> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Monday.com (Enterprise)

*This doc covers the Enterprise-plan Monday.com connector. The tile reads "Monday (Enterprise)". The Enterprise plan is required. For non-Enterprise plans, use [Monday.com (Basic)](/integrations/library/monday-com/monday-com-basic).*

## After this article

You'll be able to connect the Enterprise Monday.com integration to Lumos, sync users, teams, roles, and team memberships, and provision or deprovision users through the SCIM API.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | Yes | Users. Lumos can create, deactivate, and reactivate accounts through SCIM |
| Teams | Permission | Yes | No | Teams |
| Roles | Permission | Yes | Yes (assign only) | Account roles (admin, member, viewer, guest). Lumos assigns a role by replacing the user's current one, and roles can't be removed, only replaced |
| Team Membership | Permission | Yes | Yes | Team memberships for users. Lumos adds and removes team members |

**Provisioning behavior:**

* **Create:** Lumos creates the user through SCIM (`POST /Users`) with the email as the username plus the given and family name. All three fields are required. New users are created active. Roles and team memberships can't be included in the create request, so Lumos assigns them afterward.
* **Assign a role:** Lumos replaces the user's `userType` with the requested role (admin, member, viewer, or guest). A user holds exactly one role, so assigning a role replaces the previous one, and a role can't be unassigned on its own.
* **Team membership:** Lumos adds the user to a team with a SCIM `add` operation on the group, and removes them with a `remove` operation.
* **Deactivate and reactivate:** Lumos flips the SCIM `active` flag, so reactivating a deactivated account is supported.

| Deprovisioning Action | Type | Description |
| - | - | - |
| Deactivate | User | Deactivate a user by changing the "active" property. Lumos can also reactivate the account later |

**User status mapping**

| Monday.com user status | Lumos account status |
| - | - |
| active | Active |
| inactive | Suspended |

The user sync includes inactive users, so deactivated accounts stay visible in Lumos as Suspended.

**Activity tracking:** supported (Last Activity and Last Login). Lumos reads last activity from the GraphQL `users` query, and last login events from the `audit_logs` query. The `audit_logs` query requires the Personal API Token account to have the `manage_account_security` permission.

## Required plan and roles

* **Monday.com plan:** the **Enterprise** plan is required.
* **Monday.com role:** you must be an **organizational admin** to complete the steps below.
* **Permission scoping:** this integration can't be scoped to read-only. It needs full provisioning access to work.
* **Connection fields:** Lumos needs a **Bearer Token** (SCIM Secret Token), your **subdomain**, and a **Personal API Token**.

## Instructions

**Phase 1: Generate the Bearer Token in Monday.com**

1. Log in to your Monday.com account.
2. Click your profile picture in the left navigation pane.
3. Navigate to **Admin > Security**.
4. Under the **Login** tab, select **Open** in the **SCIM** section.
5. Click **Generate** to create a new Secret Token. This is your Bearer Token.

**Phase 2: Find your subdomain**

1. Look at your Monday.com URL. The subdomain is the part before `.monday.com`.
2. For example, if your URL is `https://yourcompany.monday.com`, the subdomain is `yourcompany`.

**Phase 3: Generate the Personal API Token**

1. Make sure you have the `manage_account_security` permission enabled on your account. Lumos needs it to read login events for activity tracking.
2. Click the menu icon next to your profile picture in the top right corner.
3. Navigate to **Admin > Connections > Personal API token** and generate your token.

**Phase 4: Connect in Lumos**

1. Search for **Monday.com (Enterprise)** in Lumos.
2. Gather all fields and enter them into Lumos.
3. Click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Authentication fails when connecting.** The Bearer Token and the Personal API Token are different credentials from different admin pages. Confirm the Bearer Token is the SCIM Secret Token from **Admin > Security > SCIM**, the Personal API Token comes from **Admin > Connections**, the subdomain matches your Monday.com URL, and neither token has been regenerated since you copied it.

**Last login data is missing.** The `audit_logs` query only works when the account that generated the Personal API Token has the `manage_account_security` permission. Enable it and reconnect.

**Creating a user fails.** SCIM user creation requires an email, a given name, and a family name. All three are mandatory.

**A role can't be removed from a user.** This is expected. Every user holds exactly one account role, so Lumos can only replace a role with another one, not remove it.

**Deactivated users still appear in Lumos.** This is expected. The sync includes inactive users and maps them to the Suspended status, which keeps them visible for Access Reviews and reactivation.