Integrate with GitHub Enterprise Cloud – Enterprise Accounts

Use JumpCloud SAML Single Sign On (SSO) to give your users convenient but secure access to all their web applications with a single set of credentials. Automatically provision, update and deprovision users and groups in Github Enterprise Cloud from JumpCloud using the SCIM integration. Leverage this integration to centralize user lifecycle, user identity, and group management in JumpCloud for Github Enterprise Cloud. Save time and avoid mistakes, as well as potential security risks, related to manually creating users.

Read this article to learn how to setup the GitHub Enterprise Cloud - Enterprise Accounts integration.

Prerequisites

• A JumpCloud administrator account
• JumpCloud SSO Package or higher or SSO add-on feature
• GitHub Enterprise Managed Users enterprise account
• A setup admin user account with 2FA configured
• A personal access token:
  • You must be signed in as the setup user when the token is created
  • The token must have at least the scim:enterprise scope
  • The token must have no expiration
• Your GitHub Enterprise name

Creating a new JumpCloud Application Integration

1. Log in to the JumpCloud Admin Portal.

Important

If your data is stored outside of the US, check which login URL you should be using depending on your region. If your organization uses LDAP, RADIUS, or requires firewall allow list configuration, the Fully Qualified Domain Names (FQDNs) will also be region specific. See JumpCloud Data Centers for the URLs, FQDNs, and IP addresses.

2. Go to Access> SSO Applications.
3. Click + Add New Application.
4. You can also enter the name of the application in the Search field and select it.
5. You can either select an application from the available list or select Custom Application, and click Next.
6. Select the required options from the Select Options page and click Next. The Enter General Info page is displayed.
7. On the Enter General Info page, you can customize the display label, description and how the application displays:
   • Description - add a description that users will see in their user portal
   • User Portal Image - choose Logoor Color Indicator
   • Show in User Portal - select to ensure the app is visible in the user portal
8. Optionally, expand the Advanced Settings section and customize the IdP URL:
   • Enter a custom value to replace the default application name in the SSO IdP URL endpoint ( https://sso.jumpcloud.com/saml2/{custom_value})

warning

The SSO IdP URL is not editable after the application is created. If you need to change this URL later, you must delete and recreate the connector.

9. Click Save Application.
10. Next, click:
    • Configure Application and go to the next section
    • Close to configure your new application at a later time

tip

Users are implicitly denied access to applications. See Authorize Users to an SSO Application.

note

Linking the Application to AI Gateway

• The sections below walk through SSO configuration for this application. When that is complete, you can connect this application to JumpCloud AI Gateway so users can access its data from supported AI clients (for example, Cursor or ChatGPT).
• Register the MCP server under Access > AI Gateway and link it to this application. The server appears under Servers in AI Gateway. When you open the application from Access > SSO Applications, the same server appears on the application's AI Gateway tab.
• Not all applications support MCP. Confirm support with the application vendor or see Configure AI Gateway Integrations to learn more about supported integrations.

Configuring the SSO Integration

To navigate to your JumpCloud SSO connector

1. Log in to the JumpCloud Admin Portal.

Important

If your data is stored outside of the US, check which login URL you should be using depending on your region. If your organization uses LDAP, RADIUS, or requires firewall allow list configuration, the Fully Qualified Domain Names (FQDNs) will also be region specific. See JumpCloud Data Centers for the URLs, FQDNs, and IP addresses.

2. Go to Access > SSO Applications.

3. Create a new application or select it from the Configured Applications list.

4. Select the SSO tab.

To configure JumpCloud

1. Replace any instances of ENTERPRISE_SLUG with your GitHub Enterprise name.
2. In the Login URL, enter https://github.com/enterprises/{EMU_SLUG}/sso.
   • Replace EMU_SLUG with your GitHub Enterprise name
3. Optionally, configure:

MFA Claims

note

The Authentication Methods References (AMR) is automatically included in the SAML assertion by default. No additional configuration is required to enable this.

Complete the MFA Claim Configuration to define how the authentication context is sent in the SAML assertion.

1. Under Auth Context, choose one of the following options based on your SP's requirements:
   • Send a single value for all successful MFA factors - select if the Service Provider accepts a generic confirmation for any MFA login. Enter the single URL or URN they accept
   • Send specific factors - select this option to map individual JumpCloud MFA methods to distinct values. In the Factor Mapping table, add each MFA factor enabled in your organization and enter the corresponding value required by the Service Provider
   • Send single value and specific factors - select to send both a generic identifier and specific factor details in the assertion

tip

Refer to your Service Provider's documentation to determine the specific URN or URL values required (e.g., Salesforce Session Security Levels). The values entered in this configuration must exactly match what the Service Provider expects.

MFA Factor	Service Provider	Notes
Password	Reference your Service Providers's documentation for the values they expect for each factor
TOTP
WebAuthN
Push Notification		JumpCloud Protect or other authenticator application
Duo Security
Device Trust
Device Trust + User Verification		JumpCloud Go (requires explicit configuration - see the next table)
API Key
External Identity Provider

MFA Method	MFA Value in AMR Claim
apikey	swk
duo	mfa
pwd	pwd
totp	otp
unk
wan	hwk
push	mfa
uv
durt	hwk
durt_uv	hwk
ext_idp

Learn more about MFA Claims.

Attributes

Configure User Attributes to be sent to the SP in assertions. User attributes are unique to each user. You can include attributes for standard user detail attributes or for custom attributes. For example, you can include standard attributes for users’ employee ID and department, or you can include a custom attribute for users’ application ID. Standard attributes are configured in the User Panel Details tab's User Information andEmployee Information sections.

Unlike user attributes, a Constant Attribute can be sent for every user in a specific group or application profile.

note

If required attributes are present, they are not editable.

1. Under User Attributes, click add attribute:
   • Service Provider Attribute Name - enter the service provider’s name for the attribute
   • JumpCloud Attribute Name - select the corresponding attribute from the drop down list
2. Repeat these steps for any desired user or custom attributes.
3. Under Constant Attributes, click add attribute:
   • Service Provider Attribute Name - enter the service provider’s name for the attribute
   • Value - enter the corresponding attribute in JumpCloud
4. Optionally, if groups are supported, select Include Group Attribute.

Learn More

4. Click Save.

Download the certificate

1. If you closed the application, find it in the Configured Applications list and click anywhere in the row to reopen its configuration window.
2. Click Actions > Download Certificate.

tip

The certificate.pem will download to your local Downloads folder.

To configure GitHub Enterprise Cloud – Enterprise Accounts

1. Sign in to GitHub.com with your setup admin user.
2. Go to Enterprise settings > Identity Provider and select SAML.
3. Enter the following information:
   • Sign On URL - copy and paste the JumpCloud IDP URL
   • Issuer - copy and paste the JumpCloud IdP Entity ID
   • Public Certificate - copy and paste the certificate downloaded in the previous section
4. Test the SAML connection.
5. If successful, click Save SAML Settings.
6. Download the recovery codes and enable SAML.

Authorizing SSO Application Access

Users are implicitly denied access to SSO Applications. After you connect an application to JumpCloud, you need to authorize user access to that application. You can authorize user access from the Applications, Users List or User Groups page.

To authorize user access from the SSO Application’s page

1. Log in to the JumpCloud Admin Portal.

Important

If your data is stored outside of the US, check which login URL you should be using depending on your region. If your organization uses LDAP, RADIUS, or requires firewall allow list configuration, the Fully Qualified Domain Names (FQDNs) will also be region specific. See JumpCloud Data Centers for the URLs, FQDNs, and IP addresses.

2. Go to Access > SSO Applications, then select the application to which you want to authorize user access.
3. Select the User Groups tab. If you need to create a new group of users, see Get Started: User Groups.
4. Select the check box next to the desired group of users to which you want to give access.
5. Click Save.

To learn how to authorize user access from the Users or User Groups pages, see Authorize Users to an SSO Application.

Authorizing agent access

Agents are implicitly denied access to SSO applications. After you configure SCIM for a supported application, bind one or more agent groups on the application to grant agents access and start agent provisioning.

Agent access is managed through agent groups only. You cannot bind an individual agent directly to an application.

To authorize agent access from the SSO application page:

1. In JumpCloud Admin Portal, go to Access > SSO Applications and select the application.
2. Click the Agent Groups tab.
3. Select the checkbox next to each agent group that should have access to the application.
4. Click Save.

Agents in a bound agent group inherit access to the application. Removing an agent group removes access for the agents that inherited it through that group.

To authorize agent access from an agent group:

1. In JumpCloud Admin Portal, go to Identity Management > Agent Groups and select the agent group you want to configure.
2. Click the Applications tab.
3. Select the application and click Save.

note

Only applications that support agent identities appear for assignment from an agent group. If an application does not support agents, it is not available on the Applications tab.

Validating SSO user authentication workflow(s)

Check your SP's documentation to ensure that both workflows are supported.

IdP-initiated user workflow

• Access the JumpCloud User Console
• Go to Applications and click an application tile to launch it
• JumpCloud asserts the user's identity to the SP and is authenticated without the user having to log in to the application

SP-initiated user workflow

• Go to the SP application login - generally, there is either a special link or an adaptive username field that detects the user is authenticated through SSO

note

This varies by SP.

• Login redirects the user to JumpCloud where the user enters their JumpCloud credentials
• After the user is logged in successfully, they are redirected back to the SP and automatically logged in

tip

See Additional User Experience Considerations when setting up JumpCloud SSO.

Configuring the SCIM Integration

To enable the Open SCIM Configuration

To start your SCIM configuration:

1. Log in to GitHub with the setup account
2. From the setup account profile menu, select Enterprise
3. Click the Identity provider tab
4. Scroll down to the Open SCIM Configuration setting
5. Click the toggle to turn it On

To navigate to your JumpCloud SCIM connector

1. Log in to the JumpCloud Admin Portal.

Important

If your data is stored outside of the US, check which login URL you should be using depending on your region. If your organization uses LDAP, RADIUS, or requires firewall allow list configuration, the Fully Qualified Domain Names (FQDNs) will also be region specific. See JumpCloud Data Centers for the URLs, FQDNs, and IP addresses.

2. Go to Access > SSO Applications.

3. Create a new application or select it from the Configured Applications list.

4. Select the Provisioning tab.

To configure JumpCloud

1. Select or enter the following:
   • API Type - SCIM API
   • Base URL - https://api.github.com/scim/v2/enterprises/{EMU_SLUG}
   • Replace EMU_SLUG with your GitHub Enterprise name
   • Token Key - enter your Github personal access token (generated as a prerequisite)
   • Test User Email - enter your setup admin user's email
2. Click Test Connection.
3. Review and edit any user attribute mappings.
4. Click Save.

To configure GitHub Enterprise Cloud

To complete your setup you will need to update the role of at least one of your users to Enterprise
Owner. For more details on the Roles for Enterprise Managed Users, review the following documentation:

• Roles in an enterprise - GitHub Enterprise Cloud Docs
• REST API endpoints for SCIM - GitHub Enterprise Cloud Docs

Assigning the Enterprise Owner Role

Important

Before proceeding, it’s important that you complete all the SCIM setup steps and can confirm that your users have been provisioned within your GitHub Enterprise tenant.

note

Follow the legacy steps if the new fully customizable SCIM attribute mapping capabilities haven't been enabled for your organization. To have the capabilities enabled, contact your Customer Success Manager or Account Manager.

Legacy Method for Assigning Enterprise Owner Role

Assigning the Enterprise Owner Role via the Command Line

Follow the steps below

1. Obtain the externalIDand the IDfor the user whose role will be elevated to Enterprise Owner by personalizing (replacing values within the curly brackets) and executing the following call for a Users list:

curl --location 'https://api.github.com/scim/v2/enterprises/{{enterprise}}/Users' \
--header 'Authorization: Bearer {{setup_user_SCIM_token}}'

2. From the output, note the values for "externalID" and "id" for the user you want to make the Enterprise Owner.
3. Personalize (replacing values in the curly brackets) and execute the following call to elevate the user's role:

curl --location --request PATCH 'https://api.github.com/scim/v2/enterprises/{{enterprise}}/Users/b25e9296-20f9-11f0-8570-4d4bff8946ab' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer {{setup_user_SCIM_token}}' \
--data '{
"Operations":[{
"op":"replace",
"path" : "roles",
"value": [
{
"value": "enterprise_owner",
"primary": true
}
]
}
]
}'

4. You can confirm the Enterprise Owner role has been added from the output of this call.
5. Refresh your Enterprise Admin portal.
6. Go to the People Tab > Administrators and confirm users are displayed.
7. Log out as the setup admin and log back in with the new Enterprise Owner user's account.
8. You can now create organizations teams and assign roles.

Add a Mapping for Assigning Roles

1. Add the attribute mapping for the Roles in the GitHub SCIM integration configuration
   • Go to Access>SSO Applications from the left navigation menu
   • Search for your GitHub Enterprise Managed Accounts integration and click on it
   • Click the Provisioning tab
   • Expand the Export Attribute Mapping section
   • Click Edit
   • Click + Add Attribute
   • Select Expression
   • Enter notNullOrEmpty(jcUser.attributes) && notNullOrEmpty(jcUser.attributes.GitHubRole) ? [{"value": jcUser.attributes.GitHubRole, "primary": true}] : [{"value": "member", "primary": true}] in the JumpCloud Attribute column (replace GitHubRole with the name you plan to give the user custom attribute on the user record in the next step
   • Click the SCIM Attribute column and choose Custom User Attribute
   • Enter roles
   • Click Preview Mappings
   • Select one of the users who has the custom attribute on their user record and verify the roles array value
   • Select another user who does not have the custom attribute on their user record and verify the roles array value
   • Click Update
   • Click Save
2. Add a custom attribute to each JumpCloud user you want to assign the enterprise_owner role in GitHub
   • Go to Identity Management>Users from the left navigation menu
   • Click on the user you want to edit
   • Click the Details tab
   • Expand the Custom Attributes section
   • Click add new custom attribute
   • Enter the custom attribute name (e.g., GitHubRole)
   • Enter enterprise_owner
   • Click Save User
3. Verify all GitHub groups are connected to the app
4. Confirm the Enterprise Owner role has been added
   • Refresh your Enterprise Admin portal.
   • Go to the People Tab > Administrators and confirm users are displayed.
5. Log out as the setup admin and log back in with the new Enterprise Owner user's account.
6. You can now create organizations teams and assign roles.

Provisioning Agents with SCIM

JumpCloud provisions agents and agent groups to supported SCIM applications using the same SCIM connection you configured for users. You do not create a separate SCIM connection for agents.

• When an agent group is bound to a supported application, JumpCloud automatically creates, updates, and deprovisions agent accounts in that application based on the agent lifecycle in JumpCloud.

  • Agent group bound to the application: Agents in the group are provisioned when SCIM is active
  • Agent attribute changes: The downstream agent account is updated
  • Agent is suspended: The downstream account is set to inactive (active: false)
  • Agent is re-activated: The downstream account is re-enabled (active: true)
  • Agent group is unbound, or agent is removed from the group: The downstream account is deprovisioned

• Agents and users are provisioned independently. An agent is never created, updated, or deleted through the user provisioning path.

• There is no separate setting to turn agent provisioning on. If the application supports agents and an agent group is bound, agents in that group are provisioned automatically.

Group Management and agent groups

The Enable management of User Groups and Group Membership in this application setting on the Provisioning tab controls group push for both user groups and agent groups:

• When group management is enabled, user groups and agent groups (for applications that support agent groups) provision as SCIM groups.
• When group management is disabled, neither user groups nor agent groups are pushed as SCIM groups.
• Individual agent account provisioning is not controlled by the group management setting. Agents in a bound agent group are provisioned as accounts regardless of whether group push is enabled.

note

• Agent credentials, secrets, and tokens are never sent in a SCIM payload.
• To stop provisioning agents to an application, unbind the agent groups from the application or delete the agents in JumpCloud.

Attribute Mappings

The User Attributes/User Group Attributes table lists the Required and Optional Mappings that JumpCloud sends to the Service Provider. See Attribute Considerations for more information regarding attribute mapping considerations.

Learn about JumpCloud Properties and how they work with system users in our API.

Modifying Attributes

To add user attributes

Important

It's highly recommended you use all optional mappings. This creates a more complete user profile, enabling better automation and more accurate access management within the application.

1. From your connector’s configuration page, select the Provisioning tab.

2. Expand the User Attributes section and click Edit. The Edit Attribute Mappings table will open.

3. Scroll to the bottom of the table and click +Add Attribute.

4. Select one of the mapping types:

   • Direct Mapping (JSON Path) - send the value from a user attribute in JumpCloud directly to an attribute in the service provider
     • From the JumpCloud Attribute dropdown, select the desired attribute
       • If you choose “Custom User Attribute” you must type the name of the attribute exactly as it on the user details page. To see the dropdown again, you must delete the attribute and add a new attribute
     • From the SCIM Attribute dropdown, select the corresponding (destination) attribute
   • Expression - transform or combine multiple user attributes into a single, custom value before sending it to the service provider
     • Enter the expression in the JumpCloud Attribute field
     • From the SCIM Attribute dropdown, select the corresponding (destination) attribute
   • Constant - send a fixed, predefined value—like a specific company name —for every user to the service provider
     • This is a free text field with no validation, e.g., the attribute must match exactly, including case, to the corresponding attribute in the user record. Once the custom attribute is added, you must delete it and readd a new custom attribute to see the dropdown again.

5. Repeat these steps for additional attributes.

6. Click Preview Mappings to review the User Schema.

   • If you do not select a specific user from the Preview Filter dropdown, the schema will default to the first user.

7. Click:

   • Save and Sync to initiate an immediate full sync of the updated attributes
   • Update to initiate the update during the next modification of the user group's record, like adding a space to the Description field

To add group attributes

1. From your connector’s configuration page, select the Provisioning tab.
2. If not already enabled, toggle on Enable management of User Groups and Group Membership in this application.
3. Expand the User Group Attributes section and click Edit.
4. Click +Add Attribute.
5. Select one of the mapping types:
   • Direct Mapping (JSON Path) - send a dynamically pulled JumpCloud group value directly to an attribute in the SP. From the JumpCloud Attribute dropdown, select:
     • Custom User Group Attribute - the value will change to jcUserGroup.attributes.
       • Add a <value> (name of the group) at the end of the attribute (jcUserGroup.attributes.DevOps)
       • From the SCIM Attribute dropdown, select Custom User Group Attribute and enter the corresponding destination attribute
     • id - the SCIM Attribute will change to externalId
     • name - the SCIM Attribute will change to displayName
   • Expression - use EXPR expressions to allow for more complex mapping logic:
     • Enter the expression in the JumpCloud Attribute field
     • From the SCIM Attribute dropdown, select the corresponding (destination) attribute
   • Constant - enter a fixed, hardcoded value you want assigned to a group:
     • Enter the value in the Constant Value field
     • From the SCIM Attribute dropdown, select the corresponding (destination) custom group attribute
6. Click Preview Mappings to review the Group Schema.
7. If everything is mapping correctly, click:
   • Save and Sync to initiate an immediate full sync of the updated attributes
   • Update to initiate the update during the next modification of the user group's record, like adding a space to the Description field

To modify existing attributes

1. From your connector’s configuration page, select the Provisioning tab.
2. Expand the User Attributes/User Group Attributes section and click Edit.
3. For the type of attribute you would like to modify:
   • Direct - select the new attribute from the dropdown(s)
   • Expression - click in the Expression field and make the desired edits. If necessary, select the new attribute from the SCIM Attribute dropdown
   • Custom - delete the existing values in either or both of the attribute fields and enter the new values
4. Click Preview Mappings to review the updated User Schema.
5. If the mappings look correct, click:
   • Save and Sync and then Continue to initiate an immediate full sync of the updated attributes
   • Update to initiate the update during the next modification of the user group's record, like adding a space to the Description field

Deleting attributes

1. From your connector’s configuration page, select the Provisioning tab.

2. In the User Attributes/User Group Attributes section, click Edit. The Optional Mappings table will open.

3. Click Delete () to remove any optional attributes.

4. Click:

   • Save and Sync and then Continue to initiate an immediate full sync of the updated attributes
   • Update to initiate the update during the next modification of the user group's record, like adding a space to the Description field

note

Attributes that were initially included and populated in the user record and then deleted at a later time will not be modified or removed from the user record.

Restoring the default attribute table

1. From your connector’s configuration page, select the Provisioning tab.
2. In the User Attributes/User Group Attributes section, click Edit. The Edit Attribute Mappings table will open.
3. Scroll to the bottom of the table and select Restore Defaults.
4. Click:
   • Save and Sync and then Continue to initiate an immediate full sync of the updated attributes
   • Update to initiate the update during the next modification of the user group's record, like adding a space to the Description field

GitHub Enterprise Cloud User Attributes

JumpCloud Attribute	SCIM Attribute	Notes
Optional Mapping
company	$enterpriseUser.organization
costCenter	$enterpriseUser.costCenter
department	$enterpriseUser.department
email	userName
employeeType	userType
firstname	name.givenName
isAssignedToApp && !(jcUser.suspended == true)	active
jobTitle	title
lastname	name.familyName
notNullOrEmpty(jcUser.displayname) ? jcUser.displayname : (notNullOrEmpty(jcUser.lastname) ? jcUser.firstname + ' ' + jcUser.lastname : jcUser.firstname)	displayName
notNullOrEmpty(jcUser.displayname) ? jcUser.displayname : (notNullOrEmpty(jcUser.lastname) ? jcUser.firstname + ' ' + jcUser.lastname : jcUser.firstname)	externalId
notNullOrEmpty(providerUser.locale) ? providerUser.locale : 'en-US'	locale
notNullOrEmpty(providerUser.preferredLanguage) ? providerUser.preferredLanguage : 'en-US'	preferredLanguage
toScimAddresses(find(jcUser.addresses, .type == 'work') ?? first(jcUser.addresses))	addresses
toScimEmails(jcUser.email)	emails
toScimPhoneNumbers(find(jcUser.phoneNumbers, .type == 'work') ?? first(jcUser.phoneNumbers))	phoneNumbers

Agent Attributes

On the Provisioning tab, the Agent Attributes section lists the default mappings JumpCloud sends when an agent is provisioned to this application.

Default Agent Attribute Mappings

JumpCloud Attribute	SCIM Attribute	Notes
Required Mappings
email	userName	The agent email is used as the username.
Optional Mappings
displayname	displayName	Agent display name.
notNullOrEmpty(providerAgent.externalId) ? providerAgent.externalId : jcAgent.id	externalId	Existing provider external ID, otherwise the JumpCloud agent ID.
isAssignedToApp && jcAgent.state == "ACTIVATED"	active	Active only while the agent is bound to the application and in the ACTIVATED state.

To review or edit agent attribute mappings:

1. Open the application and click the Provisioning tab.
2. Expand Agent Attributes and click Edit.
3. Review the Required Mappings and Optional Mappings tables.
4. Click Preview mappings to review how an agent will appear in the target application.
5. Click Save and Sync or Update.
6. To revert to the defaults shown above, click Restore Defaults.

Agent Group Attributes

For applications that support agent groups, the Agent Group Attributes section lists the default mappings JumpCloud sends when an agent group is provisioned as a SCIM group.

Default Agent Group Attribute Mappings

JumpCloud Attribute	SCIM Attribute	Notes
Required Mappings
name	displayName	Agent group name.
Optional Mappings
notNullOrEmpty(providerAgentGroup.externalId) ? providerAgentGroup.externalId : jcAgentGroup.id	externalId	Existing provider external ID, otherwise the JumpCloud agent group ID.
Group membership	members	Adding or removing an agent from the group updates membership in the downstream SCIM group.

To review or edit agent group attribute mappings:

1. Open the application and click the Provisioning tab.
2. Confirm Enable management of User Groups and Group Membership in this application is selected if you want agent groups pushed as SCIM groups.
3. Expand Agent Group Attributes and click Edit.
4. Review or change mappings, then click Preview Mappings.
5. Click Save and Sync or Update.

SCIM Directory Insights Events

SCIM Events Tables

The following Directory Insights (DI) events provide visibility into failures and detailed information about the user and group data and attributes being added or updated from HR or other external solutions to JumpCloud.

note

Customers with no package or the Device Management Package will need to add the Directory Insights à la carte option. Directory Insights is included in all other packages.

SCIM DI Integration Events

Event Name	Event Description
idm_integration_activate	Logged when an IT admin attempts to activated new SCIM integration.
idm_integration_update	Logged when an IT admin attempts to update a configured and activated SCIM integration.
idm_integration_delete	Logged when an IT admin attempts to deactivate an activated SCIM integration.
idm_integration_auth	Logged when an IT admin authenticates/authorizes a SCIM integration.
idm_integration_reauth	Logged when an IT admin attempts to change the credentials for an activated SCIM integration.

SCIM DI User Events

Event Name	Event Description
user_lookup_provision	Logged when JumpCloud encounters an issue when trying to lookup a user to determine if the user needs to be created or updated.
user_create_provision	Logged when JumpCloud tries to create a new user in service provider application.
user_update_provision	Logged when JumpCloud tries to update an existing user in service provider application.
user_deprovision	Logged when JumpCloud tries to change an existing user to inactive in the service provider application.
user_delete_provision	Logged when JumpCloud tries to delete an existing user in service provider application.

SCIM DI Attribute Events

Event Name	Event Description
attributemappings_add	Logged when the attribute mappings of an application are added.
attributemappings_delete	Logged when the attribute mappings of an application are deleted.
attributemappings_update	Logged when the attribute mappings of an application are updated.

tip

You can filter these events for users or groups by using the Resource Type filter and then selecting user\_attribute\_mapping or user\_group\_attribute\_mapping.

SCIM DI Group Events

Important

These DI events will only be present if SCIM Groups are supported.

Event Name	Event Description
group_create_provision	Logged when JumpCloud tries to create a new group in service provider application.
group_update_provision	Logged when JumpCloud tries to update an existing group in service provider application.
group_delete_provision	Logged when JumpCloud tries to delete an existing group in service provider application.

Removing the Integration

Removing the Integration

warning

These are steps for removing the integration in JumpCloud. Consult your SP's documentation for any additional steps needed (like disabling "mandatory SSO login" settings) to remove the integration in the SP. Failure to remove the integration successfully for both the SP and JumpCloud may result in users, including admins, losing access to the application.

Important

If your data is stored outside of the US, check which login URL you should be using depending on your region. If your organization uses LDAP, RADIUS, or requires firewall allow list configuration, the Fully Qualified Domain Names (FQDNs) will also be region specific. See JumpCloud Data Centers for the URLs, FQDNs, and IP addresses.

To deactivate the SCIM Integration

1. Log in to the JumpCloud Admin Portal.

2. Go to Access > SSO Applications.

3. Search for the application that you’d like to deactivate and click to open the configuration window.

4. Click Actions > Deactivate IdM and then click confirm.

To deactivate the SSO Integration

1. Log in to the JumpCloud Admin Portal.
2. Go to Access > SSO Applications.
3. Search for the application that you’d like to deactivate and click to open its details panel.
4. Select the SSOtab.
5. Scroll to the bottom of the configuration.
6. Click Deactivate SSO.
7. Click Save.
8. If successful, you will receive a confirmation message.

To delete the application

1. Log in to the JumpCloud Admin Portal.

2. Go to Access > SSO Applications.

3. Search for the application that you’d like to delete.

4. Check the box next to the application to select it.

5. Click Delete.

6. Enter the number of the applications you are deleting

7. Click Delete Application.

8. If successful, you will see an application deletion confirmation notification.