Integrate with Apple Business Manager

Managed Apple Accounts are the gateway to Bring Your Own Device (BYOD) Programs. These accounts, created within Apple Business Manager (ABM), or using JumpCloud’s SSO and SCIM Connector, are required for managing user-owned devices with JumpCloud.

Use JumpCloud OIDC Single Sign On (SSO) to give your users convenient but secure access to their Managed Apple Account with a single set of credentials. Automatically provision, update and deprovision users in ABM from JumpCloud, centralizing user lifecycle and user identity management in JumpCloud for ABM. Save time and avoid mistakes, as well as potential security risks, related to manually creating users.

Read this article to learn how to setup the ABM integration.

Prerequisites

• A JumpCloud administrator account
• JumpCloud SSO Package or higher or SSO à la carte option
• An ABM account with the role of Administrator or People Manager
• An Apple verified domain and federated authentication
  • If federated authentication is not already enabled, setting up SSO will automatically enable it
• If you have an existing ABM connector, either prebuilt or custom OIDC, you must deactivate and delete the existing connector before configuring this connector
• The JumpCloud user's Managed Apple ID attribute field should be populated for users where the desired email address is different from their company email
• SCIM must be enabled in the ABM Directory Sync settings

Important Considerations

• Domains must be fully captured prior to them being locked in ABM, a pre-requisite for enabling federation and directory sync. This domain capture can take up to a month
• Admin accounts cannot be federated
• Non-administrative users whose unmanaged ABM accounts are associated with a company domain email address should manually update them to a non-company domain email address before the end of the domain capture period. Otherwise, ABM will automatically assign an auto-generated email address to these accounts
• Safari is not a supported browser for this configuration flow as some of the ABM pages do not render
• The ABM Application should not be placed behind a managed device conditional access policy if this federation will be used for device enrollment flows

SCIM Considerations

• All newly provisioned users will have the default role of staff
• A user’s email address must belong to an Apple verified domain for them to be created and updated through SCIM
• It is recommended to set your Client Secret's expiration to 12 months

• If you need to update your secret, you must deactivate the IdM integration, update the secret, and then reactivate the IdM integration
• Password synchronization is not supported

Attribute Considerations

• A default set of attributes are managed for users. See the Attribute Mappings section for more details
• The following attribute is not supported by JumpCloud:
  • division

Creating a new JumpCloud Application Integration

1. Log in to the JumpCloud Admin Portal.
2. Navigate to USER AUTHENTICATION > SSO Applications.
3. Click + Add New Application.
4. Type the name of the application in the Search field and select it.
5. Click Next.
6. In the Display Label, type your name for the application. Optionally, you can enter a Description, adjust the User Portal Image and choose to hide or Show in User Portal.
7. Click Save Application.
8. Click Configure Application.

Configuring the SSO Integration

To configure JumpCloud

1. On the SSO tab of the ABM connector, click Activate.
2. Copy the Client ID and Secret.

3. Click Got It.

To configure Apple

1. Log into Apple.
2. Go to My Profile > Managed Apple Accounts.
3. Click Get Started.
4. Select Custom Identity Provider and enter the following information:
   • Name - <name of your connector>
   • Client ID - copy and paste the Client ID generated in the previous section
   • Client Secret - copy and paste the Client Secret generated in the previous section
   • SSF Config URL - enter https://ssf.jumpcloud.com/.well-known/ssf-configuration
   • OpenID Config URL - enter https://oauth.id.jumpcloud.com/.well-known/openid-configuration
5. Click Continue and then Sign in with <name of your connector>.

6. When signed in, click Continue.
7. Under User sign in, ensure it shows Connected.

Authorizing User SSO Access

Users are implicitly denied access to applications. After you connect an application to JumpCloud, you need to authorize user access to that application. You can authorize user access from the Applications, Users List or User Groups page. 

To authorize user access from the Application’s page

1. Log in to the JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO Applications, then select the application to which you want to authorize user access.
3. Select the User Groups tab. If you need to create a new group of users, see Get Started: User Groups.
4. Select the check box next to the desired group of users to which you want to give access.
5. Click Save. 

To learn how to authorize user access from the Users or User Groups pages, see Authorize Users to an SSO Application.

Validating SSO user authentication workflow(s)

IdP-initiated user workflow

• Access the JumpCloud User Console
• Go to Applications and click an application tile to launch it
• JumpCloud asserts the user's identity to the SP and is authenticated without the user having to log in to the application

SP-initiated user workflow

• Go to the SP application login - generally, there is either a special link or an adaptive username field that detects the user is authenticated through SSO

• Login redirects the user to JumpCloud where the user enters their JumpCloud credentials
• After the user is logged in successfully, they are redirected back to the SP and automatically logged in

Configuring the Identity Management Integration

To configure Apple

1. In ABM, navigate to Directory Sync > Custom Sync and click Enable.
2. In Authorization callback URL - enter https://console.jumpcloud.com/api/v2/provision/applebusinessmanager/callback
3. Click the + Client Secret link and select 12 months (recommended).
4. Click Save.
5. Copy the Client ID and Client Secret.

6. Click Done.

To configure JumpCloud

1. Create a new application or select it from the Configured Applications list.
2. Select the Identity Management tab.
3. Click Configure.
4. You're presented with two fields:
   • Client ID - enter the Client ID generated in the previous section
   • Client Secret - enter the Client Secret generated in the previous section
5. Click Activate.
6. If the status of the sync in Apple is green, the sync has been successfully set up.
7. You can now connect user groups to the application in JumpCloud to provision the members of that group in ABM. Learn how to Authorize Users to an Application.

Attribute Mappings

The Export Attributes Mapping table lists the Required and Optional Mappings that JumpCloud sends to the Service Provider. See Attribute Considerations for more information regarding attribute mapping considerations. 

Learn about JumpCloud Properties and how they work with system users in our API. 

Modifying User Attributes

To add user attributes

1. From your connector’s configuration page, select the Identity Management tab.
2. Expand the Export Attribute Mapping section and click Edit. The Optional Mappings table will open.
3. Scroll to the bottom of the table and click +Add Attribute.
4. Select one of the mapping types:
   • Direct Mapping (JSON Path) - send the value from a user attribute in JumpCloud directly to an attribute in the service provider
     • From the JumpCloud Attribute dropdown, select the desired attribute
       • If you choose “Custom User Attribute” you must type the name of the attribute exactly as it on the user details page. To see the dropdown again, you must delete the attribute and add a new attribute
     • From the SCIM Attribute dropdown, select the corresponding (destination) attribute
   • Expression - transform or combine multiple user attributes into a single, custom value before sending it to the service provider
     • Enter the expression in the JumpCloud Attribute field
     • From the SCIM Attribute dropdown, select the corresponding (destination) attribute
   • Constant - send a fixed, predefined value—like a specific company name —for every user to the service provider
     • This is a free text field with no validation, e.g., the attribute must match exactly, including case, to the corresponding attribute in the user record. Once the custom attribute is added, you must delete it and readd a new custom attribute to see the dropdown again.
5. Repeat these steps for additional attributes.
6. Click Preview Mappings to review the User Schema.
   • If you do not select a specific user from the Preview Filter dropdown, the schema will default to the first user.

7. Click Update.

To modify existing user attributes

This enhancement gives you complete control over the user attributes sent from JumpCloud to this application. You can now:

• Fully control mappings - define which JumpCloud attribute or source data corresponds to an attribute in the SP's SCIM schema
• Use a variety of source values - map data from the user's standard attributes, Manager field, custom attributes, or other data sources
• Manipulate data with expressions - transform data, such as preferred first names and date format, using expressions before transmission to the SP. Learn more
• Preview changes - review your new mappings to ensure accuracy before you save

1. From your connector’s configuration page, select the Identity Management tab.
2. Expand the Export Attribute Mapping section and click Edit.
3. For the type of attribute you would like to modify:
   • Direct - select the new attribute from the dropdown(s)
   • Expression - click in the Expression field and make the desired edits. If necessary, select the new attribute from the SCIM Attribute dropdown
   • Custom - delete the existing values in either or both of the attribute fields and enter the new values
4. Click Preview Mappings to review the updated User Schema.
5. Click Update.

To delete user attributes

1. From your connector’s configuration page, select the Identity Management tab.
2. In the Export Attribute Mapping section, click Edit. The Optional Mappings table will open.
3. Click Delete () to remove any optional attributes.

4. When finished, click Update.

SCIM Directory Insights Events

The following Directory Insights (DI) events provide visibility into failures and detailed information about the user and group data being added or updated from HR or other external solutions to JumpCloud.

Removing the Integration

To deactivate the IdM Integration

1. Log in to the JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO Applications.
3. Search for the application that you’d like to deactivate and click to open its details panel. 
4. Under the company name and logo on the left hand panel, click the Deactivate IdM connection link.
5. Click confirm. 
6. If successful, you will receive a confirmation message.

To deactivate the SSO Integration or Bookmark

1. Log in to the JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO Applications.
3. Search for the application that you’d like to deactivate and click to open its details panel. 
4. Select the SSO or Bookmark tab.
5. Scroll to the bottom of the configuration.
6. Click Deactivate SSO or Deactivate Bookmark. 
7. Click save. 
8. If successful, you will receive a confirmation message.

To delete the application

1. Log in to the JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO Applications.
3. Search for the application that you’d like to delete.
4. Check the box next to the application to select it.
5. Click Delete.
6. Enter the number of the applications you are deleting
7. Click Delete Application.
8. If successful, you will see an application deletion confirmation notification.