Help Center Home > Apps and Integrations > Integrate with Deel

Integrate with Deel

Prerequisites

  • Deel administrator account
  • A customized Deel subdomain and your Deel ID (SSO only).
  • A dedicated JumpCloud administrator account (User Sync only).
  • A JumpCloud API key to connect Deel and JumpCloud (User Sync only).

 Important Considerations for User Sync

  • Syncs from Deel to JumpCloud happen automatically every night. 
  • Syncs can be triggered to occur at any time from the JumpCloud app in the Deel console.

Configuring the User Sync Integration

To create a new JumpCloud Admin account for the User Sync Integration

  1. Log in to the JumpCloud Admin Portal with an administrator account.
  2. Click your initials in the top right corner.
  3. Select Administrators.
  4. Click the green + icon.
  5. Enter a first name, such as ‘Deel’.
  6. Enter a last name, such as ‘Integration’.
  7. Enter the email address you want associated with this account.
  8. Select Administrator for the Role.
  9. Toggle on Multi-factor Authentication Required and click Require MFA.

Note:

MFA is optional, but not required for this account. It is strongly recommended.

  1. Click Save. 
  2. Go to the inbox of the email address specified for this account.
  3. Find the JumpCloud Administrator Account Setup email.
  4. Click Setup Account in the email.
  5. Enter a password in the Password and Confirm Password fields.
  6. Select the box to agree to the Terms of Use.
  7. Click Reset Password.
  8. If the option to require Multi-factor Authentication was enabled, do the following:
    1. Follow the instructions to download JumpCloud Protect if you don’t have it or another Authenticator app.
    2. Otherwise, click I Have An App.
    3. Add the JumpCloud account.
    4. Verify the TOTP code from the Authenticator app.
    5. Click Submit. 

To get your JumpCloud API Key

Note: The Admin API key needs to belong to an Admin that has one of the following roles; Manager, Administrator or Admin with Billing. Creating an administrator service account with one of these roles is one way to ensure the integration isn't dependent on a specific admin account.

Warning:

Once a new API key is generated, this revokes access to the current API key. 

  1. Log in to the JumpCloud Admin Portal with the administrator account you want to use to generate the API key for this integration.
  2. Click your initials in the top right corner.
  3. Select My API Key.
  4. Click on Generate New API Key.
  5. Copy the API Key and store it securely, or leave this tab open while you complete the integration configuration steps in the SP.

Important:

This is the only time your API key will be visible to you. Store it somewhere safe, such as the JumpCloud Password Manager, so you can access it later.

To connect the JumpCloud app in Deel

  1. Login to Deel with an administrator account.
  2. Click Apps & Integration from the left navigation menu.
  3. Search for and select JumpCloud.
  4. Click Connect.
  5. Paste the API key you copied in the steps above.
  6. Click Connect.
  7. Click OK on the connection success notification window.

To sync users from Deel to JumpCloud

An automatic hourly sync occurs that will create new users, update existing users, and suspend users who have been marked as terminated. You can trigger an immediate sync between Deel and JumpCloud at any time. 

Tip:

You may want to trigger an immediate sync in the case of employee terminations or role and department changes.

To immediately sync changes from Deel to JumpCloud

  1. Login to Deel with an administrator account.
  2. Click Apps & Integration from the left navigation menu.
  3. Select the Connected Apps tab.
  4. Find the JumpCloud app.
  5. Click Manage.
  6. Click Sync JumpCloud,

Deel User Attributes

Deel Value JumpCloud Attribute JumpCloud UI Field Name Notes
Work email email Company Email Required. Users will not sync if a work email address is not defined.  (max length 1024)
N/A username Username The user name is set to {firstname.lastname}. If the username already exists in your JumpCloud organization, a number will be appended to the last name (e.g., alpha.zed1)
First Name firstname First Name
Last Name lastname Last Name
Full Name displayName Display Name
Active (boolean) state N/A Users are created as staged or active when active is true.  Users are suspended when active is sent as false.
Job Title jobTitle Job Title
Department department Department
Work Location location Location
Team costCenter Cost Center
Worker Type employeeType Employee Type
Entity company Company
Profile ID employeeIdentifier Employee ID

Activating a user in JumpCloud

A user in the Staged user state in JumpCloud does not have access to their assigned resources. Once a user has been assigned a device, policies, and all other needed JumpCloud managed resources, the user will need to be activated in JumpCloud to gain access to those resources. For more information about activating a user, read Manage User States.

  1. Log in to the JumpCloud Admin Portal with an administrator account.
  2. Go to USER MANAGEMENT > Users.
  3. Select the user you want to activate.
  4. Click the dropdown menu next to Staged above the Security Status section in the left panel.
  5. Select Activate. 
  6. Click Schedule Activation to activate the user on a future date and time or Activate Now to activate the user immediately.
  7. Click Save.

Important:

For Scheduled Activation, the time must be at least one hour in the future.

  1. Select and populate the Send email to field to notify the user of their JumpCloud account activation.
  2. Click Save.

Configuring the SSO Integration

To configure JumpCloud

  1. Log in to the JumpCloud Admin Portal.
  2. Navigate to USER AUTHENTICATION > SSO Applications.
  3. Click + Add New Application and type Deel.
  4. Select it from the dropdown and click Next.
  5. In the Display Label, confirm or change the name for the application. Optionally, you can enter a Description, adjust the User Portal Image and choose to hide or Show in User Portal.
  6. Click Save Application and then Configure Application.
  7. On the SSO tab, replace any instances of YOUR_ID and YOUR_SUBDOMAIN with your Deel values.
  8. Add or change any additional attributes.
  9. Click save.

Download the certificate

  1. Find your application in the Configured Applications list and click anywhere in the row to reopen its configuration window.
  2. Select the SSO tab and click IDP Certificate Valid > Download certificate.

Tip:

The certificate.pem will download to your local Downloads folder.

To configure Deel

  1. Click the Edit button next to your subdomain.
  2. In the Part 2: Single Sign-On section, toggle on the SAML 2.0 Connector.
  3. Enter the following information:
    • SAML 2.0 Endpoint - copy and paste the JumpCloud IDP URL.
    • IDP X509 Public Key - copy and paste the contents of the certificate downloaded in the previous section.

Tip:

Only copy the contents between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.

  1. Ensure the displayed IdP configuration matches the JumpCloud configuration.
  2. Click Continue.
  3. Customize your interface and then click Deploy.

Authorizing User SSO Access

Users are implicitly denied access to applications. After you connect an application to JumpCloud, you need to authorize user access to that application. You can authorize user access from the Application Configuration panel or from the Groups Configuration panel. 

To authorize user access from the Application Configuration panel

  1. Log in to the JumpCloud Admin Portal.
  2. Go to USER AUTHENTICATION > SSO Applications, then select the application to which you want to authorize user access.
  3. Select the User Groups tab. If you need to create a new group of users, see Get Started: User Groups.
  4. Select the check box next to the group of users you want to give access.
  5. Click save. 

To learn how to authorize user access from the Groups Configuration panel, see Authorize Users to an SSO Application.

Validating SSO user authentication workflow(s)

IdP-initiated user workflow

  • Access the JumpCloud User Console
  • Go to Applications and click an application tile to launch it
  • JumpCloud asserts the user's identity to the SP and is authenticated without the user having to log in to the application

SP-initiated user workflow

  • Go to the SP application login - generally, there is either a special link or an adaptive username field that detects the user is authenticated through SSO

Note:

This varies by SP.

  • Login redirects the user to JumpCloud where the user enters their JumpCloud credentials
  • After the user is logged in successfully, they are redirected back to the SP and automatically logged in

Managing user access and access policies for JumpCloud managed resources

Once users are created in JumpCloud, you can grant them access to any of the resources connected to JumpCloud from a device to applications, networks, etc. User, device, and policy groups allow you to more efficiently assign resources to users and control the level of permissions they are given. Access policies allow you to control how, on what device, and from where they can access their assigned resources. 

All user access and access policy management for JumpCloud managed resources is done directly in the JumpCloud Admin Portal or through the JumpCloud API. For more information see, Get Started: Users, Get Started: User Groups, and Get Started: Conditional Access Policies.

Managing devices and policies

Using JumpCloud's device management features will allow you to control settings on your devices, including Firewalls, Disk Encryption, Security Settings and common compliance policy groups.

All device and policy management actions are done directly in the JumpCloud Admin Portal or through the JumpCloud API. For more information, see Get Started: Devices and Get Started: Policies.

Removing the User Sync Integration

  1. Login to Deel with your administrator account.
  2. Navigate to App Store > My Apps.
  3. In the JumpCloud app, click Manage.
  4. In the right upper corner, click More and then Disconnect.

Removing the SSO Integration

Important:

These are steps for removing the integration in JumpCloud. Consult your SP's documentation for any additional steps needed to remove the integration in the SP. Failure to remove the integration successfully for both the SP and JumpCloud may result in users losing access to the application.

To deactivate the SSO Integration

  1. Log in to the JumpCloud Admin Portal.
  2. Go to USER AUTHENTICATION > SSO Applications.
  3. Search for the application that you’d like to deactivate and click to open its details panel. 
  4. Select the SSO tab.
  5. Scroll to the bottom of the configuration.
  6. Click Deactivate SSO. 
  7. Click save. 
  8. If successful, you will receive a confirmation message.

To delete the application

  1. Log in to the JumpCloud Admin Portal.
  2. Go to USER AUTHENTICATION > SSO Applications.
  3. Search for the application that you’d like to delete.
  4. Check the box next to the application to select it.
  5. Click Delete.
  6. Enter the number of the applications you are deleting
  7. Click Delete Application.
  8. If successful, you will see an application deletion confirmation notification.
Back to Top

List IconIn this Article

Notebook IconLearn More

Get Started: SAML Single Sign-on (SSO)

SAML Attribute Notes

SAML Configuration Notes

Configure User Attributes for SAML Connectors

How to Set Up the JumpCloud Integration for Deel

How to Set Up the SAML 2.0 Integration with JumpCloud for Single Sign On for Deel

Still Have Questions?

If you cannot find an answer to your question in our FAQ, you can always contact us.

Submit a Case