Skip to main content
Lumos offers two Slack connectors, each its own integration card. This article covers Slack Provisioning (User Management), a Slack OAuth app you create that syncs and provisions users, user groups, teams, workspace roles, and channels. For notifications, user and role visibility, license management, and user suspension via the Lumos workspace app, use Slack (Messaging). You can connect both. Slack Provisioning adds account and entitlement provisioning on top of Messaging.

​
After this article

You will be able to connect Slack to Lumos to sync and provision users, user groups, teams, workspace roles, and channels. You can create, activate, deactivate, and delete Slack user accounts and assign or remove their entitlements, or connect read-only for visibility.

​
Capabilities

Provisioning behavior:
  • Create: Lumos creates the user through SCIM (POST /Users) with a username, email, and optional first and last name. Before creating, Lumos searches SCIM by username and then by email. If a match exists, Lumos links that account instead of creating a duplicate, and a conflict response from Slack is handled the same way. New users are created active.
  • Activate or deactivate: Lumos sets the SCIM active flag. If the account is already in the requested state, the action is a safe no-op.
  • Delete: Lumos deletes the user through SCIM. Deleting a user who is already gone is a safe no-op.
  • User groups: Lumos reads the group’s current members and writes the updated list via usergroups.users.update. Adding an existing member or removing a non-member is a safe no-op. Your workspace settings must allow the connecting user to manage user groups.
  • Teams (Enterprise Grid): Lumos adds or removes the user with admin.users.assign and admin.users.remove. Already-assigned and already-removed states are safe no-ops.
  • Roles (Enterprise Grid): Workspace roles use admin.users.setOwner, admin.users.setAdmin, and admin.users.setRegular. Removing the Owner or Admin role downgrades the user to Member. The Member role itself can’t be unassigned, use Deactivate or Delete instead. Grid system roles use admin.roles.addAssignments and admin.roles.removeAssignments, and some Grid roles aren’t assignable through the API.
  • Channels: Lumos invites or removes the user with conversations.invite and conversations.kick. Already-in-channel and not-in-channel states are safe no-ops. Users can’t be removed from the #general channel.
  • Create Channel and Delete Channel: custom actions that create or delete channels via admin.conversations.create and admin.conversations.delete. Both require Enterprise Grid and channel provisioning enabled.
Unassign Entitlement (remove roles, groups, teams, or channel access) is also supported in read + write mode. On non-Enterprise-Grid workspaces, role and team provisioning is unavailable, but account and group actions still work. Guest users have limited data.

​
Required plan and roles

  • Lumos plan: no minimum plan needed to connect.
  • Slack plan: creating, deleting, activating, and deactivating Slack user accounts uses Slack’s SCIM API, which requires Business+ or Enterprise Grid. Workspace role, organization role, and team membership provisioning uses Slack’s Admin API, which requires Enterprise Grid. User group membership changes work on non-Grid workspaces. Channel access provisioning requires Business+ or above and channel provisioning enabled for your Lumos tenant. Detailed audit logs require Enterprise Grid.
  • Slack role: your Slack user must be a Workspace Admin at the Workspace level and Org Primary Admin/Org Owner at the Organization level.
OAuth app scopes (set on the app you create in Phase 1):
  • Bot Token scopes (required to initialize the bot user, needed for the OAuth-flow provisioning): channels:manage, channels:read, channels:write.invites, groups:read, groups:write, groups:write.invites, usergroups:read, usergroups:write, users:read, users:read.email
  • User Token scopes (required for full functionality): channels:read, channels:write, channels:write.invites, groups:read, groups:write, groups:write.invites, usergroups:read, usergroups:write, users:read, users:read.email
  • The users:*, usergroups.*, and team:read scopes are required for integration with Slack Workspaces.
  • The admin scope is required for SCIM access, and admin.* scopes are required on Enterprise Grid. Skip these on non-Enterprise workspaces.
Read-only mode: grant only the read versions of these scopes. Lumos connects with read-only access and all account and entitlement provisioning actions are blocked. If you reconnect with new scopes, you must revoke your previous OAuth token in Slack first, otherwise Slack won’t request the new scopes. Slack also requests scopes through the OAuth flow during setup. These are the scopes Lumos asks for: Bot Token scopes User Token scopes If you don’t require or allow admin scopes for Slack, you can connect with only the read scopes for users (admin.users:read) and teams (admin.teams:read) to send notifications to those users. You won’t be able to auto-provision or deprovision via Slack with this scope. To use this non-admin scope, contact Lumos Support via Slack or at support@lumos.com.

​
Instructions

Phase 1: Create a Slack OAuth app
  1. In Slack, go to View Your Apps → Create New App → From scratch, enter an App Name, select your workspace, and click Create App.
  2. Copy the app’s Client ID and Client Secret.
  3. Under OAuth & Permissions → Scopes, add the Bot Token and User Token scopes listed in Required plan and roles above (read versions only for read-only mode).
  4. Under OAuth & Permissions → Redirect URLs, add https://app.lumosidentity.com/integrations/ics_oauth2_callback.
Phase 2: Connect in Lumos
  1. Find the Slack Provisioning card in your Lumos integrations (Reconnect or add new).
  2. Paste the Client ID and Client Secret from your Slack app.
  3. Enterprise Grid only: mark the Enterprise Grid checkbox, then approve the Lumos app for your org and add it to the workspaces where you want to use it.
  4. Click Connect.

​
API Endpoints Used

​
Troubleshooting

Slack Provisioning sync fails and nothing appears on the Integrations page. Past occurrences of “Failed to connect Slack Provisioning” in the activity log traced to a platform-side bug that engineering fixed, and no customer config change was required. If you see this, do not repeatedly reconnect. Contact support to confirm the current status. “Missing required scope” or “Insufficient permissions”. Verify all required OAuth scopes were granted and reinstall the Slack app with the correct permissions. For private channels, the bot must be added as a member. Private channels only sync where the bot is a member, and all public channels sync. Channel access assignment fails. Assigning channel access requires Business+ or above with provisioning (write) scopes granted. Downgrading scopes is not working. Slack’s APIs do not support downgrading scopes by reconnecting. For User Token scopes, ask the Lumos team to revoke your current token, then reconnect. For Bot Token scopes, uninstall the Slack app from your organization in Slack admin, then reconnect the integration in Lumos. Assigning a user to a channel or group they already belong to. Re-assigning an existing member is treated as success and does not create an error task. The “already a member” response is ignored so the provisioning flow continues. Rate limiting (429 Too Many Requests). Slack enforces tiered API rate limits: Tier 2 (~20 req/min for most endpoints), Tier 3 (~50 req/min), Tier 4 (~100 req/min for admin endpoints), and SCIM (~180 req/min). The connector handles rate limiting automatically with backoff, and large workspaces simply sync more slowly. Some provisioning actions fail on a non-Enterprise-Grid workspace. Workspace role and team membership provisioning use Slack’s Admin API, which requires Enterprise Grid. Account creation, deletion, activation, and deactivation use SCIM and work off Grid on the Business+ plan. User group membership changes work on any workspace. If a SCIM action fails with “SCIM is not available”, the workspace plan doesn’t include SCIM.