Skip to main content

​
After this article

You will be able to connect LastPass to Lumos to sync users, admin roles, and last-login activity, and to provision, suspend, and deprovision LastPass users from Lumos.

​
Capabilities

Account status mapping (derived from the disabled and neverloggedin fields via api_get_user_data): Last Login is synced from the LastPass last_login field and represents the last time the user logged into LastPass.

​
Required plan and roles

  • LastPass plan: your organization must be on the LastPass Business plan.
  • LastPass role: the connecting LastPass user must be a Super Admin.
  • Credentials: the integration authenticates with your Account Number (CID) and Provisioning Hash (also called the API secret). The provisioning hash grants full Enterprise API access, there is no scoped or read-only variant. Lumos uses it both to read user data and to add, deactivate, and remove users.

​
Read-only access vs provisioning

Is read-only possible? No. The Provisioning Hash grants full Enterprise API access with no scoped or read-only variant, so any connection can create, suspend, and delete users. What full provisioning requires. Your Account Number (CID) and Provisioning Hash, retrieved by a Super Admin on the LastPass Business plan from the Admin Console’s Advanced → Enterprise API page. Follow the steps below. Watch out for. Regenerating the provisioning hash invalidates the old one for any other tool using it, so coordinate before rotating it. Suspend deactivates a user but does not reclaim their license, only Deprovision does. If LastPass shows up twice in your app inventory (an Okta-sourced bookmark plus this direct integration), don’t merge the sources, since merging is not self-serve and has to be undone by Lumos Support.

​
Instructions

Phase 1: Retrieve your CID and Provisioning Hash in LastPass
  1. Log into the LastPass Admin Console at admin.lastpass.com as a Super Admin.
  2. On the Dashboard tab, copy your Account number (CID) shown at the top of the page.
  3. Go to Advanced → Enterprise API.
  4. If you have not previously created a provisioning hash, click Create provisioning hash → OK. The provisioning hash is shown at the top of the page, copy it. (Regenerating the hash invalidates the old one for any other tools using it.)
Phase 2: Connect in Lumos
  1. Find the LastPass card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Enter your LastPass CID in the Account Number (CID) field.
  3. Enter your LastPass Provisioning Hash in the Provisioning Hash (API Key) field.
  4. Click Connect LastPass.

​
API Endpoints Used

​
Troubleshooting

Connection fails. Confirm the CID matches the Account number on the Admin Console Dashboard and that the provisioning hash is the current one from Advanced → Enterprise API. If the hash was regenerated since you last copied it, the old value no longer works. Suspended a user but the license count didn’t drop. Expected: Suspend deactivates the user but retains their membership and does not reclaim a license. Use Deprovision to permanently remove the user and reclaim the license. A provisioned user doesn’t appear in Lumos immediately. Provisioning has no impact on Lumos user data until the next LastPass user sync completes. LastPass appears twice in your app inventory (direct integration plus an IdP-sourced instance) and the sources were merged prematurely. Merged app sources can be unmerged so each source becomes its own application again (useful for user access reviews). This is performed by Lumos Support on request. It is not self-serve. Two LastPass apps appear in Lumos. One is an Okta-sync bookmark app; the other is the direct integration (lastpass.com) that syncs users, status, last login, and entitlements. To auto-deprovision on Okta deactivation, use an Auto-Offboarding workflow with the Immediately After Deactivation trigger.