Integrate with Paylocity

Give your users convenient but secure Single Sign On (SSO) access to Paylocity using their JumpCloud credentials with the SSO integration. Import users from Paylocity to JumpCloud using the SCIM integration. Save time and cost related to user account management and avoid mistakes, as well as potential security risks, related to manually creating users.

Read this article to learn how to setup the Paylocity integration.

Prerequisites

• A JumpCloud administrator account
• JumpCloud SSO Package or higher or SSO à la carte option
• A Paylocity user account with administrator permissions
• Your Paylocity company ID
• View and Edit permission to the HR & Payroll > User Access > SSO Configuration Menu Item in Paylocity Security Role
• Paylocity SCIM integration user credentials

Important Considerations

• SSO is required for SCIM
• If you have update your credentials, you must deactivate the integration, update your credentials, and then reactivate the integration
• Paylocity does not support configuration for SSO on a Company Set level
  • An SSO Integration must be created for each individual company within the set, as individuals are matched on both the Company ID and either the full work email address or Employee ID in which they reside in Paylocity. These attributes are set as part of the SSO configuration and are provided in the attributes of the SAML response
• Authentication for the SCIM integration is OAuth2.0
• The SCIM integration is only for importing new users from Paylocity to JumpCloud:
  • It does not support provisioning or updating from JumpCloud to Paylocity
  • It currently only supports creating new users. Updates to users in Paylocity will not sync back to JumpCloud

Attribute considerations

• A default set of attributes are managed for users. See the Attribute Mappings section for more details

Configuring the SSO Integration

To configure JumpCloud

1. Access the JumpCloud Admin Portal.

Important

If your data is stored outside of the US, check which login URL you should be using depending on your region. If your organization uses LDAP, RADIUS, or requires firewall allow list configuration, the Fully Qualified Domain Names (FQDNs) will also be region specific. See JumpCloud Data Centers for the URLs, FQDNs, and IP addresses.

1. Go to Identity Management > HR Directories
2. In the Paylocity tile, click Configure.
3. Click +Create New Application and then click Next.
4. Enter a Display Label in the General Info tab. Optionally, you can enter a description and adjust the logo shown for the application.
5. Click Save Application and then Configure Application.
6. Select the SSO tab.
7. In the IDP Entity Id field, replace YOUR_PAYLOCITY_COMPANY_ID with your Paylocity company ID to create a unique value, which is required by Paylocity (e.g., JumpCloud-123456).
8. Optionally, configure:

MFA Claims

note

The Authentication Methods References (AMR) is automatically included in the SAML assertion by default. No additional configuration is required to enable this.

Complete the MFA Claim Configuration to define how the authentication context is sent in the SAML assertion.

1. Under Auth Context, choose one of the following options based on your SP's requirements:
   • Send a single value for all successful MFA factors - select if the Service Provider accepts a generic confirmation for any MFA login. Enter the single URL or URN they accept
   • Send specific factors - select this option to map individual JumpCloud MFA methods to distinct values. In the Factor Mapping table, add each MFA factor enabled in your organization and enter the corresponding value required by the Service Provider
   • Send single value and specific factors - select to send both a generic identifier and specific factor details in the assertion

tip

Refer to your Service Provider's documentation to determine the specific URN or URL values required (e.g., Salesforce Session Security Levels). The values entered in this configuration must exactly match what the Service Provider expects.

MFA Factor	Service Provider	Notes
---	---	---
Password	Reference your Service Providers's documentation for the values they expect for each factor
TOTP
WebAuthN
Push Notification		JumpCloud Protect or other authenticator application
Duo Security
Device Trust
Device Trust + User Verification		JumpCloud Go (requires explicit configuration - see the next table)
API Key
External Identity Provider

MFA Method	MFA Value in AMR Claim
---	---
apikey	swk
duo	mfa
pwd	pwd
totp	otp
unk
wan	hwk
push	mfa
uv
durt	hwk
durt_uv	hwk
ext_idp

Learn more about MFA Claims.

9. Verify the Paylocity User mapping in the USER ATTRIBUTE MAPPING section.
   • Paylocity supports either the full work email address or employee Id for SSO login. The default is set to email but can be changed to the field where the Paylocity employee Id value is stored in JumpCloud, (e.g., employeeIdentifier or a custom field.)
10. In the CONSTANT ATTRIBUTES section, replace YOUR_PAYLOCITY_COMPANY_ID with your Paylocity company id for the PaylocityEntity mapping .
11. Click Save.

Download the JumpCloud metadata file

1. If you've closed the app:
   • Find your app in the Configured Applications list and select its checkbox
   • Click Export Metadata in the top right corner of the window
2. If you are still on the SSO tab of the app:
   • Click Export Metadata
3. The JumpCloud-<applicationname>-metadata.xml will be exported to your local Downloads folder.

tip

Metadata can also be downloaded from the Configured Applications list. Search for and select the application in the list and then click Export Metadata in the top right corner of the window.

To configure Paylocity

1. Log into Paylocity’s HR & Payroll.
2. Select User Access" > SSO Configuration > SSO Integration > Add SSO Integration.
3. Set the following values:
   • SSO Provider - JumpCloud SSO
   • Status - Active
   • Upload the Metadata file (xml) generated from the JumpCloud
4. Click Save
5. After you have completed the above steps, you can start assigning people to the application.
   • Please ensure all users have a username and work email address in Paylocity’s HR & Payroll module
6. For any questions, please contact your Paylocity Account Manager at service@paylocity.com

Authorizing SSO Application Access

Users are implicitly denied access to SSO Applications. After you connect an application to JumpCloud, you need to authorize user access to that application. You can authorize user access from the Applications, Users List or User Groups page.

To authorize user access from the SSO Application’s page

1. 1. Log in to the JumpCloud Admin Portal.

Important

If your data is stored outside of the US, check which login URL you should be using depending on your region. If your organization uses LDAP, RADIUS, or requires firewall allow list configuration, the Fully Qualified Domain Names (FQDNs) will also be region specific. See JumpCloud Data Centers for the URLs, FQDNs, and IP addresses.

2. Go to Access > SSO Applications, then select the application to which you want to authorize user access.
3. Select the User Groups tab. If you need to create a new group of users, see Get Started: User Groups.
4. Select the check box next to the desired group of users to which you want to give access.
5. Click Save.

To learn how to authorize user access from the Users or User Groups pages, see Authorize Users to an SSO Application.

Validating SSO user authentication workflow(s)

Check your SP's documentation to ensure that both workflows are supported.

IdP-initiated user workflow

• Access the JumpCloud User Console
• Go to Applications and click an application tile to launch it
• JumpCloud asserts the user's identity to the SP and is authenticated without the user having to log in to the application

SP-initiated user workflow

• Go to the SP application login - generally, there is either a special link or an adaptive username field that detects the user is authenticated through SSO

note

This varies by SP.

• Login redirects the user to JumpCloud where the user enters their JumpCloud credentials
• After the user is logged in successfully, they are redirected back to the SP and automatically logged in

tip

See Additional User Experience Considerations when setting up JumpCloud SSO.

Configuring the SCIM Integration

Important

You must configure SSO first. See the sections above.

To configure Paylocity

1. In Paylocity, navigate to HR & Payroll > User Access > SSO Configuration.
2. Click SCIM Provisioning.
3. Select Yesunder Enable SCIM Provisioning.
4. Enter a username.

Important

Usernames must be between 8-20 characters and must not contain any special characters other than "\_" and ".".

5. Enter a password and confirm it.
6. Click Save.

To navigate to your JumpCloud SCIM connector

1. Log in to the JumpCloud Admin Portal.

Important

If your data is stored outside of the US, check which login URL you should be using depending on your region. If your organization uses LDAP, RADIUS, or requires firewall allow list configuration, the Fully Qualified Domain Names (FQDNs) will also be region specific. See JumpCloud Data Centers for the URLs, FQDNs, and IP addresses.

2. Go to Access > SSO Applications.

3. Create a new application or select it from the Configured Applications list.

4. Select the Provisioning tab.

To configure JumpCloud

1. Review and edit any user attribute mappings.
2. Click Configure.

note

The default user attribute mappings will be used for the initial sync for already connected users if mappings aren’t edited before clicking the Configurebutton.

3. Click Continue.
4. A window will open with the Paylocity Login Page.

note

If you click the Backbutton to return to the JumpCloud admin portal, any edits they made to the attribute mappings will be lost and need to be reapplied before clicking Configureagain.

5. Enter the company id and SCIM user credentials and click Login.
6. You will be redirected back to the Paylocity connector page in the JumpCloud Admin Portal.

Attribute Mappings

See Attribute Considerations for more information regarding attribute mapping considerations.

Learn about JumpCloud Properties and how they work with system users in our API.

Paylocity User Attributes

JumpCloud Attribute	SCIM Attribute	Notes
---	---	---
Required Mappings
email	userName
Optional Mappings
company	$enterpriseUser.organization
costCenter	$enterpriseUser.costCenter
department	$enterpriseUser.department
employeeIdentifier	$enterpriseUser.employeeNumber
employeeType	userType
firstname	name.givenName
isAssignedToApp && !(jcUser.suspended == true)	active
jobTitle	title
lastname	name.familyName
notNullOrEmpty(jcUser.displayname) ? jcUser.displayname : (notNullOrEmpty(jcUser.lastname) ? jcUser.firstname + ' ' + jcUser.lastname : jcUser.firstname)	displayName
notNullOrEmpty(providerUser.externalId) ? providerUser.externalId : jcUser.id	externalId
notNullOrEmpty(providerUser.locale) ? providerUser.locale : 'en-US'	locale
notNullOrEmpty(providerUser.preferredLanguage) ? providerUser.preferredLanguage : 'en-US'	preferredLanguage
toScimAddresses(find(jcUser.addresses, .type == 'work') ?? first(jcUser.addresses))	addresses
toScimEmails(jcUser.email)	emails
toScimPhoneNumbers(find(jcUser.phoneNumbers, .type == 'work') ?? first(jcUser.phoneNumbers))	phoneNumbers

SCIM Directory Insights Events

SCIM Events Tables

The following Directory Insights (DI) events provide visibility into failures and detailed information about the user and group data and attributes being added or updated from HR or other external solutions to JumpCloud.

note

Customers with no package or the Device Management Package will need to add the Directory Insights à la carte option. Directory Insights is included in all other packages.

SCIM DI Integration Events

Event Name	Event Description
---	---
idm_integration_activate	Logged when an IT admin attempts to activated new SCIM integration.
idm_integration_update	Logged when an IT admin attempts to update a configured and activated SCIM integration.
idm_integration_delete	Logged when an IT admin attempts to deactivate an activated SCIM integration.
idm_integration_auth	Logged when an IT admin authenticates/authorizes a SCIM integration.
idm_integration_reauth	Logged when an IT admin attempts to change the credentials for an activated SCIM integration.

SCIM DI User Events

Event Name	Event Description
---	---
user_lookup_provision	Logged when JumpCloud encounters an issue when trying to lookup a user to determine if the user needs to be created or updated.
user_create_provision	Logged when JumpCloud tries to create a new user in service provider application.
user_update_provision	Logged when JumpCloud tries to update an existing user in service provider application.
user_deprovision	Logged when JumpCloud tries to change an existing user to inactive in the service provider application.
user_delete_provision	Logged when JumpCloud tries to delete an existing user in service provider application.

SCIM DI Attribute Events

Event Name	Event Description
---	---
attributemappings_add	Logged when the attribute mappings of an application are added.
attributemappings_delete	Logged when the attribute mappings of an application are deleted.
attributemappings_update	Logged when the attribute mappings of an application are updated.

tip

You can filter these events for users or groups by using the Resource Type filter and then selecting user\_attribute\_mapping or user\_group\_attribute\_mapping.

SCIM DI Group Events

Important

These DI events will only be present if SCIM Groups are supported.

Event Name	Event Description
---	---
group_create_provision	Logged when JumpCloud tries to create a new group in service provider application.
group_update_provision	Logged when JumpCloud tries to update an existing group in service provider application.
group_delete_provision	Logged when JumpCloud tries to delete an existing group in service provider application.

Removing the Integration

Removing the Integration

warning

These are steps for removing the integration in JumpCloud. Consult your SP's documentation for any additional steps needed (like disabling "mandatory SSO login" settings) to remove the integration in the SP. Failure to remove the integration successfully for both the SP and JumpCloud may result in users, including admins, losing access to the application.

Important

If your data is stored outside of the US, check which login URL you should be using depending on your region. If your organization uses LDAP, RADIUS, or requires firewall allow list configuration, the Fully Qualified Domain Names (FQDNs) will also be region specific. See JumpCloud Data Centers for the URLs, FQDNs, and IP addresses.

To deactivate the SCIM Integration

1. 1. Log in to the JumpCloud Admin Portal.

2. Go to Access > SSO Applications.

3. Search for the application that you’d like to deactivate and click to open the configuration window.

4. Click Actions > Deactivate IdM and then click confirm.

To deactivate the SSO Integration

1. Log in to the JumpCloud Admin Portal.
2. Go to Access > SSO Applications.
3. Search for the application that you’d like to deactivate and click to open its details panel.
4. Select the SSOtab.
5. Scroll to the bottom of the configuration.
6. Click Deactivate SSO.
7. Click Save.
8. If successful, you will receive a confirmation message.

To delete the application

1. Log in to the JumpCloud Admin Portal.

2. Go to Access > SSO Applications.

3. Search for the application that you’d like to delete.

4. Check the box next to the application to select it.

5. Click Delete.

6. Enter the number of the applications you are deleting

7. Click Delete Application.

8. If successful, you will see an application deletion confirmation notification.