Sync Circuit Breakers

Background

Lumos syncs mirror account, identity, and entitlement data from your connected apps. Sometimes a source system returns bad data: a truncated response, an authentication failure, or an unexpected mass status change. Without a safeguard, Lumos installs that data as if the change were intentional, deactivating or removing accounts and identities at scale.

Circuit Breakers evaluate every full integration sync before its data is installed. When a sync would make a change that looks catastrophic, Lumos halts that sync and flags it instead of applying it. Four rules are enabled by default for every app in your domain, and you can adjust or disable each one — globally or on an individual app. Lumos records every change you make in the Activity Log, with the value before and after.

Related: 📄 Sync Visibility · 📄 Activity Log

Why Use This

• A source outage returns nothing. A vendor API returns zero accounts during an outage. Without a breaker, every account for that app is marked inactive and downstream deprovisioning follows. The Empty account response rule halts the sync instead.

• A truncated response looks like offboarding. A partial payload arrives with most accounts missing. Lumos would read the absence as removal and offboard those people. The Mass account absence rule halts the sync.

• A connector regression reports mass deactivation. A source starts reporting most active accounts as deactivated. The Mass account deactivation rule halts the sync before those users lose access.

• A legitimate large change is planned. You are running an org restructure that will deactivate most accounts on one app. Raise that rule's threshold on that app, run the sync, then set it back.

Prerequisites

• The Admin role, or a role with permission to manage domain settings.

• An integration that uses the full integration sync. Circuit Breakers do not evaluate other pipelines.

The Four Rules

Threshold is the percentage at or above which the rule trips. Minimum sample is the number of records the app must have before the rule is evaluated at all, so small apps do not raise false alarms. A rule with a minimum sample of 10 is skipped when the app has fewer than 10 active records.

Empty account response has no threshold or minimum sample to configure. It trips whenever a sync returns zero accounts.

Configuring Rules for Your Domain

Domain settings define the default posture for every integration you have connected.

1. Navigate to Settings → Circuit Breakers. The Circuit Breaker Rules card lists all four rules with their current state.

2. Click "Edit" to make the card editable.

3. Toggle a rule On or Off. A rule that is On halts the sync when it trips. A rule that is Off is not evaluated.

4. Enter a new Threshold percentage for a ratio-based rule. A higher threshold makes the rule less sensitive. A lower threshold makes it more sensitive.

5. Enter a new Min sample value. Raising this value keeps the rule quiet on apps with few records.

6. Enter a Reason for change. The reason is required and is recorded in the Activity Log for every rule the save touches.

7. Click "Save Changes".

To discard edits before saving, click "Cancel". To return every rule to the Lumos defaults, click "Reset to Default".

Domain settings apply to every app and take effect on each app's next sync. Apps with their own override keep that override.

Overriding Rules on a Single App

Each app follows the Lumos default until you change a value on the app itself. Once you do, that value is pinned to the integration and stops tracking the default. Use an override when one app behaves differently from the rest — a chronically empty app, or an app critical enough to warrant a stricter threshold.

1. Navigate to Apps and select the app.

2. Open the Integrations tab.

3. Locate the Circuit Breaker Rules card.

4. Click "Edit", change the values for that app, enter a Reason for change, and click "Save Changes".

Override one app rather than loosening a domain default. A domain change removes protection from every integration you have connected.

Reviewing Changes in the Activity Log

Every save is recorded in the Activity Log, so you can see who changed a rule, when, why, and what the value was before.

1. Navigate to Activity Log.

2. Search for Circuit Breaker, or filter the Event Name column.

3. Expand an entry to see the detail.

Each entry shows:

• Event Name — Updated Sync Circuit Breaker Settings

• App Name — the integration the change applied to, for changes made on a single app

• Actor — the admin who made the change

• Timestamp — the date and time of the save

• Scope — whether the change applied to this integration or to the domain

• Reason — the reason the admin entered when saving

• Each rule that changed — listed by name with its value before and after, such as Enabled: On → Off

• A note when a value is now pinned to the integration rather than following the Lumos default

To keep a record outside Lumos, click "Download Table (CSV)" on the Activity Log.

What Happens When a Rule Trips

If an enabled rule trips, Lumos halts the sync before installing its data. On the app's Integrations tab, the run is marked as blocked by a circuit breaker and shows the expected value, the actual value, and the threshold that was crossed. Downstream stages move to Waiting.

A halted sync is not data loss. Nothing was written, your existing data in Lumos is unchanged, and the next sync proceeds normally once the source returns healthy data.

To resolve a halted sync:

1. Review the expected, actual, and threshold values on the blocked run.

2. Confirm what the source system returned. A trip most often means the source is wrong, not Lumos.

3. If the source had a problem, resolve it and let the next sync run.

4. If the change was legitimate, raise the threshold or turn that rule off for the app, then run the sync again.

Apps That Return Zero Accounts

Some apps legitimately have no accounts to return — an empty group in a multi-instance connector, or an app configured but not yet in use. Empty account response trips on every sync for those apps, because zero remains the correct answer each time.

For an app that is expected to return zero accounts, turn Empty account response off for that app on its Integrations tab. That is the intended use of a per-app override.

Limitations

• Circuit Breakers evaluate only integrations that use the full integration sync.

• There is no warn-only mode. A rule that is enabled halts the sync when it trips.

• Rules cannot be scheduled or temporarily suspended. To allow a planned mass change, adjust the threshold or disable the rule for that app, then restore it.

• Circuit Breaker rules are not available in the Lumos API.

• Mass identity deactivation is evaluated only where an app is coalesced onto your identities.

FAQ

Do the defaults apply to apps I connected before this change? Yes. Domain settings apply to every app in your domain and take effect on each app's next sync.

Can a rule block a sync partway through installation? No. Rules are evaluated before data is installed. A halted sync installs nothing.

Who can change these settings? Admins in your domain. Every save requires a reason for change and appears in the Activity Log with the before and after value of each rule that changed.

Can I tell whether a value came from the domain default or was set on the app? Yes. The Activity Log notes when a value is pinned to the integration instead of following the Lumos default.

Can I set a different threshold for each app? Yes. Each app can override any field independently of the domain default.

Does a halted sync affect my other apps? No. Rules are evaluated per app, and a halted sync stops only that app's run.

Questions? Contact your Lumos account team or open a support ticket.