Skip to main content

​
After this article

You will be able to connect KnowBe4 to Lumos to sync users, groups, and roles, including last user activity, for visibility and Access Reviews.

​
Capabilities

Activity tracking is supported: Lumos syncs last user activity as defined by KnowBe4’s APIs.

​
Required plan and roles

  • KnowBe4 role: the API token is created from Account Settings in the KSAT console, so the person performing setup needs admin-level access to the KnowBe4 console.
  • Token type: a Reporting API token. When creating the API key, ensure access to the Reporting API is provided.
  • Permission scoping: this is a read-only integration. Lumos syncs users, groups, and roles but doesn’t provision or deprovision anything in KnowBe4.

​
Read-only access vs provisioning

Is read-only possible? Yes. This connector is read-only in every configuration. Lumos syncs users, groups, and roles but never provisions or deprovisions anything in KnowBe4. What read-only requires. A Reporting API token, created with access to the Reporting API enabled. Follow the steps below. Watch out for. Access granted to KnowBe4 through an Entra ID group that is mastered in on-premises Active Directory can fail to provision with a Microsoft Graph error, since KnowBe4 itself never performs provisioning, the write attempt and the error both originate on the identity-provider side, not from this connector.

​
Instructions

Phase 1: Create a Reporting API token in KnowBe4
  1. In the KSAT console, click your email address in the top-right corner and select Account Settings.
  2. Go to Account Integrations → API.
  3. On the Reporting API subtab, click + Create New API Token.
  4. Name the token, make sure it is enabled, and click Create Token.
  5. Copy the token immediately. KnowBe4 only shows the full token once (afterwards only the last 10 digits are visible).
Phase 2: Connect in Lumos
  1. Find the KnowBe4 card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Provide the required fields, including the Reporting API token.
  3. Click Connect.

​
API Endpoints Used

​
Troubleshooting

Connection fails with a valid-looking token. Confirm the token was created on the Reporting API subtab (not another API type) and is still enabled in Account Settings → Account Integrations → API. Syncs are slow or intermittently delayed. KnowBe4 enforces API rate limits, and Lumos throttles its requests to stay within them, so large accounts can take longer to sync. This is expected behavior, not an error. Provisioning to KnowBe4 fails on an “Add to Group” step with Request_BadRequest mentioning “on-premises mastered” objects. This error comes from Microsoft Graph (Microsoft 365 / Entra ID), not from KnowBe4. KnowBe4 access is being granted via an Entra ID group that is mastered in on-premises Active Directory, and Microsoft blocks cloud-side writes to on-prem-mastered objects. Either add the user to the group in on-premises AD (it syncs up to Entra), or create a cloud-only Entra ID group for that access and point the Lumos workflow at it. The native KnowBe4 connector itself is read-only and never performs provisioning.