- \n
- You must have Admin with Billing permissions to configure an IdP. <\/li>\n\n\n\n
- You need a Microsoft Entra Admin Center login with the permission to create Enterprise Applications, like a Global Administrator or Application Administrator .<\/li>\n<\/ul>\n\n\n\n
Considerations<\/strong><\/p>\n\n\n\n
- \n
- Federated authentication will be applied to only specific user groups. See Routing Policies for Identity Providers<\/a> to learn more. <\/li>\n\n\n\n
- Creating the IdP won’t automatically result in users logging in with that IdP. <\/li>\n\n\n\n
- User Portal access will be available with a federated login. If you don\u2019t want User Portal access, you can create a policy<\/a> to deny this. <\/li>\n\n\n\n
- Learn how to provision users<\/a> from your Entra ID directory to JumpCloud.<\/li>\n\n\n\n
- You should already have a user created<\/a> in JumpCloud.<\/li>\n<\/ul>\n\n\n\n
Preparing your IdP to Configure with JumpCloud<\/strong><\/h2>\n\n\n\n
To register JumpCloud in Entra ID:<\/strong><\/p>\n\n\n\n
- \n
- Log in to your Microsoft Entra Admin Center. <\/li>\n\n\n\n
- In the left hand navigation, click Identity<\/strong> > App registrations<\/strong>. <\/li>\n\n\n\n
- On the next page, click + New registration<\/strong>. <\/li>\n\n\n\n
- Enter a *Name<\/strong> associated with JumpCloud. <\/li>\n\n\n\n
- Under Supported Account Types<\/strong>, you need to select who can use this app or API. Click Accounts in this organizational directory only<\/strong>.<\/li>\n\n\n\n
- For the Redirect URI<\/strong>, click the Select a platform dropdown menu<\/strong> > Web<\/strong>. This is the redirect URI that needs to be pasted into the URI field: https:\/\/login.jumpcloud.com\/oauth\/callback<\/kbd><\/li>\n\n\n\n
- Click Register<\/strong>. <\/li>\n\n\n\n
- On the new JumpCloud app page, under Manage<\/strong>, click Authentication<\/strong>. <\/li>\n\n\n\n
- Scroll down to Implicit grant and hybrid flows<\/strong>, you need to choose the token authorization endpoint, select ID tokens (used for implicit and hybrid flows)<\/strong>. <\/li>\n\n\n\n
- Click Save<\/strong>. <\/li>\n\n\n\n
- Next, under Manage<\/strong>, click Token configuration<\/strong>. <\/li>\n\n\n\n
- Click + Add optional claim<\/strong>, then under *Token Type<\/strong>, select ID<\/strong>. <\/li>\n\n\n\n
- A list of available optional claims will populate. Next to the Claim<\/strong> column, click the checkbox to bulk select all of the claims. <\/li>\n\n\n\n
- Click Add<\/strong>. <\/li>\n\n\n\n
- You\u2019ll be prompted to confirm that you want to Turn on the Microsoft Graph email, profile permission (required for claims to appear in token)<\/strong>, click the checkbox to confirm, then click Add<\/strong>.<\/li>\n\n\n\n
- Next, under Manage<\/strong>, click API permissions<\/strong>. Click Grant admin consent for JumpCloud<\/strong>. You\u2019ll be prompted to confirm the selection, click Yes<\/strong>. <\/li>\n\n\n\n
- Now, click on Overview<\/strong>, then click Endpoints<\/strong> to get the Issuer URL. <\/li>\n\n\n\n
- A list of URLs will populate, the first Endpoint URL called OAuth 2.0 authorization endpoint v2 is what you will need to configure in JumpCloud. Copy the entire URL up until the \/oauth2\/v2.0\/authorize. This part can be ignored or deleted. Only copy the URL and Directory Tenant ID.<\/li>\n\n\n\n
- Finally, in the left hand navigation, click Identity<\/strong> > Applications<\/strong> > App registrations<\/strong>, then click All applications<\/strong>.<\/li>\n\n\n\n
- Next to the JumpCloud app, under the Application (client ID)<\/strong>, copy the ID to your clipboard. <\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\")
<\/p><\/div>Tip:<\/strong> \nYou can also copy this URL: https:\/\/login.microsoftonline.com\/<\/kbd>, paste it to your clipboard. Then go back to the JumpCloud App Overview<\/strong> page, under Essentials<\/strong>, copy the Directory (tenant) ID<\/strong>, and paste it directly after the https:\/\/login.microsoftonline.com\/<\/kbd> URL in your clipboard. <\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Creating Client Credentials<\/strong><\/h3>\n\n\n\n
- \n
- From your Microsoft Entra Admin Center, navigate to the JumpCloud app that you just registered. On the Overview<\/strong> page, under Essentials<\/strong> > Client credentials<\/strong>, click Add a certificate or secret<\/strong>.<\/li>\n\n\n\n
- On the next page, click + New client secret<\/strong>, then add a Description<\/strong> for this Client Secret. Then, click the Expires<\/strong> dropdown menu to change the expiration of the client secret. <\/li>\n\n\n\n
- Click Add<\/strong>. <\/li>\n\n\n\n
- The new Client Secret will populate on the page with a Value<\/strong> and Secret ID<\/strong>. In order to complete the configuration in JumpCloud, the Value is required.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/warning-icon.png\")
<\/p><\/div>Warning:<\/strong> \nThe Client ID and Secret (token) may only be shown once. Copy them to a secure location, like the JumpCloud Password Manager<\/a>, for future reference.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Creating a New User<\/strong><\/h3>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\")
<\/p><\/div>Important:<\/strong> \nYou should have existing users created<\/a> in the JumpCloud Admin Portal.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- From your Microsoft Entra Admin Center, in the left hand navigation, click Users<\/strong> > All Users<\/strong>. <\/li>\n\n\n\n
- Click + New user<\/strong> > Create new user<\/strong>.<\/li>\n\n\n\n
- On the next page, enter a User principal name<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\")
<\/p><\/div>Note:<\/strong> \nThe User principal name<\/strong> should be the same as the existing JumpCloud user’s Company Email<\/strong>.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- For Mail nickname*<\/strong>, the option to Derive from user principal name<\/strong> is selected by default. You can change this if you\u2019d like to. <\/li>\n\n\n\n
- Enter a Display name*<\/strong>.<\/li>\n\n\n\n
- For Password*<\/strong>, keep the auto generated option selected. <\/li>\n\n\n\n
- For Account enabled*<\/strong>, keep the checkbox selected by default.<\/li>\n\n\n\n
- Click Review + create<\/strong>.<\/li>\n\n\n\n
- On the next page, review your new user\u2019s details and then click Create<\/strong>. <\/li>\n\n\n\n
- The new user should populate in the list of Users, if it doesn\u2019t, click Refresh<\/strong>. <\/li>\n\n\n\n
- Next, you need to add an email to the new user. Click on the user you just created. <\/li>\n\n\n\n
- On the user\u2019s Overview<\/strong> page, click Properties<\/strong>. <\/li>\n\n\n\n
- Copy the User principal name<\/strong> to your clipboard. This is where the ID token will be sent. <\/li>\n\n\n\n
- Click the \u2018pencil\u2019 icon next to Contact Information<\/strong> to edit. <\/li>\n\n\n\n
- In the Email<\/strong> field, paste the User principal name that you just copied. <\/li>\n\n\n\n
- Click Save<\/strong>. If it doesn\u2019t update right away, click Refresh<\/strong>.<\/li>\n<\/ol>\n\n\n\n
Now, you have a connection to JumpCloud in Entra. Next, you\u2019ll want to configure the connection in JumpCloud. <\/p>\n\n\n\n
Configuring Entra ID as an IdP in JumpCloud<\/strong><\/h2>\n\n\n\n
To configure Entra ID:<\/strong><\/p>\n\n\n\n
- \n
- Log in to your JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n
- Click DIRECTORY<\/strong> INTEGRATIONS<\/strong> > Identity Providers<\/strong>.<\/li>\n\n\n\n
- Click the Add Identity Provider<\/strong> dropdown menu, and select Azure<\/strong>. <\/li>\n\n\n\n
- Enter an Identity Provider Name<\/strong>* as a display name (i.e., Entra OIDC).<\/li>\n\n\n\n
- Next, you\u2019ll need to copy\/paste the following information from your Microsoft Entra Admin Center into the required fields in JumpCloud:<\/li>\n<\/ol>\n\n\n\n
<\/p><\/div>Tip:<\/strong> \nYou should have an existing user already created in the JumpCloud Admin Portal.<\/p>\n\n\n\n
- \n
- Entra IdP URL*<\/strong>: This is the https:\/\/login.microsoftonline.com\/<Directory (tenant ID)><\/kbd>.<\/li>\n\n\n\n
- Client ID*<\/strong>: This is the Application (client ID) associated with the new user you created.<\/li>\n\n\n\n
- Client Secret*<\/strong>: This is the secret value you received when you created the client credentials.<\/li>\n<\/ol>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Once these are all copy\/pasted in, click Save<\/strong>. <\/li>\n\n\n\n
- You\u2019ll be prompted to verify that you want to enable Federated Device Authentication for your users\u2019 login. Select I understand the impacts above<\/strong>, then click Yes, Continue<\/strong>.<\/li>\n<\/ol>\n\n\n\n
Now, you can go and test the connection to ensure everything is working as expected. <\/p>\n\n\n\n
Managing the IdP <\/strong><\/h2>\n\n\n\n
- You\u2019ll be prompted to verify that you want to enable Federated Device Authentication for your users\u2019 login. Select I understand the impacts above<\/strong>, then click Yes, Continue<\/strong>.<\/li>\n<\/ol>\n\n\n\n
- Client ID*<\/strong>: This is the Application (client ID) associated with the new user you created.<\/li>\n\n\n\n
- Click DIRECTORY<\/strong> INTEGRATIONS<\/strong> > Identity Providers<\/strong>.<\/li>\n\n\n\n
- Enter a Display name*<\/strong>.<\/li>\n\n\n\n
- Click + New user<\/strong> > Create new user<\/strong>.<\/li>\n\n\n\n
- On the next page, click + New client secret<\/strong>, then add a Description<\/strong> for this Client Secret. Then, click the Expires<\/strong> dropdown menu to change the expiration of the client secret. <\/li>\n\n\n\n
- On the next page, click + New registration<\/strong>. <\/li>\n\n\n\n
- Federated authentication will be applied to only specific user groups. See Routing Policies for Identity Providers<\/a> to learn more. <\/li>\n\n\n\n