Skip to main content
Connect Intercom to Oleria to see which teammates can administer your Intercom workspace, which roles and teams they hold, which apps hold access tokens to it, and what admin actions they take.

​
What Oleria discovers

  • Users - Intercom admins (teammates), from the admin list, with last sign-in, sign-in methods, last password reset and two-factor status taken from the admin activity log
  • Roles - each admin’s assigned role, as roles and role assignments
  • Teams - Intercom teams, mapped as groups, and each admin’s team memberships
  • Non-human identities - Developer Hub apps found in the admin activity log, with their access tokens and client secrets as credentials and, where the log records it, the admin who installed each app as its owner. For OAuth connections, the Oleria app itself is included too
  • Activity - admin activity-log events (audit trail of admin actions in the workspace)

​
Prerequisites

  • Administrator permission on the Oleria workspace.
  • An Intercom teammate with access to your workspace’s Developer Hub (Private App Access Token), or permission to install apps (OAuth).
  • For team membership remediation, that teammate also needs permission to manage teams (Settings -> Workspace -> Teammates).
  • We recommend a dedicated Developer Hub app for Oleria, not one shared with other integrations, so you can rotate or revoke its token on its own.
Oleria’s Intercom integration supports workspaces on Intercom’s US data region only. EU and Australia region workspaces aren’t supported - connecting one fails at authentication.

​
Create a private app access token in Intercom

Skip this section if you connect with OAuth.
1

Open the Developer Hub

Sign in to Intercom and go to the Developer Hub, then open (or create) an app for this integration.
2

Grant scopes

Under Configure -> Authentication, grant the app the following scopes:
  • read_admins
  • read_admin_activity_logs
  • read_users_companies
Intercom doesn’t document which scope covers its Teams endpoint. Oleria requests read_users_companies in case it does. Authenticate checks that teams can be read, so a missing scope shows up when you connect.
3

Create the access token

From the same Authentication page, create an Access Token. Copy it now - Intercom shows it only once.

​
Connect Intercom to Oleria

1

Open the integration

Sign in to your Oleria workspace, navigate to Integrations, and select Intercom.
2

Complete the connection form

Fill in the connection form:With OAuth, Intercom asks you to approve the read_admins, read_admin_activity_logs and read_users_companies scopes.
Authenticate also reads your Intercom teams, workspace details and admin activity log, and fails if the credential can’t read them.
3

Authenticate

Select Authenticate to complete the connection.

​
Verify the integration

Confirm the Intercom instance appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, you can review the discovered admins, roles, teams, apps and admin activity in your Oleria workspace.

​
Remediation actions

Oleria can add a teammate to an Intercom team and remove one from a team, and can undo either change.
  • Intercom offers team membership changes only in its Preview API version. Oleria uses that version for these two changes alone; everything else it reads uses a stable version.
  • Intercom replaces a team’s whole member list on every change, so Oleria reads the team first and keeps every other member and their assignment priority.
  • Intercom doesn’t allow an empty team, so Oleria can’t remove a team’s last member.
  • The teammate who authorized Oleria’s app (or approved OAuth) must be able to manage teams. If Intercom’s Preview API isn’t available to your workspace, the change fails with a permission error and nothing is changed.

​
Known limitations

  • Intercom’s roles endpoint is available only in its Preview API, so Oleria derives roles from the roles assigned to admins. A role no admin holds isn’t shown.
  • Intercom has no API that lists Developer Hub apps or their tokens. Oleria finds an app only when the activity log records its access token or client secret being revealed or copied in the Developer Hub. Fin AI agents aren’t listed by any Intercom API, so they aren’t discovered.
  • Intercom’s admin records have no sign-in, password or two-factor fields. Oleria reads sign-ins from the last 90 days of the activity log, and password resets and two-factor changes from the whole log Intercom keeps. An admin with no such event shows the value as unavailable. Workspace-wide two-factor and SAML enforcement settings can’t be read.
  • Intercom’s API has no way to disable, suspend or change the role of a teammate. Removing a teammate is permanent and needs someone to take over their work, and creating one is possible only through SCIM from your identity provider, so Oleria does neither. Teammate lifecycle and roles are managed in Intercom’s own admin console.
  • Contacts and Companies in Intercom aren’t synced as resources - this integration covers workspace access (admins, roles, teams, apps) and admin activity only.

​
Contact us

For questions about this integration, contact us at support@oleria.com.