> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sage Intacct

## After this article

You'll be able to connect Sage Intacct to Lumos to sync users, groups, and roles for visibility and Access Reviews.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | No | User accounts |
| Groups | Permission | Yes | No | Groups |
| Roles | Permission | Yes | No | Roles |

## Required plan and roles

* **Sage Intacct user:** the Web Services user must be a **Business type** user with the **Admin** role.
* **OAuth app:** create an app in Sage's developer console before connecting. Reach out to Sage support to confirm the app meets the requirements for the OAuth 2.0 Client Credentials Flow and to generate the values.
* **Redirect URL:** the callback/redirect URL for the OAuth application is `https://app.lumosidentity.com/integrations/ics_oauth2_callback`.

## Read-only access vs provisioning

**Is read-only possible?** Yes, and it's the only mode available. Sage Intacct syncs users, groups, and roles for visibility and Access Reviews, the connector doesn't provision or deprovision anything in Sage Intacct.

**What read-only requires.** A Sage Intacct Web Services user that's a **Business type** user with the **Admin** role, plus an OAuth 2.0 Client Credentials app from Sage's developer console (confirm the app configuration with Sage support). Follow the steps below to create the Web Services user and OAuth app, then connect with the Client ID, Client Secret, and Username.

**Watch out for.** This is a sync-only integration end to end, there's no separate write-capable credential or connection mode to request from Sage. Keep the Web Services user active and correctly roled, since Lumos relies on it for every sync.

## Instructions

**Phase 1: Create a Web Services user in Sage Intacct**

1. If you already have a Web Services user for your integration, skip this step.
2. Log in to your company and go to **Company → Admin → Web Services Users → Add**.
3. Create the Web Services user and assign the necessary permissions or role. It must be a Business type user with the Admin role.

**Phase 2: Set up the OAuth application**

1. Create an app in Sage's developer console for the OAuth 2.0 Client Credentials Flow.
2. Set the redirect URL to `https://app.lumosidentity.com/integrations/ics_oauth2_callback`.
3. Confirm with Sage support that the app is configured for Client Credentials.

**Phase 3: Connect in Lumos**

1. Click the Sage Intacct card in your Lumos integrations. Reconnect an existing card or add a new one.
2. Enter the **Client ID**, **Client Secret**, and **Username**.
   * **Client ID** is your application's client ID.
   * **Client Secret** is your application's client secret.
   * **Username** is the Web Services user ID, in `userId@companyId|entityId` format.
3. Click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Authentication failures.** Verify the Client ID and Client Secret from your Sage developer console app, and confirm the Username is in `userId@companyId|entityId` format. Check that the Web Services user is active and is a Business type user with the Admin role.

**Users or roles aren't syncing.** Confirm the Web Services user can view users and roles, and that the accounts and role assignments are active in Sage Intacct. If the app configuration is unclear, contact Sage support to confirm it meets the OAuth 2.0 Client Credentials requirements.