> For the complete documentation index, see [llms.txt](https://docs.threatdefence.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.threatdefence.com/siem-integrations/password-managers/1password-1.md).

# LastPass Business

By integrating **LastPass Business** with **ThreatDefence** via the **LastPass Enterprise API**, you can seamlessly ingest user activity and audit event data into ThreatDefence for centralized monitoring and response.

This integration enhances visibility into:

* User authentication events such as logins and failed login attempts
* Administrative actions including user provisioning and role changes
* Shared folder access and policy modifications
* Master password and multifactor authentication changes

It enables more effective detection of unauthorized access, credential-based threats, and suspicious administrative activity across your LastPass environment.

Events are collected across **all users** in your LastPass organisation — not limited to admin accounts. This provides full coverage of user-level activity alongside administrative actions.

***

## Requirements

* Access to your **LastPass Admin Console** at `admin.lastpass.com` with **Admin** or **Super Admin** privileges
* A **LastPass Business** or **Teams** plan — API access is not available on Free or Premium plans

***

## Step 1. Retrieve Your Account Number (CID)

Your **Company ID (CID)** is a numeric identifier required for every API call. To find it:

1. Sign in to the LastPass Admin Console at **<https://admin.lastpass.com>**.
2. In the left sidebar, navigate to **Dashboard**.
3. Your **Account Number** is displayed at the top of the Dashboard page.

Note this value — you will need it when configuring the ThreatDefence integration.

***

## Step 2. Generate a Provisioning Hash

> **Note:** The **Advanced - Enterprise API** option is only visible in the Admin Console if API access is enabled on your LastPass Business plan. If you do not see this option, contact [LastPass Support](https://support.lastpass.com/) to confirm that Enterprise API access is provisioned for your account.

The **Provisioning Hash** is a secret token used to authenticate API requests. It is generated from the Admin Console:

1. Sign in to the LastPass Admin Console at **<https://admin.lastpass.com>**.
2. In the left sidebar, navigate to **Advanced** → **Enterprise API**.
3. Under the **Provisioning Hash** section, click **Generate** (or **Reset** if one already exists).
4. Copy the displayed hash and store it securely.

**Important:** The provisioning hash grants API access to your LastPass organisation. Store it securely and do not share it. If you reset the hash, any existing integrations using the previous value will stop working until updated.

For more information on the LastPass Enterprise API, refer to the official documentation:\
[LastPass Enterprise API Documentation](https://support.lastpass.com/s/document-item?language=en_US\&bundleId=lastpass\&topicId=LastPass/api-enterprise.html)

***

## Step 3. Configure ThreatDefence Integration

Provide the following information to your ThreatDefence representative at **<support@threatdefence.com>**:

* Account Number (CID)
* Provisioning Hash | (API\_KEY)

***

## Support

For questions or assistance, please contact:\
📧 **<support@threatdefence.com>**


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.threatdefence.com/siem-integrations/password-managers/1password-1.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.