> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SentinelOne

## After this article

You'll be able to connect SentinelOne to Lumos and authenticate the integration so Lumos can read from your SentinelOne tenant.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Authenticate | Account | Yes | No | Read-only authentication against the SentinelOne tenant |

| AppStore | Offboarding | Access Reviews | License Management |
| - | - | - | - |
| No | No | No | No |

## Required plan and roles

* **SentinelOne plan:** no minimum SentinelOne plan is required to connect this integration.
* **SentinelOne role:** the API token must be generated by a user with the **Admin** role.
* **Permission scoping:** the connection is read-only. Lumos authenticates against SentinelOne and does not write back.

## Read-only access vs provisioning

**Is read-only possible?** Yes, and it's the only way this connector works. SentinelOne connects with a single read-only API token. Lumos authenticates against your SentinelOne tenant and never writes back, so there's no provisioning mode to opt into.

**What read-only requires.** An API token generated by a SentinelOne user with the **Admin** role, plus the tenant's Base URL. Follow the steps below.

**Watch out for.** A token generated by a non-admin user won't authenticate, and a Base URL that doesn't match your tenant will reject the token even if the token itself is valid.

## Instructions

**Phase 1: Connect in Lumos**

1. Find the SentinelOne card in your Lumos integrations (reconnect an existing card or add a new one).
2. Provide your **API Token** and **Base URL**.
3. Click **Connect**.

Generate the API token with a SentinelOne user that has the Admin role. A token from a non-admin user cannot authenticate the integration.

## Troubleshooting

**Connection fails when saving credentials.** Confirm the API token was generated by a user with the Admin role. Tokens from non-admin users cannot authenticate.

**Wrong Base URL.** Enter the Base URL that matches your SentinelOne tenant. A mismatched URL rejects the token.