Contact Us
Help Center Home > Apps and Integrations > Integrate with Netskope

Integrate with Netskope

This integration centralizes Netskope user management and access control within JumpCloud. By combining JumpCloud SAML Single Sign-On (SSO) with SCIM Identity Management, you can provide a seamless and secure end-user login experience to Netskope while automating the provisioning, updating, and deprovisioning of users and groups, ensuring accurate and up-to-date access controls. This unified approach eliminates manual errors, bolsters security, and saves valuable IT resources.

Read this article to learn how to set up the Netskope integration.

Prerequisites

  • A JumpCloud administrator account
  • JumpCloud SSO Package or higher
  • A Netskope user account with Super Admin permissions
  • Your Netskope tenant name for the SCIM Base URL

Attribute Considerations

  •  A default set of attributes are managed for users. See the Attribute Mappings section for more details
  • Groups are supported

Creating a new JumpCloud Application Integration

  1. Log in to the JumpCloud Admin Portal.

Important:

If your data is stored outside of the US, check which login URL you should be using depending on your region, see JumpCloud Data Centers to learn more.

  1. Go to Access > SSO Applications.
  2. Click + Add New Application.
  3. You can also enter the name of the application in the Search field and select it.
  4. You can either select an application from the available list or select Custom Application, and click Next.
  5. Select the required options from the Select Options page and click Next. The Enter General Info page is displayed.
  6. On the Enter General Info page, you can customize the display label, description and how the application displays:
    • Description - add a description that users will see in their user portal
    • User Portal Image - choose Logo or Color Indicator
    • Show in User Portal - select to ensure the app is visible in the user portal
  7. Optionally, expand the Advanced Settings section and customize the IdP URL:
    • Enter a custom value to replace the default application name in the SSO IdP URL endpoint ( https://sso.jumpcloud.com/saml2/{custom_value})

Warning:

The SSO IdP URL is not editable after the application is created. If you need to change this URL later, you must delete and recreate the connector.

  1. Click Save Application.
  2. Next, click:
    • Configure Application and go to the next section
    • Close to configure your new application at a later time

Configuring SAML SSO Integration for Netskope

To configure Netskope:

  1. Log in to your Netskope account as an administrator.
  2. Go to Settings > Administration > SSO.
  3. Click EDIT SETTINGS and copy the Netskope Proxy ACS URL and Organization ID (for the Instance URL).

To configure JumpCloud:

  1. In the JumpCloud Admin Portal, go to the SSO tab.
  2. In the IDP Entity ID field, enter your Netskope Instance URL (e.g., https://<tenant-name>.goskope.com) to replace APPLICATION_INSTANCE_URL.
  3. Optionally, configure:
MFA Claims

Note:

The Authentication Methods References (AMR) is automatically included in the SAML assertion by default. No additional configuration is required to enable this.

Complete the MFA Claim Configuration to define how the authentication context is sent in the SAML assertion.

  1. Under Auth Context, choose one of the following options based on your SP's requirements:
    • Send a single value for all successful MFA factors - select if the Service Provider accepts a generic confirmation for any MFA login. Enter the single URL or URN they accept
    • Send specific factors - select this option to map individual JumpCloud MFA methods to distinct values. In the Factor Mapping table, add each MFA factor enabled in your organization and enter the corresponding value required by the Service Provider
    • Send single value and specific factors - select to send both a generic identifier and specific factor details in the assertion

Tip:

Refer to your Service Provider's documentation to determine the specific URN or URL values required (e.g., Salesforce Session Security Levels). The values entered in this configuration must exactly match what the Service Provider expects.

MFA Factor Service Provider Notes
Password Reference your Service Providers's documentation for the values they expect for each factor
TOTP
WebAuthN
Push Notification JumpCloud Protect or other authenticator application
Duo Security
Device Trust
Device Trust + User Verification JumpCloud Go
API Key
External Identity Provider
Attributes

Configure User Attributes to be sent to the SP in assertions. User attributes are unique to each user. You can include attributes for standard user detail attributes or for custom attributes. For example, you can include standard attributes for users’ employee ID and department, or you can include a custom attribute for users’ application ID. Standard attributes are configured in the User Panel Details tab's User Information and Employee Information sections.

Unlike user attributes, a Constant Attribute can be sent for every user in a specific group or application profile.

Note:

If required attributes are present, they are not editable.

  1. Under User Attributes, click add attribute:
    • Service Provider Attribute Name - enter the service provider’s name for the attribute
    • JumpCloud Attribute Name - select the corresponding attribute from the drop down list
  2. Repeat these steps for any desired user or custom attributes.
  3. Under Constant Attributes, click add attribute:
    • Service Provider Attribute Name - enter the service provider’s name for the attribute
    • Value - enter the corresponding attribute in JumpCloud
  4. If groups are supported, select Include Group Attribute.

Learn More

  1. Click Save.

Download the JumpCloud metadata file

  1. If you've closed the app:
    • Find your app in the Configured Applications list and select its checkbox
    • Click Export Metadata in the top right corner of the window
  2. If you are still on the SSO tab of the app:
    • Click Export Metadata
  3. The JumpCloud-<applicationname>-metadata.xml will be exported to your local Downloads folder.

Tip:

Metadata can also be downloaded from the Configured Applications list. Search for and select the application in the list and then click Export Metadata in the top right corner of the window.

To complete the Netskope SSO configuration:

  1. In your Netskope account, go to Settings > Administration > SSO.
  2. In the SSO/SLO Settings section, click EDIT SETTINGS.
  3. Select Enable SSO.
  4. Enter the following:
    • IDP URL: Enter the JumpCloud IDP URL.
    • IDP ENTITY ID: Enter the JumpCloud IdP Entity ID.
    • IDP CERTIFICATE: Paste the contents of the downloaded certificate.
  5. Click Submit.

Authorizing User SSO Access

Users are implicitly denied access to applications. After you connect an application to JumpCloud, you need to authorize user access to that application. You can authorize user access from the Applications, Users List or User Groups page. 

To authorize user access from the Application’s page

  1. Log in to the JumpCloud Admin Portal.

Important:

If your data is stored outside of the US, check which login URL you should be using depending on your region, see JumpCloud Data Centers to learn more.

  1. Go to Access > SSO Applications, then select the application to which you want to authorize user access.
  2. Select the User Groups tab. If you need to create a new group of users, see Get Started: User Groups.
  3. Select the check box next to the desired group of users to which you want to give access.
  4. Click Save. 

To learn how to authorize user access from the Users or User Groups pages, see Authorize Users to an SSO Application.

Validating SSO user authentication workflow(s)

IdP-initiated user workflow

  • Access the JumpCloud User Console
  • Go to Applications and click an application tile to launch it
  • JumpCloud asserts the user's identity to the SP and is authenticated without the user having to log in to the application

SP-initiated user workflow

  • Go to the SP application login - generally, there is either a special link or an adaptive username field that detects the user is authenticated through SSO

Note:

This varies by SP.

  • Login redirects the user to JumpCloud where the user enters their JumpCloud credentials
  • After the user is logged in successfully, they are redirected back to the SP and automatically logged in

Configuring Identity Management via SCIM

To configure Netskope for SCIM Credentials:

  1. In your Netskope account, go to Settings > Tools > REST API v2.
  2. Ensure REST API Status is enabled.
  3. Click New Token, enter JumpCloud, and select a token expiry duration.
  4. Click ADD ENDPOINT and select the /api/v2/scim/Users and /api/v2/scim/Groups endpoints with Read+Write privileges.
  5. Click Save and copy the token immediately.

Warning:

The token may only be shown once. Copy and save the tokens for future reference.

To configure JumpCloud and activate SCIM:

  1. In the Netskope application configuration, select the Identity Management tab.
  2. Click Configure.
  3. In the Base URL field, enter the SCIM Endpoint, https://<tenant-name>.goskope.com/api/v2/scim.
  4. In the Token Key field, paste the REST API v2 token you copied from Netskope.
  5. Click Activate.
  6. Under Export Attribute Mapping, ensure the userName SCIM attribute is mapped to the JumpCloud username property, as this acts as the mandatory UPN for Netskope.

Attribute Mappings

The Export Attributes Mapping table lists the Required and Optional Mappings that JumpCloud sends to the Service Provider. See Attribute Considerations for more information regarding attribute mapping considerations. Learn about JumpCloud Properties and how they work with system users in our API. 

Map the userName SCIM attribute to the JumpCloud username username property to serve as the mandatory UPN for Netskope.

Netskope Attributes

JumpCloud Attribute SCIM Attribute Applied
Required Mappings
username userName create and update
email emails create and update
Optional Mappings
company $enterpriseUser.organization create and update
costCenter $enterpriseUser.costCenter create and update
department $enterpriseUser.department create and update
employeeIdentifier $enterpriseUser.employeeNumber create and update
employeeType userType create and update
firstname name.givenName create and update
jobTitle title create and update
lastname name.familyName create and update
notNullOrEmpty(jcUser.displayname) ? jcUser.displayname : (notNullOrEmpty(jcUser.lastname) ? jcUser.firstname + ' ' + jcUser.lastname : jcUser.firstname) displayName create and update
notNullOrEmpty(providerUser.externalId) ? providerUser.externalId : jcUser.id externalId create and update
notNullOrEmpty(providerUser.locale) ? providerUser.locale : 'en-US' locale create and update
notNullOrEmpty(providerUser.preferredLanguage) ? providerUser.preferredLanguage : 'en-US' preferredLanguage create and update
notNullOrEmpty(providerUser.preferredLanguage) ? providerUser.preferredLanguage : 'en-US' addresses create and update
toScimEmails(jcUser.email) emails create and update
toScimPhoneNumbers(find(jcUser.phoneNumbers, .type == 'work') ?? first(jcUser.phoneNumbers)) phoneNumbers create and update

To update your token

  1. After generating a new token in your SP, log in to the JumpCloud Admin Portal.

Important:

If your data is stored outside of the US, check which login URL you should be using depending on your region, see JumpCloud Data Centers to learn more.

  1. Go to Access > SSO Applications.
  2. Search for the application and click to open its configuration panel. 
  3. Select the Identity Management tab.
  4. Expand the Configuration Settings section.
  5. In the Token Key field, paste your updated token.

Note:
  • This may also be called API Key, Client Secret or Bearer Token.
  • If present, you do not need to update the Client ID.
  1. Click Update.

Warning:

Clicking Save will not update your token. You must click Update.

  1. You will get a message saying your Identity Management integration has been successfully verified.

Attribute Mappings

The Export Attributes Mapping table lists the Required and Optional Mappings that JumpCloud sends to the Service Provider. See Attribute Considerations for more information regarding attribute mapping considerations. 

Learn about JumpCloud Properties and how they work with system users in our API. 

Deleting user attributes

Important:

It's highly recommended you use all optional mappings. This creates a more complete user profile, enabling better automation and more accurate access management within the application.

  1. From your connector’s configuration page, select the Identity Management tab.
  2. In the Export Attribute Mapping section, click Edit. The Optional Mappings table will open.
  3. Click Delete (Delete icon) to remove any optional attributes.
  1. When finished, click Update.

Note:

Attributes that were initially included and populated in the user record and then deleted at a later time will not be modified or removed from the user record.

Restoring default user attributes

  1. From your connector’s configuration page, select the Identity Management tab.
  2. In the Export Attribute Mapping section, click Edit. The Optional Mappings table will open.
  3. Scroll to the bottom of the table and select Restore Defaults.
  4. Click Update and then click Save.
Modifying User Attributes (Private Preview – Coming Soon)

Modifying User Attributes (Private Preview – Coming Soon)

Note:

This new functionality is in Private Preview. Contact your Account Manager to enable it. Your feedback helps us evolve this feature so share your suggestions at the bottom of the article. Learn More

To add user attributes

  1. From your connector’s configuration page, select the Identity Management tab.
  2. Expand the Export Attribute Mapping section and click Edit. The Optional Mappings table will open.
  3. Scroll to the bottom of the table and click +Add Attribute.
  4. Select one of the mapping types:
    • Direct Mapping (JSON Path) - send the value from a user attribute in JumpCloud directly to an attribute in the service provider
      • From the JumpCloud Attribute dropdown, select the desired attribute
        • If you choose “Custom User Attribute” you must type the name of the attribute exactly as it on the user details page. To see the dropdown again, you must delete the attribute and add a new attribute
      • From the SCIM Attribute dropdown, select the corresponding (destination) attribute
    • Expression - transform or combine multiple user attributes into a single, custom value before sending it to the service provider
      • Enter the expression in the JumpCloud Attribute field
      • From the SCIM Attribute dropdown, select the corresponding (destination) attribute
    • Constant - send a fixed, predefined value—like a specific company name —for every user to the service provider
      • This is a free text field with no validation, e.g., the attribute must match exactly, including case, to the corresponding attribute in the user record. Once the custom attribute is added, you must delete it and readd a new custom attribute to see the dropdown again.
  5. Repeat these steps for additional attributes.
  6. Click Preview Mappings to review the User Schema.
    • If you do not select a specific user from the Preview Filter dropdown, the schema will default to the first user.
  1. Click Update.

Warning:

Updates to the user schema will not dynamically sync. To force a sync, you must modify the user group’s record in some way, like adding a space to the Description field.

To modify existing user attributes

This enhancement gives you complete control over the user attributes sent from JumpCloud to this application. You can now:

  • Fully control mappings - define which JumpCloud attribute or source data corresponds to an attribute in the SP's SCIM schema
  • Use a variety of source values - map data from the user's standard attributes, Manager field, custom attributes, or other data sources
  • Manipulate data with expressions - transform data, such as preferred first names and date format, using expressions before transmission to the SP. Learn more
  • Preview changes - review your new mappings to ensure accuracy before you save
  1. From your connector’s configuration page, select the Identity Management tab.
  2. Expand the Export Attribute Mapping section and click Edit.
  3. For the type of attribute you would like to modify:
    • Direct - select the new attribute from the dropdown(s)
    • Expression - click in the Expression field and make the desired edits. If necessary, select the new attribute from the SCIM Attribute dropdown
    • Custom - delete the existing values in either or both of the attribute fields and enter the new values
  4. Click Preview Mappings to review the updated User Schema.
  5. Click Update.

Important:

Updates to the user schema will not dynamically sync. To force a sync, you must modify the user group’s record in some way, like adding a space to the Description field.

Importing Users

This functionality is helpful if users have already been created in the application but have not been created in JumpCloud.

Important:

Users that are suspended in the application will not be created in JumpCloud.

  1. Log in to the JumpCloud Admin Portal.

Important:

If your data is stored outside of the US, check which login URL you should be using depending on your region, see JumpCloud Data Centers to learn more.

  1. Go to Access > SSO Applications.
  2. Search for the application and click to open its configuration panel. 
  3. Select the Identity Management tab.
  4. Click Manual Import.
  5. Select the users you want to create in JumpCloud from the application from the list of users that appear. Users in the list have two import statuses:
    • New - user has not been imported
    • Imported - user has been imported and has an account in JumpCloud

Tip: Try using the New Users-only filter when selecting users to import. This will move all of your new users to the top of the list, making them easier to identify and select.

  1. Click Import.
    • If you are importing less than 100 users, your import results will display in real time and you can continue onboarding your users 
    • If you have more than 100 users being imported, JumpCloud will send you an email when your import is complete
  1. You can now connect and grant users access to all their JumpCloud resources. Learn more in the Authorize Users to an Application and Connecting Users to Resources articles.

Warning: Imported users must be members of a user group bound to an application for JumpCloud to manage their identity in, and access to, the application.

SCIM Directory Insights Events

The following Directory Insights (DI) events provide visibility into failures and detailed information about the user and group data being added or updated from HR or other external solutions to JumpCloud.

Note:

Customers with no package or the Device Management Package will need to add the Directory Insights à la carte option. Directory Insights is included in all other packages.

Identity Management DI Integration Events

Event Name Event Description
idm_integration_activate Logged when an IT admin attempts to activated new Identity Management integration.
idm_integration_update Logged when an IT admin attempts to update a configured and activated Identity Management integration.
idm_integration_reauth Logged when an IT admin attempts to change the credentials for an activated Identity Management integration.
idm_integration_delete Logged when an IT admin attempts to deactivate an activated Identity Management integration.

SCIM DI User Events

Event Name Event Description
user_create_provision Logged when JumpCloud tries to create a new user in service provider application.
user_update_provision Logged when JumpCloud tries to update an existing user in service provider application.
user_deprovision Logged when JumpCloud tries to change an existing user to inactive in the service provider application.
user_delete_provision Logged when JumpCloud tries to delete an existing user in service provider application.
user_lookup_provision Logged when JumpCloud encounters an issue when trying to lookup a user to determine if the user needs to be created or updated.

SCIM DI Group Events

Important:

These DI events will only be present if SCIM Groups are supported.

Event Name Event Description
group_create_provision Logged when JumpCloud tries to create a new group in service provider application.
group_update_provision Logged when JumpCloud tries to update an existing group in service provider application.
group_delete_provision Logged when JumpCloud tries to delete an existing group in service provider application.

Removing the Integration

Important:

These are steps for removing the integration in JumpCloud. Consult your SP's documentation for any additional steps needed to remove the integration in the SP. Failure to remove the integration successfully for both the SP and JumpCloud may result in users losing access to the application.

To deactivate the IdM Integration

  1. Log in to the JumpCloud Admin Portal.

Important:

If your data is stored outside of the US, check which login URL you should be using depending on your region, see JumpCloud Data Centers to learn more.

  1. Go to Access > SSO Applications.
  2. Search for the application that you’d like to deactivate and click to open the configuration window. 
  3. Click Actions, Deactivate IdM and then click confirm.

To deactivate the SSO Integration or Bookmark

  1. Log in to the JumpCloud Admin Portal.

Important:

If your data is stored outside of the US, check which login URL you should be using depending on your region, see JumpCloud Data Centers to learn more.

  1. Go to Access > SSO Applications.
  2. Search for the application that you’d like to deactivate and click to open its details panel. 
  3. Select the SSO or Bookmark tab.
  4. Scroll to the bottom of the configuration.
  5. Click Deactivate SSO or Deactivate Bookmark. 
  6. Click save. 
  7. If successful, you will receive a confirmation message.

To delete the application

  1. Log in to the JumpCloud Admin Portal.

Important:

If your data is stored outside of the US, check which login URL you should be using depending on your region, see JumpCloud Data Centers to learn more.

  1. Go to Access > SSO Applications.
  2. Search for the application that you’d like to delete.
  3. Check the box next to the application to select it.
  4. Click Delete.
  5. Enter the number of the applications you are deleting
  6. Click Delete Application.
  7. If successful, you will see an application deletion confirmation notification.
Back to Top

List IconIn this Article

Still Have Questions?

If you cannot find an answer to your question in our FAQ, you can always contact us.

Submit a Case