Skip to main content

​
Background

The NHI connectors — Microsoft Entra ID (NHI), AWS IAM Identity Center (NHI), and GitHub (Graph) — work differently from standard Lumos integrations. They exist to feed the Identity Agent Force security agents, and they do not sync accounts or identities into your Lumos inventory. Because of this, the integration tile can show a sync error even when the connector is healthy. This article explains which status signals matter, which don’t, and how to tell a cosmetic error from a real one. Related: Connecting Microsoft Entra ID (NHI) · AWS IAM (NHI) · Identity Agent Force Overview

​
Why NHI connectors show sync errors

Standard Lumos integrations run a full integration sync on a schedule and report its result on the integration tile. NHI connectors do not run this sync — the Identity Agent Force agent queries the platform directly when it runs a scan. The sync-status machinery still renders on the tile, so it can display “Sync failed” or an error banner that does not reflect the connector’s actual health. If your NHI connector shows a sync error but the agent produces findings, the connector is working. No action is needed.

​
Signals that matter

  • Connection state — the connector shows as connected after you complete setup. A “connection lost” banner is a real signal: it means credentials were revoked, expired, or the trust configuration changed.
  • Agent findings — the Identity Agent Force agent produces Issues after its scans. Findings appearing on schedule means the pipeline is healthy end to end.

​
Signals that do not matter

  • “Sync failed” on the integration tile.
  • Sync timestamps — NHI connectors have no standard sync schedule, so a stale or empty “last synced” value is expected.

​
When it is a real problem

If the agent produces no findings at all, check these causes before assuming the connector is broken:
  1. Credentials expired or revoked. Entra client secrets are capped at 24 months. Rotate the secret in Entra and update it in Lumos. For AWS, confirm the IAM role and External ID still match the Lumos configuration.
  2. Missing prerequisites limit findings. For AWS, external-exposure and unused-access findings require IAM Access Analyzer (both analyzer types), and compromise signals require GuardDuty. For Entra, conditional-access findings require an Entra ID P1 or P2 license. Without these, some finding categories never appear — this is a configuration gap, not a connector failure.
  3. The agent has not run yet. Findings appear after the agent’s first scan, not immediately on connection.

​
FAQ

The tile shows an error. Should I reconnect?
Not if findings are appearing. Reconnecting is only needed after a “connection lost” state or a credential rotation. Does the sync error affect my other Lumos integrations?
No. The NHI connector is a separate integration from any standard connector you run for the same platform (for example, Microsoft Entra ID for identity sync and Microsoft Entra ID (NHI) for security analysis are independent). Questions? Contact your Lumos account team or open a support ticket.