Skip to main content

​
After this article

You will be able to connect Notion to Lumos to sync Notion workspace members and deprovision users during offboarding, Access Reviews, and license management.

​
Capabilities

Account status mapping: Notion active maps to Active, inactive maps to Suspended, and a deleted user (one Notion no longer returns) maps to Suspended. Deprovisioning behavior: deprovisioning marks the account Suspended in Lumos, removes the user from your Notion workspace, logs them out of all active sessions, and reclaims a license. Notion accounts can’t be fully deleted through SCIM, so full deletion must be done manually in Notion. Roles and groups are not synced as entitlements. Account-level Access Reviews (who has a Notion account) work natively. For a by-role or privileged-Access Review, bring workspace roles in via CSV: export members and their roles from Notion, build a CSV with an Email column and a Roles column, and upload it on the Notion app in Lumos via Add custom data, mapping the role column as a Permission Field (not an Attribute Field).

​
Required plan and roles

  • Notion plan: SCIM provisioning requires the Notion Enterprise plan.
  • Notion role: the connecting user must be at least a Workspace Owner.
  • Credential: a Notion SCIM API token.
  • Permission scoping: the SCIM token grants both read (list users) and write (remove users). The connector is identity-only by design. It syncs users and can deprovision them, but it doesn’t sync roles or group memberships as entitlements.

​
Read-only access vs provisioning

Is read-only possible? No. The SCIM API token this connector uses grants both read (list users) and write (remove users) in a single combined scope, and no narrower, read-only credential is documented for this connector. What full provisioning requires. A Notion Enterprise plan, a connecting user who is at least a Workspace Owner, and a SCIM API token generated for the workspace. Follow the steps below to generate the token and enter it in Lumos. Watch out for. “Provisioning” here means deprovisioning only, removing a user from the workspace and logging them out, not creating accounts or syncing roles and group memberships. Roles and groups aren’t synced as entitlements at all, so a role-based Access Review needs workspace roles brought in separately through a CSV upload.

​
Instructions

Phase 1: Generate a SCIM API token in Notion
  1. Log in to Notion as a Workspace Owner on an Enterprise-plan workspace.
    1. Please follow the instructions in this Notion Help Document to enable SCIM on your account.
    2. Generate a SCIM bearer and store it for alter.
  2. Generate a SCIM API token for your workspace and copy it.
Phase 2: Connect in Lumos
  1. Find the Notion card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Choose a unique identifier for the integration (e.g. notion-1) and enter it in the App Instance Identifier field.
  3. Enter the SCIM API token in the API Key field.
  4. Click Connect Notion.

​
API Endpoints Used

​
Troubleshooting

User sync is healthy but entitlement count is zero. This is expected, not a sync failure. The connector is identity-only and doesn’t sync roles or groups. Native role syncing would be a feature request. CSV-uploaded roles create duplicate entitlements. Keep the CSV header casing consistent across uploads. A casing change creates duplicate entitlements. Each upload is a full snapshot, so rows omitted from a new upload are marked removed. CSV-sourced roles are manually maintained and must be re-uploaded to refresh. A deprovisioned user’s Notion account still exists. This is expected. SCIM removes the user from the workspace but can’t fully delete the Notion account. Delete the account manually in Notion if required.