Lumos review

Lumos is an identity management and governance platform for controlling access across employees, service accounts, keys, tokens, and AI agents. Its stated scope goes beyond employee onboarding and offboarding: it also covers non-human identities and connections involving MCP servers.

The platform is designed to automate access requests, periodic reviews, and lifecycle workflows. It can grant just-in-time access for a limited period and revoke it on schedule. For governance teams, Lumos says it can find service accounts, assign owners, flag dormant or overscoped identities, and catalog tools and data exposed through MCP servers.

It also includes role mining, which uses access patterns to propose roles intended to support least privilege. The pitch is broad identity governance, not just an employee directory or single sign-on product. Buyers should still confirm which integrations and workflows fit their environment before treating that breadth as usable coverage.

Lumos’s strongest case is the range of identity work it says it can handle in one governance program. Many teams need to manage employee access alongside credentials and automated identities that do not fit neatly into a standard joiner-mover-leaver process. Lumos explicitly includes those non-human identities and AI-related access in its scope.

The feature set also connects routine controls to operational work:

• Access reviews can automate reviews, certify straightforward access, and prepare auditor evidence.
• Lifecycle workflows cover joiners, movers, and leavers, including access removal and license reclamation.
• Just-in-time access is time-limited, with revocation scheduled rather than left to a later cleanup.
• NHI governance is intended to find service accounts, keys, and tokens, assign owners, and flag dormant or overscoped identities.
• MCP governance can discover servers, catalog exposed tools and data, and flag unapproved connections.
• Role mining proposes roles from access patterns to support least-privilege policies.

That is useful breadth on paper, particularly for teams trying to bring overlooked identities into access reviews instead of managing them in separate spreadsheets.

The clearest drawback is that Lumos is difficult to price or size up before talking to sales. The pricing information available to us, checked November 6, 2026, is low-confidence and lists custom quotes, with no published starting price, unit, monthly or annual terms, or plan inclusions. It indicates no free plan; a free-trial policy is not published in the information we have.

There are no public seat, identity, workflow, review, or connector caps in the published pricing details. That does not mean usage is unlimited; it means buyers cannot compare those limits before requesting a quote. Ask for pricing tied to your employee count and non-human identity inventory, and get any thresholds, overages, and implementation costs in writing.

The feature list is also not a substitute for a fit check. The materials here do not specify supported integrations, deployment requirements, or how access certifications and MCP discovery work in a particular environment. Lumos’s breadth is promising, but the details that determine rollout effort and total cost remain unconfirmed.

According to the pricing information checked on November 6, 2026, Lumos does not publish a starting price. The only listed option is a custom quote for businesses, so there is no published tier-to-tier price jump to compare. You will need to contact sales to find out what your setup costs.

Monthly and annual billing terms are not published. The pricing information lists no free plan, and trial terms are not published. Add-ons are also not itemized, so we can’t tell whether capabilities such as just-in-time access, non-human identity governance, or MCP governance cost extra or are included in a quote. The listed plan’s inclusions are not specified either.

That leaves buyers without the numbers needed to compare Lumos with other identity-governance tools before a sales call. Ask for a written quote that spells out the included features, billing term, any usage or identity limits, and the cost of adding products or expanding coverage. Those details are not published in the available pricing information.

The published material does not document Lumos’s migration process, supported import formats, data-export options, or implementation effort. Before switching, ask how it connects to your identity sources and applications, which access records and ownership details it can bring over, and whether you can export review evidence and workflow data if you leave. Those are questions to verify, not published capabilities.

Lumos covers employee and machine access, AI agents, access reviews, lifecycle workflows, and role mining, so map which of those you need before scoping a migration. Existing access rules, review cycles, and service-account ownership are sensible items to inventory; the source does not say Lumos migrates them automatically. Its custom-quote pricing also makes it harder to estimate switching cost without a sales discussion.

No Reddit posts or comments were included in the published material, so we can’t report what users say makes them leave Lumos. Treat retention, export rights, and offboarding support as vendor questions, not established complaints.