Skip to main content
This is a read-only integration that syncs data from Wiz.

​
After this article

You’ll be able to connect Wiz to Lumos to sync Wiz users and roles for visibility and Access Reviews, including each user’s last login activity.

​
Capabilities

Activity tracking: supported. The Wiz connector tracks each user’s last login activity.

​
Required plan and roles

  • Wiz plan: no minimum Wiz plan is required to connect this integration.
  • Service account: create a Wiz service account of type Custom Integration (GraphQL API). The connection uses its Client ID and Client Secret.
  • Scope: the service account needs the read:users scope to sync users.
  • Authentication: OAuth 2.0 Client Credentials flow, using the Client ID and Client Secret from the service account.
  • Permission scoping: the connection is read-only. Lumos syncs from Wiz and does not write back.

​
Read-only access vs provisioning

Is read-only possible? Yes. Wiz is a read-only integration. Lumos syncs users and roles from Wiz for visibility and Access Reviews and does not write back. What read-only requires. A Wiz service account of type Custom Integration (GraphQL API), with the read:users scope, connected using its Client ID and Client Secret through the OAuth 2.0 Client Credentials flow. Follow the steps below. Watch out for. There’s no broader scope to grant by mistake, since read:users is the only scope this connector asks for and the connection is read-only by design. Getting the Tenant Data Center or Environment wrong can look like a credential error, so double check those against your actual Wiz region before assuming the Client ID or Secret is wrong.

​
Instructions

Phase 1: Gather credentials in Wiz
  1. Client ID: the client ID for the service account. The service account must be of type Custom Integration (GraphQL API) and must have the read:users scope.
  2. Client Secret: the client secret for the same service account.
  3. Tenant Data Center: the regional data center of your Wiz deployment. In the Wiz portal, click the user icon at the top right, open Tenant Info, then click Data Center and Regions on the left and copy your Tenant Data Center. Third-party developers should request this from their Wiz customer contact.
  4. Environment: the Wiz deployment environment. Use app.wiz.io for Commercial (Standard) deployments, app.wiz.us for Gov (FedRAMP) deployments, or gov.wiz.io for Commercial AWS GovCloud deployments. The default is app.wiz.io.
Phase 2: Connect in Lumos
  1. Find the Wiz card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Enter the Client ID, Client Secret, Tenant Data Center, and Environment.
  3. Optionally set Filter by WIZ Auth Provider. When enabled, Lumos includes only users whose authentication provider type is WIZ. When disabled (the default), Lumos returns all users regardless of authentication provider type.
  4. Click Connect.

​
API Endpoints Used

​
Troubleshooting

Invalid Client Credentials. Confirm the Client ID and Client Secret are copied correctly, the service account is active, the required scope is granted, and the region endpoint is correct. OAuth Token Error. Confirm the grant type is client_credentials, the service account is active, and no firewall blocks requests to auth.app.wiz.io. Users not syncing. Confirm the service account has the read:users scope. Connection looks like an auth failure but credentials are correct. An invalid Tenant Data Center can produce a malformed auth URL that reads like a credential error. Set the Tenant Data Center field to your actual Wiz region code (for example us1, us2, eu1, eu2, or a specific region such as us53) and reconnect.