Integrate with Slack

Use JumpCloud SAML Single Sign On (SSO) to give your users convenient but secure access to all their web applications with a single set of credentials. Provision, update, and deprovision users in Slack in real-time from JumpCloud using the SCIM integration.

Read this article to learn how to setup the Slack integration.

Prerequisites

• A JumpCloud administrator account
• JumpCloud SSO Package or higher or SSO à la carte option
• A Slack Business+ or Enterprise Gridplan
• A Slack Administrator or Workspace Owner account
• Your Slack domain and team name

Important Considerations

• We recommend that you activate SSO for Slack prior to creating an SCIM integration with Slack to simplify the login process for your users and reduce the number of usernames and passwords they have to remember
  • If you choose to not activate SSO, deselect Show this application in the User Portal in the General Info tab of the Slack configuration window. This will hide the inactive Slack tile from your users
• SAML is the recommended method for managing secure user authentication into Slack
• If you have update your credentials, you must deactivate the integration, update your credentials, and then reactivate the integration
• Once you’ve set up SSO, members that are required to sign in with SSO will get an email. The email will prompt members to bind their Slack accounts with JumpCloud. Members will have 72 hours to bind their account before their link expires
• The email address of the JumpCloud accounts must correspond to the email address associated with the Slack Plus accounts
• JumpCloud Session Settings are not passed into Slack, session duration will need to be set in Slack as well
• If you are setting up Slack SCIM Integration for an organization that is managed from the Multi-Tenant Portal (MTP), you need to use a local JumpCloud administrator from that particular organization to do so
• Users that are created in Slack remain in an ‘Inactive’ state until they log in to their JumpCloud User Portal and launch Slack using their JumpCloud credentials
• If you delete an integrated Slack application from your Applications list, the Slack application is removed from JumpCloud, but any previously bound users remain active in Slack. Additionally, these users can log in to Slack with the password they used prior to your deletion of the Slack application from your JumpCloud account
• Users can’t be permanently deleted from Slack, they can only be deactivated
• If you try to provision a user with a duplicate email address, it will fail. Even if the existing user has been previously deactivated in Slack, the existing user email address has to be manually updated in Slack to unbind the email and allow it to be reprovisioned
• When creating a new user, make sure that nothing is invalid in the custom profile, otherwise all profile fields will be dropped
• Creating or deactivating a Multi-Channel Guest is only available on the Enterprise Grid Plan
• When creating a Single-Channel Guest, or creating a guest on the Business+ plan, you can create a member and then change their role to a guest
• Group mention handles (@group) can’t be set via the SCIM provisioning API
• Subteams that are automatically generated by Slack, like “Team Admins,” can’t be updated via the SCIM API
• The SCIM API is rate limited. If your requests are being limited, an “HTTP: 429” error will be returned
• Don't add the same user group to multiple Slack connectors in JumpCloud. If you do, users who are members of that user group will be deactivated in the application if one of the connectors is removed from the user group
• Slack maps the value sent for the 'title' user attribute to both the ‘title’ and 'What I do’ field. If users have been given the ability to change the "What I do value in Slack", their change will be overridden whenever a user update is sent via the SCIM integration. The mapping to the 'What I do' field is completely controlled by Slack
• Groups are supported - see Group Considerations

Attribute considerations

• A default set of attributes are managed for users. See the Attribute Mappings section for more details
• Slack does not store typefor addresses. The type field will be used to determine which address is the "primary address" if the request does not specify one, however the type is not stored
• Username values and channel name values must be unique and share the same namespace. For example, you can't have a username for @general if you also have a #general channel in the Slack workspace
• There is a limit of 50 custom profile fields, which includes fields set via the SCIM API. If your request would cause more than 50 fields to exist, the call will fail with a unable_to_create_team_profile_fields error
• username:
  • You can't use special characters, such as john+doe@email.com
  • Must be less than 21 characters
  • Must be unique
• displayName:
  • Values aren't entirely unique; for example, two users can have the same display name
  • You can use non-English characters, spaces, and capitalization
  • You can include periods ( . ), underscores ( _ ), hyphens ( - ), apostrophes ( ' ), brackets ( { }, [ ] ) and separators ( , / ; )
• Slack only allows matching with the attributes userNameand email

Group considerations

• We recommend selecting Enable management of User Groups and Group Membership in this application to make channel membership management easier
• A Slack Enterprise Grid SCIM integration can only create and manage IdP Groups, not User Groups. User Groups can only be managed through the Slack interface directly or a completely different API. See Connect identity provider groups to your Enterprise Grid org
  • To automate the management of User Groups when using Slack Enterprise Grid, you will need to create and run your own script to utilize the https://slack.com/api/usergroups API endpoint to perform user group management operations
• If the Enable management of User Groups and Group Membership in this application is enabled, groups cannot be added back to the Slack application after being removed
• Removing a group after it has been added to the Slack application in JumpCloud typically results in the group being disabled in Slack
• Adding the group back to the Slack application in JumpCloud results in errors and fails, because there is no functionality in the SCIM protocol for enabling and disabled groups

Creating a new JumpCloud Application Integration

1. 1. Log in to the JumpCloud Admin Portal.

Important

If your data is stored outside of the US, check which login URL you should be using depending on your region. If your organization uses LDAP, RADIUS, or requires firewall allow list configuration, the Fully Qualified Domain Names (FQDNs) will also be region specific. See JumpCloud Data Centers for the URLs, FQDNs, and IP addresses.

2. Go to Access> SSO Applications.
3. Click + Add New Application.
4. You can also enter the name of the application in the Search field and select it.
5. You can either select an application from the available list or select Custom Application, and click Next.
6. Select the required options from the Select Options page and click Next. The Enter General Info page is displayed.
7. On the Enter General Info page, you can customize the display label, description and how the application displays:
   • Description - add a description that users will see in their user portal
   • User Portal Image - choose Logoor Color Indicator
   • Show in User Portal - select to ensure the app is visible in the user portal
8. Optionally, expand the Advanced Settings section and customize the IdP URL:
   • Enter a custom value to replace the default application name in the SSO IdP URL endpoint ( https://sso.jumpcloud.com/saml2/{custom_value})

warning

The SSO IdP URL is not editable after the application is created. If you need to change this URL later, you must delete and recreate the connector.

9. Click Save Application.
10. Next, click:
    • Configure Application and go to the next section
    • Close to configure your new application at a later time

tip

Users are implicitly denied access to applications. See Authorize Users to an SSO Application.

note

Linking the Application to AI Gateway

• The sections below walk through SSO configuration for this application. When that is complete, you can connect this application to JumpCloud AI Gateway so users can access its data from supported AI clients (for example, Cursor or ChatGPT).
• Register the MCP server under Access > AI Gateway and link it to this application. The server appears under Servers in AI Gateway. When you open the application from Access > SSO Applications, the same server appears on the application's AI Gateway tab.
• Not all applications support MCP. Confirm support with the application vendor or see Configure AI Gateway Integrations to learn more about supported integrations.

See Configure Slack for the AI Gateway to learn more about connecting Slack to the AI Gateway.

Configuring the SSO Integration

To navigate to your JumpCloud SSO connector

1. Log in to the JumpCloud Admin Portal.

Important

If your data is stored outside of the US, check which login URL you should be using depending on your region. If your organization uses LDAP, RADIUS, or requires firewall allow list configuration, the Fully Qualified Domain Names (FQDNs) will also be region specific. See JumpCloud Data Centers for the URLs, FQDNs, and IP addresses.

2. Go to Access > SSO Applications.

3. Create a new application or select it from the Configured Applications list.

4. Select the SSO tab.

To configure JumpCloud

1. Replace any instances of YOURDOMAIN and TEAMNAME with your Slack values.
2. Optionally, configure:

MFA Claims

note

The Authentication Methods References (AMR) is automatically included in the SAML assertion by default. No additional configuration is required to enable this.

Complete the MFA Claim Configuration to define how the authentication context is sent in the SAML assertion.

1. Under Auth Context, choose one of the following options based on your SP's requirements:
   • Send a single value for all successful MFA factors - select if the Service Provider accepts a generic confirmation for any MFA login. Enter the single URL or URN they accept
   • Send specific factors - select this option to map individual JumpCloud MFA methods to distinct values. In the Factor Mapping table, add each MFA factor enabled in your organization and enter the corresponding value required by the Service Provider
   • Send single value and specific factors - select to send both a generic identifier and specific factor details in the assertion

tip

Refer to your Service Provider's documentation to determine the specific URN or URL values required (e.g., Salesforce Session Security Levels). The values entered in this configuration must exactly match what the Service Provider expects.

MFA Factor	Service Provider	Notes
---	---	---
Password	Reference your Service Providers's documentation for the values they expect for each factor
TOTP
WebAuthN
Push Notification		JumpCloud Protect or other authenticator application
Duo Security
Device Trust
Device Trust + User Verification		JumpCloud Go (requires explicit configuration - see the next table)
API Key
External Identity Provider

MFA Method	MFA Value in AMR Claim
---	---
apikey	swk
duo	mfa
pwd	pwd
totp	otp
unk
wan	hwk
push	mfa
uv
durt	hwk
durt_uv	hwk
ext_idp

Learn more about MFA Claims.

Attributes

Configure User Attributes to be sent to the SP in assertions. User attributes are unique to each user. You can include attributes for standard user detail attributes or for custom attributes. For example, you can include standard attributes for users’ employee ID and department, or you can include a custom attribute for users’ application ID. Standard attributes are configured in the User Panel Details tab's User Information andEmployee Information sections.

Unlike user attributes, a Constant Attribute can be sent for every user in a specific group or application profile.

note

If required attributes are present, they are not editable.

1. Under User Attributes, click add attribute:
   • Service Provider Attribute Name - enter the service provider’s name for the attribute
   • JumpCloud Attribute Name - select the corresponding attribute from the drop down list
2. Repeat these steps for any desired user or custom attributes.
3. Under Constant Attributes, click add attribute:
   • Service Provider Attribute Name - enter the service provider’s name for the attribute
   • Value - enter the corresponding attribute in JumpCloud
4. Optionally, if groups are supported, select Include Group Attribute.

Learn More

3. Click Save.

Download the certificate

1. If you closed the application, find it in the Configured Applications list and click anywhere in the row to reopen its configuration window.
2. Click Actions > Download Certificate.

tip

The certificate.pem will download to your local Downloads folder.

To configure Slack

1. Login your Slack account as a Workspace Owner.
2. Go to Settings & administration > Workplace settings.
3. Select the Authentication tab, then click Configure for SAML Authentication.
4. Enter the following information:
   • SAML 2.0 Endpoint (HTTP) - enter the JumpCloud IdP URL
   • Identity Provider Issuer - enter the JumpCloud IDP Entity ID
   • Certificate - copy and paste the contents of the certificate downloaded in the previous section
5. Under Advanced Options:
   • Use the default value for the Service Provider Issuer (e.g., https://<teamname>.slack.com)
   • Uncheck Assertions Signed

warning

If Assertions Signed is left enabled, you will receive a "The Assertion of the SAML Response is not signed. Please check your [IDP] settings." error message.

6. Select any other of the desired options for SAML Authentication for users and workspace.
7. Click Save Configuration.

note

It's recommended to use It’s optional for the Authentication for your workspace must be used by until the SAML configuration is fully tested. This will allow you to use both – username/password and SAML authentication options.

9. In the Customize section in the Sign In Button Label field, enter JumpCloud.
10. Click Save Configuration.
11. You will then be sent to the JumpCloud User Portal to perform an initial SSO login and confirm the configuration.
12. After you have completed SSO as the administrator account, your authentication settings will be verified and enabled.

Authorizing SSO Application Access

Users are implicitly denied access to SSO Applications. After you connect an application to JumpCloud, you need to authorize user access to that application. You can authorize user access from the Applications, Users List or User Groups page.

To authorize user access from the SSO Application’s page

1. 1. Log in to the JumpCloud Admin Portal.

Important

If your data is stored outside of the US, check which login URL you should be using depending on your region. If your organization uses LDAP, RADIUS, or requires firewall allow list configuration, the Fully Qualified Domain Names (FQDNs) will also be region specific. See JumpCloud Data Centers for the URLs, FQDNs, and IP addresses.

2. Go to Access > SSO Applications, then select the application to which you want to authorize user access.
3. Select the User Groups tab. If you need to create a new group of users, see Get Started: User Groups.
4. Select the check box next to the desired group of users to which you want to give access.
5. Click Save.

To learn how to authorize user access from the Users or User Groups pages, see Authorize Users to an SSO Application.

Authorizing agent access

Agents are implicitly denied access to SSO applications. After you configure SCIM for a supported application, bind one or more agent groups on the application to grant agents access and start agent provisioning.

Agent access is managed through agent groups only. You cannot bind an individual agent directly to an application.

To authorize agent access from the SSO application page:

1. In JumpCloud Admin Portal, go to Access > SSO Applications and select the application.
2. Click the Agent Groups tab.
3. Select the checkbox next to each agent group that should have access to the application.
4. Click Save.

Agents in a bound agent group inherit access to the application. Removing an agent group removes access for the agents that inherited it through that group.

To authorize agent access from an agent group:

1. In JumpCloud Admin Portal, go to Identity Management > Agent Groups and select the agent group you want to configure.
2. Click the Applications tab.
3. Select the application and click Save.

note

Only applications that support agent identities appear for assignment from an agent group. If an application does not support agents, it is not available on the Applications tab.

Validating SSO user authentication workflow(s)

Check your SP's documentation to ensure that both workflows are supported.

IdP-initiated user workflow

• Access the JumpCloud User Console
• Go to Applications and click an application tile to launch it
• JumpCloud asserts the user's identity to the SP and is authenticated without the user having to log in to the application

SP-initiated user workflow

• Go to the SP application login - generally, there is either a special link or an adaptive username field that detects the user is authenticated through SSO

note

This varies by SP.

• Login redirects the user to JumpCloud where the user enters their JumpCloud credentials
• After the user is logged in successfully, they are redirected back to the SP and automatically logged in

tip

See Additional User Experience Considerations when setting up JumpCloud SSO.

Using JIT Provisioning

Additional attributes are required to use JIT provisioning. JIT required attributes are prepopulated and are on by default to enable JIT provisioning. You can’t edit the JIT required service provider attributes. You can customize the JumpCloud attribute name and the constant value for JIT required attributes. Toggle off the attributes to opt out of sending the attributes in the SAML assertion.

To complete the provisioning process

1. Authorize a user’s access to the application in JumpCloud.
2. Have the user log in to the application using SSO. The SAML assertion passes from JumpCloud to the service provider, and gives the service provider the information it needs to create the user account.

Configuring the SCIM Integration

To navigate to your JumpCloud SCIM connector

1. Log in to the JumpCloud Admin Portal.

Important

If your data is stored outside of the US, check which login URL you should be using depending on your region. If your organization uses LDAP, RADIUS, or requires firewall allow list configuration, the Fully Qualified Domain Names (FQDNs) will also be region specific. See JumpCloud Data Centers for the URLs, FQDNs, and IP addresses.

2. Go to Access > SSO Applications.

3. Create a new application or select it from the Configured Applications list.

4. Select the Provisioning tab.

To configure JumpCloud

1. Expand Configuration Settings and deselect Enable management of User Groups and Group Membership in this application if you do not want to provision, manage, and sync groups.
2. Review and edit any user attribute mappings.

note

The default user attribute mappings will be used for the initial sync for already connected users if mappings aren’t edited before clicking the Configurebutton.

3. Click Configure.
4. You're redirected to Slack to give JumpCloud permission to access your organization's Slack workspace. Click Allow.

note

If you click the Back button to return to the JumpCloud admin portal, any edits they made to the attribute mappings will be lost and need to be reapplied before clicking Configure again.

5. You will receive a confirmation that the SCIM integration has been successfully verified.
6. Select Slack from the Configured Applications list and select the Identity Managementtab.
7. Paste the token that was generated and then click Activate.

Provisioning Agents with SCIM

JumpCloud provisions agents and agent groups to supported SCIM applications using the same SCIM connection you configured for users. You do not create a separate SCIM connection for agents.

• When an agent group is bound to a supported application, JumpCloud automatically creates, updates, and deprovisions agent accounts in that application based on the agent lifecycle in JumpCloud.

  • Agent group bound to the application: Agents in the group are provisioned when SCIM is active
  • Agent attribute changes: The downstream agent account is updated
  • Agent is suspended: The downstream account is set to inactive (active: false)
  • Agent is re-activated: The downstream account is re-enabled (active: true)
  • Agent group is unbound, or agent is removed from the group: The downstream account is deprovisioned

• Agents and users are provisioned independently. An agent is never created, updated, or deleted through the user provisioning path.

• There is no separate setting to turn agent provisioning on. If the application supports agents and an agent group is bound, agents in that group are provisioned automatically.

Group Management and agent groups

The Enable management of User Groups and Group Membership in this application setting on the Provisioning tab controls group push for both user groups and agent groups:

• When group management is enabled, user groups and agent groups (for applications that support agent groups) provision as SCIM groups.
• When group management is disabled, neither user groups nor agent groups are pushed as SCIM groups.
• Individual agent account provisioning is not controlled by the group management setting. Agents in a bound agent group are provisioned as accounts regardless of whether group push is enabled.

note

• Agent credentials, secrets, and tokens are never sent in a SCIM payload.
• To stop provisioning agents to an application, unbind the agent groups from the application or delete the agents in JumpCloud.

Attribute Mappings

The User Attributes/User Group Attributes table lists the Required and Optional Mappings that JumpCloud sends to the Service Provider. See Attribute Considerations for more information regarding attribute mapping considerations.

Learn about JumpCloud Properties and how they work with system users in our API.

Modifying Attributes

To add user attributes

Important

It's highly recommended you use all optional mappings. This creates a more complete user profile, enabling better automation and more accurate access management within the application.

1. From your connector’s configuration page, select the Provisioning tab.

2. Expand the User Attributes section and click Edit. The Edit Attribute Mappings table will open.

3. Scroll to the bottom of the table and click +Add Attribute.

4. Select one of the mapping types:

   • Direct Mapping (JSON Path) - send the value from a user attribute in JumpCloud directly to an attribute in the service provider
     • From the JumpCloud Attribute dropdown, select the desired attribute
       • If you choose “Custom User Attribute” you must type the name of the attribute exactly as it on the user details page. To see the dropdown again, you must delete the attribute and add a new attribute
     • From the SCIM Attribute dropdown, select the corresponding (destination) attribute
   • Expression - transform or combine multiple user attributes into a single, custom value before sending it to the service provider
     • Enter the expression in the JumpCloud Attribute field
     • From the SCIM Attribute dropdown, select the corresponding (destination) attribute
   • Constant - send a fixed, predefined value—like a specific company name —for every user to the service provider
     • This is a free text field with no validation, e.g., the attribute must match exactly, including case, to the corresponding attribute in the user record. Once the custom attribute is added, you must delete it and readd a new custom attribute to see the dropdown again.

5. Repeat these steps for additional attributes.

6. Click Preview Mappings to review the User Schema.

   • If you do not select a specific user from the Preview Filter dropdown, the schema will default to the first user.

7. Click:

   • Save and Sync to initiate an immediate full sync of the updated attributes
   • Update to initiate the update during the next modification of the user group's record, like adding a space to the Description field

To add group attributes

1. From your connector’s configuration page, select the Provisioning tab.
2. If not already enabled, toggle on Enable management of User Groups and Group Membership in this application.
3. Expand the User Group Attributes section and click Edit.
4. Click +Add Attribute.
5. Select one of the mapping types:
   • Direct Mapping (JSON Path) - send a dynamically pulled JumpCloud group value directly to an attribute in the SP. From the JumpCloud Attribute dropdown, select:
     • Custom User Group Attribute - the value will change to jcUserGroup.attributes.
       • Add a <value> (name of the group) at the end of the attribute (jcUserGroup.attributes.DevOps)
       • From the SCIM Attribute dropdown, select Custom User Group Attribute and enter the corresponding destination attribute
     • id - the SCIM Attribute will change to externalId
     • name - the SCIM Attribute will change to displayName
   • Expression - use EXPR expressions to allow for more complex mapping logic:
     • Enter the expression in the JumpCloud Attribute field
     • From the SCIM Attribute dropdown, select the corresponding (destination) attribute
   • Constant - enter a fixed, hardcoded value you want assigned to a group:
     • Enter the value in the Constant Value field
     • From the SCIM Attribute dropdown, select the corresponding (destination) custom group attribute
6. Click Preview Mappings to review the Group Schema.
7. If everything is mapping correctly, click:
   • Save and Sync to initiate an immediate full sync of the updated attributes
   • Update to initiate the update during the next modification of the user group's record, like adding a space to the Description field

To modify existing attributes

1. From your connector’s configuration page, select the Provisioning tab.
2. Expand the User Attributes/User Group Attributes section and click Edit.
3. For the type of attribute you would like to modify:
   • Direct - select the new attribute from the dropdown(s)
   • Expression - click in the Expression field and make the desired edits. If necessary, select the new attribute from the SCIM Attribute dropdown
   • Custom - delete the existing values in either or both of the attribute fields and enter the new values
4. Click Preview Mappings to review the updated User Schema.
5. If the mappings look correct, click:
   • Save and Sync and then Continue to initiate an immediate full sync of the updated attributes
   • Update to initiate the update during the next modification of the user group's record, like adding a space to the Description field

Deleting attributes

1. From your connector’s configuration page, select the Provisioning tab.

2. In the User Attributes/User Group Attributes section, click Edit. The Optional Mappings table will open.

3. Click Delete () to remove any optional attributes.

4. Click:

   • Save and Sync and then Continue to initiate an immediate full sync of the updated attributes
   • Update to initiate the update during the next modification of the user group's record, like adding a space to the Description field

note

Attributes that were initially included and populated in the user record and then deleted at a later time will not be modified or removed from the user record.

Restoring the default attribute table

1. From your connector’s configuration page, select the Provisioning tab.
2. In the User Attributes/User Group Attributes section, click Edit. The Edit Attribute Mappings table will open.
3. Scroll to the bottom of the table and select Restore Defaults.
4. Click:
   • Save and Sync and then Continue to initiate an immediate full sync of the updated attributes
   • Update to initiate the update during the next modification of the user group's record, like adding a space to the Description field

Slack User Attributes

JumpCloud Attribute	SCIM Attribute	Notes
---	---	---
Required Mappings
email	userName
toScimEmails(jcUser.email)	emails
Optional Mappings
company	$enterpriseUser.organization
costCenter	$enterpriseUser.costCenter
department	$enterpriseUser.department
employeeIdentifier	$enterpriseUser.employeeNumber
employeeType	userType
firstname	name.givenName
isAssignedToApp && !(jcUser.suspended == true)	active
jobTitle	title
lastname	name.familyName
managerExternalId	$enterpriseUser.manager.managerId
notNullOrEmpty(jcUser.displayname) ? jcUser.displayname : (notNullOrEmpty(jcUser.lastname) ? jcUser.firstname + ' ' + jcUser.lastname : jcUser.firstname)	displayName
notNullOrEmpty(providerUser.externalId) ? providerUser.externalId : jcUser.id	externalId
notNullOrEmpty(providerUser.locale) ? providerUser.locale : 'en-US'	locale
notNullOrEmpty(providerUser.preferredLanguage) ? providerUser.preferredLanguage : 'en-US'	preferredLanguage
toScimAddresses(find(jcUser.addresses, .type == 'work') ?? first(jcUser.addresses))	addresses
toScimPhoneNumbers(find(jcUser.phoneNumbers, .type == 'work') ?? first(jcUser.phoneNumbers))	phoneNumbers

---

Slack Group Attributes

Slack Group Attribute	JumpCloud Group Attribute	Notes
---	---	---
external_id	id
Name	name
Members	members	Multi-valued

Group Management Considerations

Enabling Group Management

You must toggle on the Enable management of User Groups and Group Membership in this application option to manage groups and group membership in the application from JumpCloud.

Provisioning and Syncing Groups

• JumpCloud takes over management of existing groups in the application when the user group name in JumpCloud matches the name of the group in the application
• All user groups associated with the application in JumpCloud are synced. Syncing occurs when:
  • A membership or group change event occurs
  • You click Save and Sync after editing group attributes
• If a user group is disassociated from the application in JumpCloud, syncing immediately stops and the group is left as-is in the application. All members of that user group are deactivated in the application unless they are associated with another active application group that is managed from JumpCloud

Deleting Groups

• Managed groups deleted in JumpCloud are deleted in the application
• All members of the deleted group are deactivated in the application, unless they are associated with another active application group that is managed from JumpCloud

Disabling Group Management

• Disable group and group membership management by toggling off the Enable management of User Groups and Group Membership in this application option
• The managed groups and group membership are left as-is in the application
• JumpCloud stops sending group membership information for the user, but the user’s identity will continue to be managed from JumpCloud

Agent Attributes

On the Provisioning tab, the Agent Attributes section lists the default mappings JumpCloud sends when an agent is provisioned to this application.

Default Agent Attribute Mappings

JumpCloud Attribute	SCIM Attribute	Notes
---	---	---
Required Mappings
email	userName	The agent email is used as the username.
Optional Mappings
displayname	displayName	Agent display name.
notNullOrEmpty(providerAgent.externalId) ? providerAgent.externalId : jcAgent.id	externalId	Existing provider external ID, otherwise the JumpCloud agent ID.
isAssignedToApp && jcAgent.state == "ACTIVATED"	active	Active only while the agent is bound to the application and in the ACTIVATED state.

To review or edit agent attribute mappings:

1. Open the application and click the Provisioning tab.
2. Expand Agent Attributes and click Edit.
3. Review the Required Mappings and Optional Mappings tables.
4. Click Preview mappings to review how an agent will appear in the target application.
5. Click Save and Sync or Update.
6. To revert to the defaults shown above, click Restore Defaults.

Agent Group Attributes

For applications that support agent groups, the Agent Group Attributes section lists the default mappings JumpCloud sends when an agent group is provisioned as a SCIM group.

Default Agent Group Attribute Mappings

JumpCloud Attribute	SCIM Attribute	Notes
---	---	---
Required Mappings
name	displayName	Agent group name.
Optional Mappings
notNullOrEmpty(providerAgentGroup.externalId) ? providerAgentGroup.externalId : jcAgentGroup.id	externalId	Existing provider external ID, otherwise the JumpCloud agent group ID.
Group membership	members	Adding or removing an agent from the group updates membership in the downstream SCIM group.

To review or edit agent group attribute mappings:

1. Open the application and click the Provisioning tab.
2. Confirm Enable management of User Groups and Group Membership in this application is selected if you want agent groups pushed as SCIM groups.
3. Expand Agent Group Attributes and click Edit.
4. Review or change mappings, then click Preview Mappings.
5. Click Save and Sync or Update.

note

In addition to the default agent mappings, Slack requires a mapping from the agent email to the SCIM emails attribute. JumpCloud maps toScimEmails(jcAgent.email) to emails as a required mapping. This matches Slack user provisioning behavior and is required for the agent account to provision successfully.

SCIM Directory Insights Events

SCIM Events Tables

The following Directory Insights (DI) events provide visibility into failures and detailed information about the user and group data and attributes being added or updated from HR or other external solutions to JumpCloud.

note

Customers with no package or the Device Management Package will need to add the Directory Insights à la carte option. Directory Insights is included in all other packages.

SCIM DI Integration Events

Event Name	Event Description
---	---
idm_integration_activate	Logged when an IT admin attempts to activated new SCIM integration.
idm_integration_update	Logged when an IT admin attempts to update a configured and activated SCIM integration.
idm_integration_delete	Logged when an IT admin attempts to deactivate an activated SCIM integration.
idm_integration_auth	Logged when an IT admin authenticates/authorizes a SCIM integration.
idm_integration_reauth	Logged when an IT admin attempts to change the credentials for an activated SCIM integration.

SCIM DI User Events

Event Name	Event Description
---	---
user_lookup_provision	Logged when JumpCloud encounters an issue when trying to lookup a user to determine if the user needs to be created or updated.
user_create_provision	Logged when JumpCloud tries to create a new user in service provider application.
user_update_provision	Logged when JumpCloud tries to update an existing user in service provider application.
user_deprovision	Logged when JumpCloud tries to change an existing user to inactive in the service provider application.
user_delete_provision	Logged when JumpCloud tries to delete an existing user in service provider application.

SCIM DI Attribute Events

Event Name	Event Description
---	---
attributemappings_add	Logged when the attribute mappings of an application are added.
attributemappings_delete	Logged when the attribute mappings of an application are deleted.
attributemappings_update	Logged when the attribute mappings of an application are updated.

tip

You can filter these events for users or groups by using the Resource Type filter and then selecting user\_attribute\_mapping or user\_group\_attribute\_mapping.

SCIM DI Group Events

Important

These DI events will only be present if SCIM Groups are supported.

Event Name	Event Description
---	---
group_create_provision	Logged when JumpCloud tries to create a new group in service provider application.
group_update_provision	Logged when JumpCloud tries to update an existing group in service provider application.
group_delete_provision	Logged when JumpCloud tries to delete an existing group in service provider application.

SCIM DI Attribute Events

Event Name	Event Description
---	---
integrationattribute_include	Logged when an IT admin creates an attribute mapping.
integrationattribute_exclude	Logged when an IT admin deletes an attribute mapping.

Removing the Integration

Removing the Integration

warning

These are steps for removing the integration in JumpCloud. Consult your SP's documentation for any additional steps needed (like disabling "mandatory SSO login" settings) to remove the integration in the SP. Failure to remove the integration successfully for both the SP and JumpCloud may result in users, including admins, losing access to the application.

Important

If your data is stored outside of the US, check which login URL you should be using depending on your region. If your organization uses LDAP, RADIUS, or requires firewall allow list configuration, the Fully Qualified Domain Names (FQDNs) will also be region specific. See JumpCloud Data Centers for the URLs, FQDNs, and IP addresses.

To deactivate the SCIM Integration

1. 1. Log in to the JumpCloud Admin Portal.

2. Go to Access > SSO Applications.

3. Search for the application that you’d like to deactivate and click to open the configuration window.

4. Click Actions > Deactivate IdM and then click confirm.

To deactivate the SSO Integration

1. Log in to the JumpCloud Admin Portal.
2. Go to Access > SSO Applications.
3. Search for the application that you’d like to deactivate and click to open its details panel.
4. Select the SSOtab.
5. Scroll to the bottom of the configuration.
6. Click Deactivate SSO.
7. Click Save.
8. If successful, you will receive a confirmation message.

To delete the application

1. Log in to the JumpCloud Admin Portal.

2. Go to Access > SSO Applications.

3. Search for the application that you’d like to delete.

4. Check the box next to the application to select it.

5. Click Delete.

6. Enter the number of the applications you are deleting

7. Click Delete Application.

8. If successful, you will see an application deletion confirmation notification.