# Slack

Probo reads your Slack workspace members through the `users.list` API. For each member it records the role and whether two-factor authentication is turned on. Slack connects through OAuth only, so there is no API key to create or paste.

:::caution
Connect Slack while signed in as a workspace **Admin**, **Owner**, or **Primary Owner**. Probo acts with the user token of the person who authorizes it, and Slack only returns a member's two-factor authentication status when the caller is a workspace admin. Probo refuses the connection unless the person who authorizes it is an Admin, Owner, or Primary Owner.
:::

## Prerequisites

- Probo organization administrator access
- The **Admin**, **Owner**, or **Primary Owner** role in the Slack workspace you want to review

## Collected Fields

| Probo field | Slack field                                                                        | Notes                                                                                                                                              |
| ----------- | ---------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| Name        | `real_name`                                                                        |                                                                                                                                                    |
| Email       | `profile.email`                                                                    | Members without an email address are not listed, which in practice leaves out bots and apps                                                        |
| Role        | `is_primary_owner`, `is_owner`, `is_admin`, `is_restricted`, `is_ultra_restricted` | One of `Primary Owner`, `Owner`, `Admin`, `Restricted` (multi-channel guest), `Ultra Restricted` (single-channel guest), or `Member`               |
| Admin       | `is_admin`, `is_owner`, `is_primary_owner`                                         | Admin when any of the three is true                                                                                                                |
| Status      | `deleted`                                                                          | Inactive when the member is deactivated                                                                                                            |
| MFA         | `has_2fa`                                                                          | Enabled or Disabled. Unknown when Slack leaves the field out, as it can for deactivated members, and for every member when the token cannot see it |
| Last login  |                            |                                                                                                                                                    |
| External ID | `id`                                                                               | Slack member ID, used to track the account across reviews                                                                                          |
| Created at  |                            |                                                                                                                                                    |

Probo also records each member's job title from `profile.title`.

Probo reads MFA only from the `has_2fa` value Slack reports. If your members sign in to Slack through an identity provider, check their MFA status in that provider as well.

## Connect Slack

1. In Probo, go to **Settings** > **Connectors** and click **Add more** to open the **Marketplace**.
2. Find **Slack** and open it.
3. Enter a **Name** for the connection (e.g. `main`) and click **Connect**.
4. Sign in to Slack as a workspace admin or owner, pick the workspace you want to review, then click **Allow**. Probo requests the **`users:read`** and **`users:read.email`** user scopes.
5. Go to **Access Review** > **Sources**, click **Add sources**, tick **Slack**, and click **Add**.

Probo names the source after the Slack workspace and pulls its members into your campaigns. Each connection covers one workspace. To review several workspaces of an Enterprise Grid organization, connect each workspace separately.

## Troubleshooting

- **"Slack must be connected by a workspace admin or owner, the only role Slack shares MFA status with."** The person who authorized Probo is not an admin or owner of the workspace, so Probo rejected the connection. Connect Slack again from the **Marketplace** and authorize as an **Admin**, **Owner**, or **Primary Owner**.
- **The source says Slack is disconnected.** The token was revoked, for example because the person who authorized Probo left the workspace or removed the app, or the connection predates MFA collection and still uses a bot token, which cannot read it. Open the Slack connector in **Settings** > **Connectors**, click **Reconnect**, and authorize as a workspace admin or owner.
- **The source says Slack refused this request.** The person who authorized the connection is no longer an admin or owner, so Slack stopped returning MFA status to their token. Click **Reconnect** on the Slack source in **Access Review** > **Sources** and authorize as a current admin or owner.
- **A member is missing.** Probo skips Slackbot and every member without an email address, which in practice leaves out bots and apps.