Skip to main content
Most NHI connectors run a real sync that reads your non-human accounts, credentials, and entitlements into the NHI Inventory. On those, the sync status means what it says: a failure means the run did not complete and your inventory did not update. GitHub (NHI) is the exception. It authorizes the security agent to read your organization directly and syncs nothing, so its status is not a signal either way. An earlier version of this page told you to ignore a failed sync on every NHI connector. That now applies only to GitHub (NHI).

​
What the sync status tells you

On the connector’s “Integrations” tab, “Sync” shows one of four states.
  • Never synced. No run has completed yet.
  • Syncing. A run is in progress. Clicking “Sync” again tells you a run is already going rather than starting a second one.
  • Synced. The last run completed.
  • Failed. The run did not complete, with a short message describing what went wrong.
The same status appears in the “Sync Status” column on your connected integrations list, so you can sort and filter on it there. The tab is shorter than on your other integrations. Sync history, identity matching, offboarding workflows, attribute sync, and circuit-breaker settings do not apply to non-human accounts, so they are not shown. You can start a sync yourself at any time with “Sync”. To find out how often syncs run on their own for your tenant, ask your Lumos account team.

​
When Failed is real

On Entra, AWS, OpenAI, and Anthropic, Failed means the run did not complete and your inventory was not updated. Start with the message under the status. The most common causes are credential and permission problems.
  • An Entra client secret expired. Microsoft caps them at 24 months. Create a new secret in Entra and update it in Lumos.
  • The AWS trust configuration drifted. The role ARN, External ID, and trust policy all have to still match what your Lumos setup form shows, including the Lumos Customer Integrator Role ARN in the trust policy.
  • An AWS policy statement was removed while its setting is still on. The run fails with an AccessDenied error. Either restore the statement or switch the matching setting off in Lumos.
  • An OpenAI or Anthropic key was rotated or revoked. Update the key in Lumos.
If the message does not point at one of those, send it to Lumos support along with the connector name.

​
GitHub (NHI) is different

GitHub (NHI) does not sync. It authorizes the NHI security agent to read your organization directly, so a sync error on its tile can be ignored. The signal that it is working is findings arriving after the agent runs. A “Connection lost” banner is still real on GitHub (NHI), and means the OAuth App or GitHub App credentials were revoked, expired, or uninstalled.

​
Where the data lands

A successful sync updates your NHI Inventory at Identities → Non-Human Identities. If a sync succeeded and you do not see the inventory in your navigation, that is a separate question from the connector. The inventory is enabled per domain, so ask your account team. Security findings are separate again. The agents described in NHI Security run on their own schedule, so a healthy sync and a quiet agent are not a contradiction.

​
Frequently asked questions

No. Microsoft Entra ID for identity sync and Microsoft Entra ID (NHI) are separate integrations, and the same is true for AWS and GitHub. One failing has no effect on the other.
Not as a first step. Read the message, fix the credential or permission it names, then run the sync again. Reconnecting is only needed after a “Connection lost” banner or a credential rotation.
On Entra, AWS, OpenAI, and Anthropic that means no run has completed yet. Click “Sync” to start one. On GitHub (NHI) it is the permanent state and nothing is wrong.