Integrate with BambooHR

Integrate BambooHR with your JumpCloud account to seamlessly manage and onboard new employees by automatically importing and updating users and their attributes to JumpCloud. This helps limit manual overhead for HR and IT organizations, reduces input error and in combination with the Single Sign On (SSO) with BambooHR SAML connector, JumpCloud provides access to all employee resources through a single set of credentials. 


  • Review Bamboo HR’s JumpCloud Integration article.
  • A JumpCloud Administrator API key. Learn how to access this key below. 
  • A BambooHR “advantage” package at minimum.
  • Your BambooHR tenant
  • Email [email protected] to enable the JumpCloud integration on your account.
  • Configuring JumpCloud SSO for BambooHR is recommended, but not required.
    • JumpCloud won’t manage or consume the BambooHR password. Setting up SSO with the BambooHR User Portal will let your Users access the Bamboo portal using their JumpCloud credentials.
    • JumpCloud managed users must have an email address that corresponds to an email address associated with a BambooHR account.

Note: SSO is either on or off. There is not an option to allow users to either login with SSO or login with their BambooHR credentials.

Important Considerations

  • BambooHR will be the identity source once the integration is configured and serves as the “master” for user attributes. Once that identity is in JumpCloud, admins can manage access, authentication, and extend that identity to all JumpCloud managed resources. 
  • The integration is managed by BambooHR. Please contact [email protected] for support.
  • The integration only sends employee records. User records not sent.
  • The integration is one-way. The employee identities are sent from BambooHR to JumpCloud.
  • Bamboo sends both active and inactive employee records. You will need to monitor the users that are created to ensure any inactive employees that should not be in JumpCloud are deleted.
    • You will need to contact your Account Manager or Account Services to let them know when this situation occurs, so billing can be managed appropriately.
    • If you do not want inactive users to be created, you can remove the work email for the employees who are inactive and store it in the “notes” tab for future reference.. Removing the work email value will prevent the records from syncing to Jumpcloud.
  • We strongly recommend setting Staged as the user default for Manual / Single User API in Settings > User Management > Default User State for User Creation in JumpCloud. Read Manage User States to learn more.
    • You can easily identify new users created by the integration
    • You can assign resources without granting access before the user’s start date
    • You can control whether or not an email is sent to the user when they are activated
    • You can activate the user by changing their user state.
  • When a user is created in BambooHR as an employee, they will automatically be created in JumpCloud on the next scheduled sync based on the settings for the JumpCloud app in BambooHR.
  • If a specific minute is selected from the minute dropdown, that will result in data being sent at that minute past the hour every hour. It does not result in a sync occurring in that minute time interval.  For example, selecting 5 for the minute will result in the data being sent to JumpCloud at 5 minutes past the hour every hour.
    • If you want to sync data more frequently than hourly, select the Every Day, Every Month, Every Hour, Every Minute options. 
  • A user created by this integration will:
    • Be created in the user state specified for Default User State for User Creation for Manual / Single User API.
    • Have a pending password status.
    • Need to establish and maintain their password within JumpCloud.
  • Users created in the Active user state won’t automatically be sent an activation email upon creation. 
  • Updates to the user attributes specified in the settings for the JumpCloud app BambooHR will be synced to JumpCloud as long as the integration is active.
  • Group import isn’t supported. 
  • This API level integration uses the SCIM protocol to write user information in a direct and timely fashion to JumpCloud’s SCIM endpoints. 
  • An employee record in BambooHR must have a company email address for the information to be sent to JumpCloud. 
  • Important:
    • When you delete a BambooHR managed user in JumpCloud, that user still exists and has a work email address in BambooHR, the user will be recreated in JumpCloud. 
    • When you suspend a user in JumpCloud and the user is still active in BambooHR, the user state for that user will updated and set back to Active in JumpCloud.
    • When you add a user in JumpCloud, the user won’t be created in BambooHR.
    • When you do a manual sync from BambooHR to JumpCloud, a full sync is done, meaning all employee records, both active and inactive users are sent.
    • When you make any changes to the settings for the JumpCloud application in BambooHR, a full sync is done, meaning all employee records, both active and inactive users are sent.
    • There are other triggers that result in a full sync. Please contact [email protected] for more information.

Attribute Considerations

  • Any attributes that have been selected within BambooHR for export to JumpCloud will overwrite values existing in JumpCloud with each update that is triggered in BambooHR.
    • It’s recommended to Enable read-only on the user’s portal profile page for all users in the Organization Settings to prevent users and administrators from updating attributes in JumpCloud.

Creating a new JumpCloud Application Integration

  1. Log in to the JumpCloud Admin Portal.
  2. Navigate to USER AUTHENTICATION SSO Applications.
  3. Click + Add New Application.
  4. Type the name of the application in the Search field and select it.
  5. Click Next.
  6. In the Display Label, type your name for the application. Optionally, you can enter a Description, adjust the User Portal Image and choose to hide or Show in User Portal.
  7. Click Save Application.
  8. If successful, click:
    • Configure Application and go to the next section.
    • Close to configure your new connector at a later time.

Configuring the SSO Integration

To configure JumpCloud

  1. Create a new application or select it from the Configured Applications list.
  2. Select the SSO tab.
  3. In the ACS URL field, replace <YOURDOMAIN> with your account’s registered BambooHR domain name.
  4. In the field terminating the IdP URL, either leave the default value or enter a plaintext string unique to this connector.
  5. Select activate and then continue.
  6. Click Download certificate from the slide out notification. 

Tip: This will download to your local Downloads folder with the name certificate.pem.

To configure BambooHR

  1. Log in to BambooHR as an administrator (This user’s email should also be managed by JumpCloud).
  2. Select the Apps icon in the upper right.
  3. Scroll down to the Single Sign-On section, and select the SAML 2.0 icon.
  4. Select the Install button next to the SAML 2.0 icon.
  5. In the SSO Login URL field, enter the same IdP URL that you set in the JumpCloud console (if you did not modify the termination of this URL, then enter the default URL:
  6. In the x.509 Certificate field, paste the contents of your public certificate.
  7. Select Install.

Authorizing User SSO Access

Users are implicitly denied access to applications. After you connect an application to JumpCloud, you need to authorize user access to that application. You can authorize user access from the Application Configuration panel or from the Groups Configuration panel. 

To authorize user access from the Application Configuration panel

  1. Log in to the JumpCloud Admin Portal.
  2. Go to USER AUTHENTICATION > SSO Applications, then select the application to which you want to authorize user access.
  3. Select the User Groups tab. If you need to create a new group of users, see Get Started: Groups.
  4. Select the check box next to the group of users you want to give access.
  5. Click save

To learn how to authorize user access from the Groups Configuration panel, see Authorize Users to an SSO Application.

Validating SSO authentication workflow(s)

IdP Initiated

  • Access the JumpCloud User Console.
  • Select the application’s tile.
  • The application will launch and login the user.

SP Initiated

  • Navigate to your Service Provider application URL.
  • You will be redirected to log in to the JumpCloud User Portal.
  • The browser will be redirected back to the application and be automatically logged in.

Configuring the Identity Management Integration

To configure BambooHR 1

  1. Log in to your Bamboo administrator account.
  2. From the Home page, select the gear icon in the top right hand corner. This brings up your Settings page. 
  3. Under your Account information, select Apps.
  4. On the next page, under Not Installed, scroll down to find JumpCloud, click Install
  5. A JumpCloud Settings modal pops up, for the question: When would you like your data to be sent?* 
    • The integration is set to send changes every minute by default. We recommend these settings for the most immediate sync. If you want a different schedule, you can customize the cadence that updates sync.
  6. For the next question: Which fields do you want to send to JumpCloud?* Determine which attributes you’d like to manage consistently in BambooHR and sync to JumpCloud.
  7. Keep this page open.

Note: BambooHR will effectively master selected attributes in JumpCloud.

To get your JumpCloud API Key


We recommend using a dedicated administrator account specific to the integration.

  1. Log in to the JumpCloud Admin Portal with the administrator account you want to use to generate the API key for this integration.
  2. Click the initials in the top right corner.
  3. Select My API Key.
  4. Click on Generate New API Key.
  5. Copy the API Key and store it securely, or leave this tab open while you complete the integration configuration steps in Deel.


This is the only time your API key will be visible to you. Store it somewhere safe, such as the JumpCloud Password Manager, so you can access it later.

Once a new API key is generated, this revokes access to the current API key. 

Note: The Admin API key needs to belong to an Admin that has one of the following roles; Manager, Administrator or Admin with Billing. Creating an administrator service account with one of these roles is one way to ensure the integration isn't dependent on a specific admin account.

To configure BambooHR 2

  1. Back on your BambooHR page, in the JumpCloud Settings modal, paste the JumpCloud API Key under Add JumpCloud provided API Key* 
  2. Click Install. You will receive a notification that JumpCloud was successfully installed.
  3. Your integration is now established. If you go back to your JumpCloud Administrator console, go to USER MANAGEMENT > Users and refresh the page, you will see newly added users.
    • If you set Staged as the default state, you can see a filtered view of just those users by clicking Staged option above the users list.
    • If you set Active as the default state, you can filter the All or Active view to just users with a password pending password status.

Attribute Mappings

The following table lists attributes that BambooHR sends to JumpCloud. Any updates to the fields selected in the settings for the JumpCloud app will trigger an update to those values in JumpCloud with the exception of work extension.

BambooHR Field Direction JumpCloud UI Field Name Field Type Notes
Work Email To Company Email Standard Employee records will NOT sync to JumpCloud until a Work Email exists in BambooHR. This is a required field in JumpCloud. This field is used as the unique identifier for matching users in JumpCloud with employees in BambooHR.
Work Email To Username Standard Defaults to first part of email address (everything before the @ symbol). This is a required field in JumpCloud. If a user already exists in JumpCloud with a matching email, the Username for that user will not be overwritten by BambooHR.
Status To User State Standard An Inactive status in BambooHR will suspend access for that user in JumpCloud.
First Name To First Name Standard  
Last Name To Last Name Standard  
Preferred Name OR First Name + Last Name To Display Name Standard Populated by Preferred Name and Last Name fields in BambooHR. If no Preferred Name value exists then First Name will be used.
Middle Name To Middle Name Optional  
Employee Number To Employee ID Optional  
Job Title To Job Title Optional  
Division To Company Optional  
Department To Department Optional  
Location To Location Optional  
Location Country To Work Country Optional Location field must be selected in BambooHR App Settings in order to sync.
Location Address Street 1 & Location Address Street 2 To Work Street Address Optional Location field must be selected in BambooHR App Settings in order to sync.
Location City To Work City Optional Location field must be selected in BambooHR App Settings in order to sync.
Location State To Work State Optional Location field must be selected in BambooHR App Settings in order to sync.
Location ZIP/Postal Code To Work Postal Code Optional Location field must be selected in BambooHR App Settings in order to sync.
Work Phone + Ext To Work Phone Optional  
Home Phone To Home Phone Optional  
Mobile Phone To Personal Cell Option  
Address Street 1 & Location Address Street 2 To Home Street Address Optional  
Address City To Home City Optional  
Address State/Province To Home State Optional  
Address ZIP/Postal Code To Home Postal Code Optional  
Address Country To Home Country Optional  

Importing Users

This functionality is helpful if users have already been created in the application but have not been created in JumpCloud.

  1. Log in to the JumpCloud Admin Portal.
  2. Go to USER AUTHENTICATION > SSO Applications.
  3. Search for the application and click to open its configuration panel. 
  4. Select the Identity Management tab.
  5. Click manual import.
  6. Select the users you want to create in JumpCloud from the application from the list of users that appear. Users in the list have two import statuses:
  • New – The user has not been imported.
  • Imported – user has been imported and has an account in JumpCloud.

Tip: Try using the New Users-only filter when selecting users to import. This will move all of your new users to the top of the list, making them easier to identify and select.

  1. Click import.
  • If you are importing less than 100 users, your import results will display in real time and you can continue onboarding your users. 
  • If you have more than 100 users being imported, JumpCloud will send you an email when your import is complete.
  1. You can now connect and grant users access to all their JumpCloud resources. Learn more in the Authorize Users to an Application and Connecting Users to Resources articles.

Warning: Imported users must be members of a user group bound to an application for JumpCloud to manage their identity in, and access to, the application.

Removing the Integration

To deactivate the IdM Integration

  1. Log in to the JumpCloud Admin Portal.
  2. Go to USER AUTHENTICATION > SSO Applications.
  3. Search for the application that you’d like to deactivate and click to open its details panel. 
  4. Under the company name and logo on the left hand panel, click the Deactivate IdM connection link.
  5. Click confirm
  6. If successful, you will receive a confirmation message.

To deactivate the SSO Integration

  1. Log in to the JumpCloud Admin Portal.
  2. Go to USER AUTHENTICATION > SSO Applications.
  3. Search for the application that you’d like to deactivate and click to open its details panel. 
  4. Select the SSO tab.
  5. Scroll to the bottom of the configuration.
  6. Click Deactivate SSO
  7. Click save
  8. If successful, you will receive a confirmation message.

To delete the application

  1. Log in to the JumpCloud Admin Portal.
  2. Go to USER AUTHENTICATION > SSO Applications.
  3. Search for the application that you’d like to delete and click to open its details panel.
  4. Check the box for the application.
  5. Click Delete.
  6. Enter the number of the applications you are deleting
  7. Click Delete Application.
  8. If successful, you will see an application deletion confirmation notification.

List IconIn this Article

Still Have Questions?

If you cannot find an answer to your question in our FAQ, you can always contact us.

Submit a Case