LastPass Business

By integrating LastPass Business with ThreatDefence via the LastPass Enterprise API, you can seamlessly ingest user activity and audit event data into ThreatDefence for centralized monitoring and response.

This integration enhances visibility into:

• User authentication events such as logins and failed login attempts

• Administrative actions including user provisioning and role changes

• Shared folder access and policy modifications

• Master password and multifactor authentication changes

It enables more effective detection of unauthorized access, credential-based threats, and suspicious administrative activity across your LastPass environment.

Events are collected across all users in your LastPass organisation — not limited to admin accounts. This provides full coverage of user-level activity alongside administrative actions.

---

Requirements

• Access to your LastPass Admin Console at admin.lastpass.com with Admin or Super Admin privileges

• A LastPass Business or Teams plan — API access is not available on Free or Premium plans

---

Step 1. Retrieve Your Account Number (CID)

Your Company ID (CID) is a numeric identifier required for every API call. To find it:

1. Sign in to the LastPass Admin Console at https://admin.lastpass.com.

2. In the left sidebar, navigate to Dashboard.

3. Your Account Number is displayed at the top of the Dashboard page.

Note this value — you will need it when configuring the ThreatDefence integration.

---

Step 2. Generate a Provisioning Hash

Note: The Advanced - Enterprise API option is only visible in the Admin Console if API access is enabled on your LastPass Business plan. If you do not see this option, contact LastPass Support to confirm that Enterprise API access is provisioned for your account.

The Provisioning Hash is a secret token used to authenticate API requests. It is generated from the Admin Console:

1. Sign in to the LastPass Admin Console at https://admin.lastpass.com.

2. In the left sidebar, navigate to Advanced → Enterprise API.

3. Under the Provisioning Hash section, click Generate (or Reset if one already exists).

4. Copy the displayed hash and store it securely.

Important: The provisioning hash grants API access to your LastPass organisation. Store it securely and do not share it. If you reset the hash, any existing integrations using the previous value will stop working until updated.

For more information on the LastPass Enterprise API, refer to the official documentation: LastPass Enterprise API Documentation

---

Step 3. Configure ThreatDefence Integration

Provide the following information to your ThreatDefence representative at [e-mail]:

• Account Number (CID)

• Provisioning Hash | (API_KEY)

---

Support

For questions or assistance, please contact: 📧 [e-mail]