Configure Okta as an Identity Provider

This feature is in Beta.

Integrate an existing Identity Provider (IdP) with JumpCloud to allow users to securely authenticate using their IdP credentials to gain access to their managed resources.


  • You need to have Admin with Billing permissions to configure an IdP. 
  • You need to have a valid Okta account with admin permissions.


  • Federated device management will be applied to all users at once.
  • Federated authentication is in Beta, and is currently limited to only device binding. You have to have either Self Service Account Provisioning, or Automated Device Enrollment enabled in order to leverage federated device authentication. 
  • Creating an IdP in JumpCloud will result in all users in the organization authenticating to supported resources (Self Service Account Provisioning and Mac ADE) with this IdP
  • User Portal access will be available with a JumpCloud password. If User Portal access is not desired, ensure that this is denied by policy, see Get Started: Conditional Access Policies.

Preparing your IdP to Configure with JumpCloud

To prepare your connection:

  1. Log in to your Okta account. 
  2. In the left navigation menu, click Applications > Applications
  3. Click Create App Integration, then in the next modal, for Sign-in method, select OIDC – OpenID Connect
  4. For Application type, select Web Application > Next
  5. On the next page, for App integration name, enter a name associated with JumpCloud. 
  6. For Grant type > Client acting on behalf of itself, select Client Credentials
  7. Under Sign-in redirect URIs, there is a link populated by default that needs to be replaced with this link:
  8. For Sign-out redirect URIs, click the ‘X’ next to the link to clear it. 
  9. Under Assignments, select Allow everyone in your organization to access, unless you only want this applicable to certain groups, in which case select Limit access to selected groups and then enter the groups you want and click Save
  10. If you Allow everyone in your org to access, another option will appear under Enable immediate access (Recommended). Select Enable immediate access with Federation Broker Mode to require users to authenticate through JumpCloud.
  11. Click Save
  12. On the next page, you can manage your app. 
  13. Next to General Settings, click Edit. Then under USER CONSENT, uncheck Require consent. This enables users to login to Okta without being prompted to give their consent with each request. 
  14. Click Save
  15. Now, click the tab at the top Okta API scopes, scroll down to find the scope named Click Grant to give consent to this scope.

Now you have a connection to JumpCloud in Okta. Next, you’ll want to configure the connection in JumpCloud. 

Configuring Okta as an IdP in JumpCloud

To configure Okta:

  1. Log in to your JumpCloud Admin Portal.
  2. Click DIRECTORY INTEGRATIONS > Identity Providers.
  3. Click the Add Identity Provider dropdown menu, and select Okta.
  4. Enter an Identity Provider Name* as a display name (i.e. Okta IdP).
  5. Next, you’ll need to copy/paste the following information from your Okta account into the required fields in JumpCloud:
    • Okta IdP URL*
      • Click your email in the top right corner, under your name and Okta email address, there is a URL with at the end. This is your Okta IdP URL.
      • Note: “.well-known/openid-configuration” will be appended to the end of your Okta tenant URL, allowing for JumpCloud to obtain all the relevant OIDC endpoints from the hosted file.
    • Client ID*
      • Under Client Credentials is where your Client ID lives.
    • Client Secret*
      • Under CLIENT SECRETS is where you can copy your current Client Secret, or Generate new secret
  6. Click Save. You’ll be prompted to verify that you want to enable Federated Device Authentication for your users’ login. Select I understand the impacts above, then click Yes, Continue.

Managing the IdP 

To manage the IdP:

  1. From your JumpCloud Admin Portal, click DIRECTORY INTEGRATIONS > Identity Providers.
  2. You can update the name, Okta IdP URL, Client ID, and Client Secret. 
  3. Under Authentication, you’ll see that Federation is applied to your users, allowing them to authenticate with an IdP.
  4. Under Device Account Provisioning, you can configure either Self Service Account Provisioning or Automated Device Enrollment for whichever OS you’re provisioning. The Status displays either Enabled or Disabled accordingly, click Configure to edit. 

See Provision New Users on Device Login and Automated Device Enrollment to learn more.

Deleting the IdP

To delete the IdP:

  1. From your JumpCloud Admin Portal, click DIRECTORY INTEGRATIONS > Identity Providers.
  2. At the bottom of the IdP Configuration page, under Delete Identity Provider, click Delete IdP
  3. You’ll be prompted to confirm your deletion, then click Yes, Delete.

Still Have Questions?

If you cannot find an answer to your question in our FAQ, you can always contact us.

Submit a Case