. Devices not syncing. Confirm the integration shows Connected in Lumos. Verify the devices are enrolled and actively managed in Kandji and have checked in recently. Make sure the token can read device information. Contact Lumos support if devices still don’t appear. Device information is outdated. Check the device’s last check-in time and trigger a manual check-in. Verify the device is online and confirm its enrollment status. Wait for the next scheduled sync. Missing device details or security settings. Verify the device completed initial enrollment and that required profiles were deployed. Review Kandji blueprint assignments. Wait for the next inventory update.