> ## Documentation Index > Fetch the complete documentation index at: https://docs.lumos.com/llms.txt > Use this file to discover all available pages before exploring further. # Slack User Management *Lumos offers two Slack connectors, each its own integration card. This article covers **Slack Provisioning** (User Management), a Slack OAuth app you create that syncs and provisions users, user groups, teams, workspace roles, and channels. For notifications, user and role visibility, license management, and user suspension via the Lumos workspace app, use [Slack (Messaging)](/integrations/library/slack/slack-messaging). You can connect both. Slack Provisioning adds account and entitlement provisioning on top of Messaging.* ## After this article You will be able to connect Slack to Lumos to sync and provision users, user groups, teams, workspace roles, and channels. You can create, activate, deactivate, and delete Slack user accounts and assign or remove their entitlements, or connect read-only for visibility. ## Capabilities | Functionality | Type | Sync | Provision | Description | | :- | :- | :- | :- | :- | | Users | Account | Yes | Yes | User account records. Lumos can create, activate, deactivate, and delete accounts via SCIM (Business+ or Enterprise Grid) | | User Groups | Permission | Yes | Yes | User groups. Membership changes work on any workspace, but not at the Grid organization level | | Teams | Permission | Yes | Yes | User teams (workspaces). Enterprise Grid only | | Workspace Roles | Permission | Yes | Yes | Workspace roles and Enterprise Grid system roles. Enterprise Grid only | | Channels | Permission | Yes | Yes | All public channels, and private channels only where the bot is a member. Requires channel provisioning enabled for your tenant | **Provisioning behavior:** * **Create:** Lumos creates the user through SCIM (`POST /Users`) with a username, email, and optional first and last name. Before creating, Lumos searches SCIM by username and then by email. If a match exists, Lumos links that account instead of creating a duplicate, and a conflict response from Slack is handled the same way. New users are created active. * **Activate or deactivate:** Lumos sets the SCIM `active` flag. If the account is already in the requested state, the action is a safe no-op. * **Delete:** Lumos deletes the user through SCIM. Deleting a user who is already gone is a safe no-op. * **User groups:** Lumos reads the group's current members and writes the updated list via `usergroups.users.update`. Adding an existing member or removing a non-member is a safe no-op. Your workspace settings must allow the connecting user to manage user groups. * **Teams (Enterprise Grid):** Lumos adds or removes the user with `admin.users.assign` and `admin.users.remove`. Already-assigned and already-removed states are safe no-ops. * **Roles (Enterprise Grid):** Workspace roles use `admin.users.setOwner`, `admin.users.setAdmin`, and `admin.users.setRegular`. Removing the Owner or Admin role downgrades the user to Member. The Member role itself can't be unassigned, use Deactivate or Delete instead. Grid system roles use `admin.roles.addAssignments` and `admin.roles.removeAssignments`, and some Grid roles aren't assignable through the API. * **Channels:** Lumos invites or removes the user with `conversations.invite` and `conversations.kick`. Already-in-channel and not-in-channel states are safe no-ops. Users can't be removed from the #general channel. * **Create Channel and Delete Channel:** custom actions that create or delete channels via `admin.conversations.create` and `admin.conversations.delete`. Both require Enterprise Grid and channel provisioning enabled. | Deprovisioning Action | Type | Description | | :- | :- | :- | | Deactivate | User | Deactivate a user in Slack via SCIM | | Delete | User | Delete a user in Slack via SCIM | Unassign Entitlement (remove roles, groups, teams, or channel access) is also supported in read + write mode. On non-Enterprise-Grid workspaces, role and team provisioning is unavailable, but account and group actions still work. Guest users have limited data. ## Required plan and roles * **Lumos plan:** no minimum plan needed to connect. * **Slack plan:** creating, deleting, activating, and deactivating Slack user accounts uses Slack's SCIM API, which requires **Business+ or Enterprise Grid**. Workspace role, organization role, and team membership provisioning uses Slack's Admin API, which requires **Enterprise Grid**. User group membership changes work on non-Grid workspaces. Channel access provisioning requires Business+ or above and channel provisioning enabled for your Lumos tenant. Detailed audit logs require Enterprise Grid. * **Slack role:** your Slack user must be a **Workspace Admin** at the Workspace level and **Org Primary Admin/Org Owner** at the Organization level. OAuth app scopes (set on the app you create in Phase 1): * **Bot Token scopes** (required to initialize the bot user, needed for the OAuth-flow provisioning): `channels:manage`, `channels:read`, `channels:write.invites`, `groups:read`, `groups:write`, `groups:write.invites`, `usergroups:read`, `usergroups:write`, `users:read`, `users:read.email` * **User Token scopes** (required for full functionality): `channels:read`, `channels:write`, `channels:write.invites`, `groups:read`, `groups:write`, `groups:write.invites`, `usergroups:read`, `usergroups:write`, `users:read`, `users:read.email` * The `users:*`, `usergroups.*`, and `team:read` scopes are required for integration with Slack Workspaces. * The `admin` scope is required for SCIM access, and `admin.*` scopes are required on Enterprise Grid. Skip these on non-Enterprise workspaces. *Read-only mode:* grant only the read versions of these scopes. Lumos connects with read-only access and all account and entitlement provisioning actions are blocked. If you reconnect with new scopes, you must revoke your previous OAuth token in Slack first, otherwise Slack won't request the new scopes. Slack also requests scopes through the OAuth flow during setup. These are the scopes Lumos asks for: **Bot Token scopes** | Scope | Required | Description | | :- | :- | :- | | `users:read` | Yes | View people in a workspace | | `users:read.email` | Yes | View email addresses of people in a workspace | **User Token scopes** | Scope | Required | Description | | :- | :- | :- | | `admin` | Yes | Administer a workspace | | `admin.teams:read` | Yes | Access information about a workspace | | `admin.users:read` | Yes | Access a workspace's profile information | | `users.profile:write` | Yes (for provisioning only) | Edit a user's profile information and status | | `users:read` | Yes | View people in a workspace | | `users:read.email` | Yes | View email addresses of people in a workspace | | `admin.roles:read` | Yes | View roles | | `admin.roles:write` | Yes (for provisioning only) | Assign access to roles | | `user.groups:read` | Yes | View user groups | | `user.groups:write` | Yes (for provisioning only) | Assign access to groups | If you don't require or allow admin scopes for Slack, you can connect with only the read scopes for users (`admin.users:read`) and teams (`admin.teams:read`) to send notifications to those users. You won't be able to auto-provision or deprovision via Slack with this scope. To use this non-admin scope, contact Lumos Support via Slack or at [support@lumos.com](mailto:support@lumos.com). ## Instructions **Phase 1: Create a Slack OAuth app** 1. In Slack, go to **View Your Apps** → **Create New App** → **From scratch**, enter an App Name, select your workspace, and click **Create App**. 2. Copy the app's **Client ID** and **Client Secret**. 3. Under **OAuth & Permissions** → **Scopes**, add the Bot Token and User Token scopes listed in **Required plan and roles** above (read versions only for read-only mode). 4. Under **OAuth & Permissions** → **Redirect URLs**, add `https://app.lumosidentity.com/integrations/ics_oauth2_callback`. **Phase 2: Connect in Lumos** 1. Find the Slack Provisioning card in your Lumos integrations (Reconnect or add new). 2. Paste the **Client ID** and **Client Secret** from your Slack app. 3. **Enterprise Grid only:** mark the Enterprise Grid checkbox, then approve the Lumos app for your org and add it to the workspaces where you want to use it. 4. Click **Connect**. ## API Endpoints Used The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them. ## Troubleshooting **Slack Provisioning sync fails and nothing appears on the Integrations page.** Past occurrences of "Failed to connect Slack Provisioning" in the activity log traced to a platform-side bug that engineering fixed, and no customer config change was required. If you see this, do not repeatedly reconnect. Contact support to confirm the current status. **"Missing required scope" or "Insufficient permissions".** Verify all required OAuth scopes were granted and reinstall the Slack app with the correct permissions. For private channels, the bot must be added as a member. Private channels only sync where the bot is a member, and all public channels sync. **Channel access assignment fails.** Assigning channel access requires Business+ or above with provisioning (write) scopes granted. **Downgrading scopes is not working.** Slack's APIs do not support downgrading scopes by reconnecting. For User Token scopes, ask the Lumos team to revoke your current token, then reconnect. For Bot Token scopes, uninstall the Slack app from your organization in Slack admin, then reconnect the integration in Lumos. **Assigning a user to a channel or group they already belong to.** Re-assigning an existing member is treated as success and does not create an error task. The "already a member" response is ignored so the provisioning flow continues. **Rate limiting (429 Too Many Requests).** Slack enforces tiered API rate limits: Tier 2 (\~20 req/min for most endpoints), Tier 3 (\~50 req/min), Tier 4 (\~100 req/min for admin endpoints), and SCIM (\~180 req/min). The connector handles rate limiting automatically with backoff, and large workspaces simply sync more slowly. **Some provisioning actions fail on a non-Enterprise-Grid workspace.** Workspace role and team membership provisioning use Slack's Admin API, which requires Enterprise Grid. Account creation, deletion, activation, and deactivation use SCIM and work off Grid on the Business+ plan. User group membership changes work on any workspace. If a SCIM action fails with "SCIM is not available", the workspace plan doesn't include SCIM.