> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# KnowBe4

## After this article

You will be able to connect KnowBe4 to Lumos to sync users, groups, and roles, including last user activity, for visibility and Access Reviews.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | No | User accounts |
| Groups | Permission | Yes | No | Groups in KnowBe4 |
| Roles | Permission | Yes | No | Roles in KnowBe4 |

Activity tracking is supported: Lumos syncs last user activity as defined by KnowBe4's APIs.

## Required plan and roles

* **KnowBe4 role:** the API token is created from **Account Settings** in the KSAT console, so the person performing setup needs admin-level access to the KnowBe4 console.
* **Token type:** a **Reporting API** token. When creating the API key, ensure access to the Reporting API is provided.
* **Permission scoping:** this is a **read-only** integration. Lumos syncs users, groups, and roles but doesn't provision or deprovision anything in KnowBe4.

## Read-only access vs provisioning

**Is read-only possible?** Yes. This connector is read-only in every configuration. Lumos syncs users, groups, and roles but never provisions or deprovisions anything in KnowBe4.

**What read-only requires.** A **Reporting API** token, created with access to the Reporting API enabled. Follow the steps below.

**Watch out for.** Access granted to KnowBe4 through an Entra ID group that is mastered in on-premises Active Directory can fail to provision with a Microsoft Graph error, since KnowBe4 itself never performs provisioning, the write attempt and the error both originate on the identity-provider side, not from this connector.

## Instructions

**Phase 1: Create a Reporting API token in KnowBe4**

1. In the KSAT console, click your email address in the top-right corner and select **Account Settings**.
2. Go to **Account Integrations** → **API**.
3. On the **Reporting API** subtab, click **+ Create New API Token**.
4. Name the token, make sure it is enabled, and click **Create Token**.
5. Copy the token immediately. KnowBe4 only shows the full token once (afterwards only the last 10 digits are visible).

**Phase 2: Connect in Lumos**

1. Find the KnowBe4 card in your Lumos integrations (reconnect an existing card or add a new one).
2. Provide the required fields, including the Reporting API token.
3. Click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Connection fails with a valid-looking token.** Confirm the token was created on the **Reporting API** subtab (not another API type) and is still enabled in **Account Settings → Account Integrations → API**.

**Syncs are slow or intermittently delayed.** KnowBe4 enforces API rate limits, and Lumos throttles its requests to stay within them, so large accounts can take longer to sync. This is expected behavior, not an error.

**Provisioning to KnowBe4 fails on an "Add to Group" step with `Request_BadRequest` mentioning "on-premises mastered" objects.** This error comes from Microsoft Graph (Microsoft 365 / Entra ID), not from KnowBe4. KnowBe4 access is being granted via an Entra ID group that is mastered in on-premises Active Directory, and Microsoft blocks cloud-side writes to on-prem-mastered objects. Either add the user to the group in on-premises AD (it syncs up to Entra), or create a cloud-only Entra ID group for that access and point the Lumos workflow at it. The native KnowBe4 connector itself is read-only and never performs provisioning.