Theme: From Intent to Access
This month, the Access Request Agent lets employees describe what they need in plain language and guides them to a least-privilege, policy-compliant request automatically. A new ADP connector and a wave of improvements across Google Workspace, Salesforce, GitHub, and more extend Lumos coverage across your stack. New workflow controls provide admins more precise automation options.AppStore
Access Request Agent [Beta]
The Lumos AppStore now has a built-in AI agent that turns plain-language intent into structured, least-privilege access requests. Instead of browsing a catalog and guessing at permission names, employees describe what they need to do - and the agent maps it to the right app, entitlement, duration, and business justification before submission. What’s new:- Conversational access request experience embedded directly in the Employee AppStore
- Intent classification that maps task descriptions to the right app and entitlement
- Automatic business justification generation based on the employee’s stated need
- Pre-submission validation for eligibility, duplicates, existing access, and policy conflicts
- Least-privilege defaults - if multiple entitlements could satisfy a request, the agent recommends the safest option
- Falls back to the standard request form if confidence is low - employees are never stuck
- Mobile-friendly design with a refreshed AppStore UI
- No admin setup required - inherits your existing catalog, approval policies, and provisioning workflows
- Employees get access faster - guided requests in under 5 minutes vs. 9+ minutes of catalog browsing
- Approvers receive decision-ready requests with full context on the first try, cutting clarification loops
- Fewer over-privileged requests - least-privilege defaults reduce security escalations and denial/resubmission cycles
- Zero risk to your existing governance - requests flow through the same approval chains as always
Lifecycle Management
Flow Step: Wait Until
Onboarding workflows can now pause until a specific date is reached - anchored to an employee’s actual Start Date, not the moment the workflow fired. This means provisioning happens at exactly the right time, regardless of when your HRIS synced the record. What’s new:- New “Wait Until” step type in the LCM workflow builder
- Supports Lumos Expression Language (LEL) for date offsets: provision 3 days before start date with
subtract_days(start_date, 3), or 7 days after withadd_days(start_date, 7) - If the computed date has already passed, the workflow proceeds immediately - no errors, no blocks
- Configurable error handling if Start Date is missing: cancel the workflow or skip the step and continue
- Full visibility in workflow run logs - shows pause state, computed resume timestamp, and outcome per run
- Provisioning fires on the employee’s timeline, not the HRIS sync schedule
- Security policies with time-sensitive access windows (like MFA enrollment periods) are reliably enforced
- Supports split onboarding flows - immediate actions on identity creation, date-delayed actions anchored to start date
- Available in the LCM workflow builder for all customers with LCM enabled - no additional setup required
Policy Mining
Knowledge Hub
The Knowledge Hub is a new home for the organizational context that shapes how Lumos AI makes decisions. Admins can now define, view, and manage the rules and guidelines their AI agents use - things like how your organization identifies contractors, which apps have access nuances, or what permissions are expected for certain roles. What’s new:- A centralized table of Knowledge Entries, each with a name, instructions, scope (global or product-specific) and tag (relevant apps)
- Filter entries by use case: General Instructions, Access Reviews, Policy Mining, Albus Chat, or Access Requests
- Audit trail tracking who created or modified each entry and when the entry was last updated
- AI recommendations reflect your organization’s actual policies and nuances - not generic defaults
- Admins can see exactly what context is shaping AI decisions, building trust in recommendations
- Every change is auditable, supporting compliance requirements
Available in the Lumos side nav for all customers. Ask Albus [Beta]
Ask Albus, Lumos’s AI-powered policy mining assistant, is now visible to all customers directly in the side nav. Albus helps IT and IAM teams build accurate, data-driven access policies from real usage patterns, and automate Day 1 provisioning for new hires. What’s new:- “Ask Albus” now appears in the side nav for all customers
- Ask questions like “What access should a new engineer have?” and get AI-generated policy recommendations based on how your organization actually uses its apps
- Knowledge Hub context integration - Albus recommendations now incorporate your org-specific rules
- Build access policies in hours instead of weeks - no more spreadsheet-based role mapping
- New hires get the right access on Day 1 instead of waiting weeks for IT to sort it out
- Policies are grounded in real usage data, not tribal knowledge or guesswork
- Reduce access request ticket volume with automated birthright provisioning
Integrations
New Connector: ADP Workforce Now [Beta]
Lumos now connects directly to ADP Workforce Now for end-to-end user and access management. What’s new:- Sync users, roles, and custom attributes
- Create and update users including custom attributes
- Assign and unassign access to roles
- Delete users
- Can be scoped to read-only
- Direct provisioning actions in Lumos without leaving the platform
- Deeper visibility into workforce data for lifecycle automation
- Supports pre-IDP initiatives for customers managing identity directly in ADP
Connector Improvements
This month includes enhancements across existing connectors. Google Workspace - Offboarding Actions: A major expansion of offboarding coverage for Google Workspace. Admins can now trigger the following actions directly from Lumos:- Mobile Wipe Device
- Delete App Specific Passwords
- Forward Emails to Manager
- Update User
- Hide User in Directory
- Sign User Out
- Revoke OAuth Tokens
- Transfer Google Group Ownership
- Remove From Google Groups
- Remove From Calendar Events
- Remove Shared Calendars
- Sync Okta Admin roles and OAuth App Scopes for fuller visibility into privileged access
- Run any custom PowerShell script directly from within Lumos - now generally available
- Sync Permission Set Groups and Queues as new entitlement types, automatically fetched in future syncs
- Instance Admins are now synced as an entitlement type and will be automatically fetched in future syncs
- Sync Team information as a new entitlement type, automatically fetched in future syncs
- Remove a user from all groups except the domain group, with optional filtering to exclude specific groups from removal
- Sync and provision to HR Profile Custom Attributes when creating and updating accounts
- Assign site-based role access across all Atlassian products
- Deeper coverage for offboarding and deprovisioning workflows across your stack
- More entitlement types visible in Lumos without manual configuration
- Custom automation flexibility via PowerShell for unique business requirements
Identities
Coming the first week of April.Lumos Members Moved to Settings
The Lumos Members page has a new home. You’ll now find it under Settings instead of the Identities tab - with a cleaner table view showing name, email, employment status, delegation status, and access level, all filterable, sortable, and searchable. Benefits:- Easier to find and manage who has access to Lumos and at what level
- Cleaner separation between identity data and member management
- View and manage delegation and access levels all in one place