> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# LastPass

## After this article

You will be able to connect LastPass to Lumos to sync users, admin roles, and last-login activity, and to provision, suspend, and deprovision LastPass users from Lumos.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | Yes | User accounts. Lumos can create, suspend, and delete users |
| Role | Permission | Yes | No | Whether the user is a LastPass Admin (derived from the `admin` field) |

**Account status mapping** (derived from the `disabled` and `neverloggedin` fields via `api_get_user_data`):

| LastPass state | Lumos status |
| - | - |
| Not disabled and has logged in | Active |
| Disabled | Suspended |
| Never logged in | Staged |
| Deleted (LastPass no longer returns the user) | Deprovisioned |

**Last Login** is synced from the LastPass `last_login` field and represents the last time the user logged into LastPass.

| Provisioning action | Used by | What happens in LastPass |
| - | - | - |
| Provision | AppStore | Creates a non-admin user from email/first name/last name via `api_add_users` with `password_reset_required: true`. The user must reset their password on first login. Consumes a license. Lumos user data updates on the next LastPass sync. |
| Suspend | Offboarding, Access Reviews, License Management | Deactivates the user via `api_delete_user` with `deleteaction: 0`, login is blocked but their data and LastPass Business membership are retained. Does **not** reclaim a license. Lumos marks the account **Suspended**. |
| Deprovision | Offboarding, Access Reviews, License Management | Permanently removes the user and their data via `api_delete_user` with `deleteaction: 2`. Reclaims a license. Lumos marks the account **Deprovisioned**. |

## Required plan and roles

* **LastPass plan:** your organization must be on the **LastPass Business** plan.
* **LastPass role:** the connecting LastPass user must be a **Super Admin**.
* **Credentials:** the integration authenticates with your **Account Number (CID)** and **Provisioning Hash** (also called the API secret). The provisioning hash grants full Enterprise API access, there is no scoped or read-only variant. Lumos uses it both to read user data and to add, deactivate, and remove users.

## Read-only access vs provisioning

**Is read-only possible?** No. The Provisioning Hash grants full Enterprise API access with no scoped or read-only variant, so any connection can create, suspend, and delete users.

**What full provisioning requires.** Your **Account Number (CID)** and **Provisioning Hash**, retrieved by a **Super Admin** on the **LastPass Business** plan from the Admin Console's **Advanced → Enterprise API** page. Follow the steps below.

**Watch out for.** Regenerating the provisioning hash invalidates the old one for any other tool using it, so coordinate before rotating it. Suspend deactivates a user but does not reclaim their license, only Deprovision does. If LastPass shows up twice in your app inventory (an Okta-sourced bookmark plus this direct integration), don't merge the sources, since merging is not self-serve and has to be undone by Lumos Support.

## Instructions

**Phase 1: Retrieve your CID and Provisioning Hash in LastPass**

1. Log into the LastPass Admin Console at [admin.lastpass.com](https://admin.lastpass.com) as a Super Admin.
2. On the **Dashboard** tab, copy your **Account number** (CID) shown at the top of the page.
3. Go to **Advanced** → **Enterprise API**.
4. If you have not previously created a provisioning hash, click **Create provisioning hash** → **OK**. The provisioning hash is shown at the top of the page, copy it. (Regenerating the hash invalidates the old one for any other tools using it.)

**Phase 2: Connect in Lumos**

1. Find the LastPass card in your Lumos integrations (reconnect an existing card or add a new one).
2. Enter your LastPass CID in the **Account Number (CID)** field.
3. Enter your LastPass Provisioning Hash in the **Provisioning Hash (API Key)** field.
4. Click **Connect LastPass**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Connection fails.** Confirm the CID matches the **Account number** on the Admin Console Dashboard and that the provisioning hash is the current one from **Advanced → Enterprise API**. If the hash was regenerated since you last copied it, the old value no longer works.

**Suspended a user but the license count didn't drop.** Expected: Suspend deactivates the user but retains their membership and does not reclaim a license. Use **Deprovision** to permanently remove the user and reclaim the license.

**A provisioned user doesn't appear in Lumos immediately.** Provisioning has no impact on Lumos user data until the next LastPass user sync completes.

**LastPass appears twice in your app inventory (direct integration plus an IdP-sourced instance) and the sources were merged prematurely.** Merged app sources can be unmerged so each source becomes its own application again (useful for user access reviews). This is performed by Lumos Support on request. It is not self-serve.

**Two LastPass apps appear in Lumos.** One is an Okta-sync **bookmark** app; the other is the **direct** integration (`lastpass.com`) that syncs users, status, last login, and entitlements. To auto-deprovision on Okta deactivation, use an Auto-Offboarding workflow with the *Immediately After Deactivation* trigger.