KeySkopeAvailable · Reviewed 2026-09-18
Before you start
- Access to create an API client in the Falcon tenant.
- The correct API cloud region for that tenant.
Read-only permissions
| Setting | Purpose / value |
|---|---|
| User Management: Read | Read console users and role assignments. Check endpoint scopes in the User Management reference; no write scope is required. |
Connect CrowdStrike Falcon
- Open Falcon → Support and resources → API clients and keys and create a dedicated client.
- Enable the read scope for User Management. If your console exposes User Roles separately, enable its Read permission only.
- Copy the client ID and secret securely.
- Choose the API host for the tenant: US-1 api.crowdstrike.com, US-2 api.us-2.crowdstrike.com, EU-1 api.eu-1.crowdstrike.com, or your documented government-cloud host.
- Enter the API base URL and credentials in KeySkope. Run a sync and compare a console user’s role assignments with Falcon.
Connection fields
| Setting | Purpose / value |
|---|---|
| base_url | HTTPS Falcon API host for your cloud. |
| client_id / client_secret | Read-only API client credentials. |
What appears in KeySkope
- Console users, assigned roles and available login timestamps. No hosts, detections or endpoint data.
- KeySkope currently groups Falcon console roles as privileged console access; the role name provides the detail for review.
Verify the first sync
- Wait for the sync to finish and review its status and any partial-collection notes.
- Compare the same account population in both systems. Check an account identifier, status and assigned role—not just the total.
- For a controlled test account, change its access in the source, sync again and verify the result. Keep approvals in your normal process.
- Record the credential owner and expiry. Rotate the credential in the source, update KeySkope and verify another sync before retiring the old credential.
Troubleshooting
| Setting | Purpose / value |
|---|---|
| 403 | Check the API region and User Management read scope. |
| User count differs | Compare Falcon console users, not device users or hosts; these are different populations. |
Official references
Vendor documentation reviewed on 2026-09-18. Setup has been checked against the connector implementation. A documentation review is not a live validation of every plan or tenant.
Ready to connect?
Open Connectors in your KeySkope workspace. Enter credentials only in the authenticated connection form.
Use your organisation’s dedicated KeySkope URL from an allowed network. Your workspace administrator can provide the address.