Automatically Syncing AppStore Permissions

​

Background

With the Lumos AppStore, you can allow end-users to request fine-grained access to applications, such as individual roles, groups, and licenses. Fielding these types of requests in your ITSM can often create hours of work every month. This article shows you how to use Lumos to automatically provision and deprovision fine-grained access, including how to sync outside permissions into your AppStore, reducing setup and maintenance time.

​

What does Lumos consider a “Permission”?

Lumos uses the word “permission” to refer to any access that you can grant to a user’s account in an application. These can be roles (basic vs admin), licenses (free seat vs paid seat), or security groups. Lumos exposes two types of permissions in the platform. First, Lumos syncs all external permissions via direct integrations, and make them available in the “permissions” tab; you can view these by going to Apps > [select an app] > Permissions. Within these permissions, there are:

• Assignable Permissions — you can assign these directly to users in the application’s admin panel. Examples include:
  • NetSuite Role
  • Zoom License
• Implied Permissions — these are permissions that are granted to a user but not directly. Examples include:
  • Inherited GCP permissions
  • Database-level access in Snowflake
  • The ability to approve an invoice in NetSuite

Both assigned and implied permissions are synced into Lumos and available to view in the platform. This allows to conduct quarterly audits on any access that a user has. However, not all permissions should be requestable in the AppStore.

​

AppStore “Requestable” Permissions

Within the AppStore, you can define which permissions are available for end users to request by going to AppStore > [select app] > Settings > Permissions. Here, you can define settings such as:

• What is the name of the permission shown to end users? (this can be different from the name used externally)
• Which approvals are required before a user can be granted access?
• Which automated steps should be taken to provision and deprovision access?

Permissions in the AppStore can either be added manually, or automatically.

​

Automatically Syncing Requestable Permissions

When you first connect an integration, the application will show up immediately, and you can configure it in the AppStore. However, it won’t have any permissions yet. Lumos runs a sync process every 24 hours to discover new users, their statuses, as well as all permissions within an application. At the end of this sync, Lumos automatically makes all assignable permissions available in your AppStore.

​

Default Requestable Permission Settings

By default, all permissions synced into the AppStore will exhibit the following behavior:

• They will be hidden from end users. This is by design, to avoid accidentally enabling new, sensitive permissions for end users without proper approvals in place.
• They will inherit the approvers, group-based visibility, and webhook settings from the app-level defaults
• Provisioning and Deprovisioning workflows will be automatically configured with a single step to assign and unassign entitlements

If you would like to make any changes to this, you can open the permission and adjust any settings directly. Lumos also supports making these changes programmatically, via the Lumos API or Terraform.

​

FAQs

​

Why is there a different number of permissions on the app page vs in the AppStore?

Lumos only creates requestable permissions in the AppStore if it can automatically provision access to the permission. Some applications such as Snowflake and Active Directory have permissions that are not directly assignable, so Lumos doesn’t add them to the AppStore automatically.

​

When are permissions synced?

Permissions are synced automatically once per day.

​

Can I trigger a sync manually?

The only way to trigger a sync manually is to click to Integrations > [select app] > Sync > Sync Users. This will trigger a full sync of all users and their permissions, and Lumos will update requestable permissions at the end of this sync.