{"id":91797,"date":"2023-06-22T16:05:12","date_gmt":"2023-06-22T20:05:12","guid":{"rendered":"https:\/\/jumpcloud.com\/?post_type=support&#038;p=91797"},"modified":"2024-10-11T14:21:11","modified_gmt":"2024-10-11T18:21:11","slug":"get-started-federated-authentication","status":"publish","type":"support","link":"https:\/\/jumpcloud.com\/support\/get-started-federated-authentication","title":{"rendered":"Get Started: Federated Authentication"},"content":{"rendered":"\n<p>Easily onboard new users that have JumpCloud managed devices by integrating your existing Identity Provider (IdP) with JumpCloud. This allows your users to securely access their devices by logging in with their IdP credentials.<\/p>\n\n\n\n<p><strong>Prerequisites<\/strong><\/p>\n\n\n\n<ul>\n<li>You need to have JumpCloud set up as an OIDC app in your IdP with the appropriate settings enabled to continue setting up Federated Authentication for your org, see our IdP configuration documentation to learn more:\n<ul>\n<li><a href=\"https:\/\/jumpcloud.com\/support\/configure-okta-as-an-identity-provider\">Configure Okta as an Identity Provider<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/jumpcloud.com\/support\/configure-azure-as-identity-provider\">Configure Entra ID as an Identity Provider<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/jumpcloud.com\/support\/configure-google-workspace-identity-provider\">Configure Google Workspace as an Identity Provider<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>You need to have Admin with Billing permissions to configure an IdP.&nbsp;<\/li>\n\n\n\n<li>You need to have an existing IdP managing your users to benefit from federated authentication.<\/li>\n\n\n\n<li>All JumpCloud users must have unique company email addresses, and the email of the JumpCloud user and external IdP email used for Federation have to match.&nbsp;<\/li>\n<\/ul>\n\n\n\n<p><strong>Considerations<\/strong><\/p>\n\n\n\n<ul>\n<li>Federated IdP authentication doesn\u2019t capture the user\u2019s IdP password. If Device Password Sync is set to NO, then users will be prompted to create a local passcode (password) on Mac or local PIN on Windows. If Device Password Sync is set to Yes, then JumpCloud will sync the JumpCloud password to the device and set it for the user account on the device. <\/li>\n\n\n\n<li>Federation does not currently support authenticating with JumpCloud Go.&nbsp;<\/li>\n\n\n\n<li>Federation does not currently support JumpCloud Multi-Factor Authentication (MFA) for users in addition to external IdP authentication. However, MFA may be applied at the IdP.<\/li>\n\n\n\n<li>Features like device provisioning and local self service password reset is currently not supported on Linux.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-externally-managed-passwords\"><strong>Externally Managed Passwords<\/strong><\/h3>\n\n\n\n<p>Externally managed passwords prevent password changes within JumpCloud, both by users and admins. When users are set to Password Externally Managed, they will no longer receive password expiration notifications and password expirations will no longer apply to them.<br><br>Use this setting when a user\u2019s password is being managed by an upstream integration or when they\u2019re authenticating with an external identity provider (IdP).<\/p>\n\n\n\n<div class=\"wp-block-cgb-notification-card notification-card note\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><p><strong>Note:<\/strong> Once this setting is enabled, users will not be able to change their own password from their JumpCloud device tray application, User Portal, or any other password reset flow. Additionally, admins won\u2019t be able to set user passwords from the Admin Portal.<\/p><\/div><\/div><\/div>\n\n\n\n<p><strong>Workflow<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"489\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/01\/Docs-Diagram-Frame-1-1024x489.png\" alt=\"\" class=\"wp-image-103727\" srcset=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/01\/Docs-Diagram-Frame-1-1024x489.png 1024w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/01\/Docs-Diagram-Frame-1-300x143.png 300w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/01\/Docs-Diagram-Frame-1-768x367.png 768w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/01\/Docs-Diagram-Frame-1-1536x734.png 1536w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/01\/Docs-Diagram-Frame-1-2048x979.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<ol>\n<li><strong>Prepare your IdP to configure with JumpCloud.<\/strong>\n<ul>\n<li>You will need to add JumpCloud as an application to your IdP with the appropriate settings enabled to continue setting up Federated Authentication for your org, see our IdP configuration documentation:\n<ul>\n<li><a href=\"https:\/\/jumpcloud.com\/support\/configure-okta-as-an-identity-provider\">Configure Okta as an Identity Provider<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/jumpcloud.com\/support\/configure-azure-as-identity-provider\">Configure Entra ID as an Identity Provider<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/jumpcloud.com\/support\/configure-google-workspace-identity-provider\">Configure Google Workspace as an Identity Provider<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Configure your IdP in JumpCloud.<\/strong>\n<ul>\n<li>Verify that you want to enable Federated Device Authentication for your users\u2019 login.\n<ul>\n<li>This will require all users to authenticate with their IdP.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Automatically bind users to devices by configuring Self Service Account Provisioning, or Automated Device Enrollment, based on whichever OS you\u2019re provisioning<\/strong>, see <a href=\"https:\/\/jumpcloud.com\/support\/get-started-self-service-account-provisioning\" target=\"_blank\" rel=\"noreferrer noopener\">Provision New Users on Device Login<\/a> to learn more<strong>.&nbsp;<\/strong>\n<ul>\n<li>Users logging into their device for the first time will use their IdP credentials to sign in. This also creates a local user on the device.<\/li>\n\n\n\n<li>By default, any new users that are associated with the device will automatically have their JumpCloud password synced to their device password. You can disable this so that any new user to device associations will <em>not<\/em> have their JumpCloud password synced to their device. <strong>Instead, the user will enter a local password to log into their device.<\/strong> See <a href=\"https:\/\/jumpcloud.com\/support\/device-password-sync\">Device Password Sync<\/a> to learn more.<\/li>\n\n\n\n<li>The JumpCloud account will be automatically bound to the JumpCloud device upon successful user login to the external IdP.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Optionally, restrict your user&#8217;s password in JumpCloud.\n<ul>\n<li>Users won\u2019t be able to set or update a password in JumpCloud. Users won\u2019t receive any password related communication or emails.<\/li>\n\n\n\n<li>Admins won\u2019t be able to set or update a user\u2019s password in JumpCloud either.&nbsp;<\/li>\n\n\n\n<li>Passwords can continue being synced from any SCIM or REST integration for this user.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-device-management-deployment-scenarios\"><strong>Device Management Deployment Scenarios<\/strong><\/h2>\n\n\n\n<p><strong>Scenario 1: Device Management with an External IdP<\/strong><\/p>\n\n\n\n<p><img decoding=\"async\" width=\"768\" height=\"255\" src=\"https:\/\/lh7-rt.googleusercontent.com\/docsz\/AD_4nXf96L4x1I42ei9GDaWNIaqaGth7Zwrtx7eFr-cdLSnX7sYGYkZrXpHBiQkWO8vb0VnswoONxzax42Mr55-QU1T1Vlcvbye3IruBpWkxhR3Osr7SwuV0da-Ms26McvjZAd-l3XG_IjBKV91l1kMfDQaDS1-K?key=W7Sm46XbedQE8QCGh-dekA\"><\/p>\n\n\n\n<p>Identity management is kept in your existing IdP. Identities are synced into JumpCloud for the purpose of IdP login. New users will set up and maintain a local passcode on their device. Existing users will maintain their existing passwords after they become managed by JumpCloud. If the user forgets this passcode, it may be reset with an external IdP login. The passcode is stored locally on the device, reducing the risk of compromise and allowing for offline authentication. The user can log in to any web-based resources (like JumpCloud\u2019s User Portal, SSO apps, local account provisioning flows, etc.) with their IdP login.<\/p>\n\n\n\n<ol>\n<li>User identities live, and are managed in an existing, external IdP like Azure AD, Google Workspace, or Okta.<\/li>\n\n\n\n<li>Sync the user identities into JumpCloud using a Cloud Directory, or SCIM integration.<\/li>\n\n\n\n<li>Once the users are synced, and are logging into their device for the first time, they\u2019ll be redirected to authenticate to the external IdP via JumpCloud federation.<\/li>\n\n\n\n<li>The local user account will then be created on the device, and become managed by JumpCloud.\u00a0<\/li>\n\n\n\n<li>The user will create a local passcode to access their device. This passcode can be reset from the login window by authenticating through the external IdP.<\/li>\n<\/ol>\n\n\n\n<p><strong>Device password<\/strong>: Local credentials<\/p>\n\n\n\n<p><strong>Zero Trust Controls<\/strong>: IdP<\/p>\n\n\n\n<p><strong>MFA<\/strong>: IdP<\/p>\n\n\n\n<p><strong>Scenario 2: Device Management with IdP Password Sync<\/strong><\/p>\n\n\n\n<p><strong><img decoding=\"async\" width=\"768\" height=\"301\" src=\"https:\/\/lh7-rt.googleusercontent.com\/docsz\/AD_4nXeNe4DvltNtE9LLBWVIZYi88TFL6QFP3iUH4ITSP5GCgD8jv-gul-bs4QTbgcznhJansdUBoBr_IbgsMaF-RvSbwGKpV0u1FLi92RJ0z7fJs8TPPaj_2Qib4NL6dUiuHWw7psfayHNz5XLsCdcAbnZVu7So?key=W7Sm46XbedQE8QCGh-dekA\"><\/strong><\/p>\n\n\n\n<p>Identity management is kept within your existing IdP. Identities are synced into JumpCloud for the purpose of IdP login. Passwords are also synced from your IdP into JumpCloud outside of the OIDC IdP login flow (which doesn\u2019t capture the password). This password is synced to the user\u2019s device, resulting in the IdP password, and the device password being in sync. Optionally, an IdP object can be configured allowing users to log in with their IdP credentials for web-based logins.&nbsp;<\/p>\n\n\n\n<ol>\n<li>User identities live, and are managed in an existing, external IdP like Okta.\u00a0<\/li>\n\n\n\n<li>Sync the user identities into JumpCloud using a Cloud Directory, or SCIM integration.\u00a0<\/li>\n\n\n\n<li>Once the users are synced, and are logging into their device for the first time, they\u2019ll be redirected to authenticate to the external IdP via JumpCloud federation.\u00a0<\/li>\n\n\n\n<li>The local user account will then be created on the device, and become managed by JumpCloud.\u00a0<\/li>\n\n\n\n<li>The user\u2019s password is managed by the external IdP, and then synced to the JumpCloud account.\u00a0<\/li>\n\n\n\n<li>User password changes, and resets have to be done in the IdP.<\/li>\n<\/ol>\n\n\n\n<p><strong>Device password<\/strong>: IdP<\/p>\n\n\n\n<p><strong>Zero Trust Controls<\/strong>: IdP<\/p>\n\n\n\n<p><strong>MFA<\/strong>: IdP<\/p>\n\n\n\n<p><strong>Scenario 3: Device Management with JumpCloud Password Sync and External IdP Login<\/strong><\/p>\n\n\n\n<p><strong><img decoding=\"async\" width=\"768\" height=\"305\" src=\"https:\/\/lh7-rt.googleusercontent.com\/docsz\/AD_4nXcoW8wlVgdUHjyyfTSTzHpK5lVeSdMknN9VfmWgiKMoDOEW893eGJeSKIYZnTcC_7hc9PZS4KjTBUwmlzJ_d-FtYpvwGmc8eaN41htUaeQrmpg8cyBu2xXgdIUduClNePGtFlgQAoZrWB_5hkfWiW5Lc2E?key=W7Sm46XbedQE8QCGh-dekA\"><\/strong><\/p>\n\n\n\n<p>In this scenario, identity management is kept within your existing IdP. Identities are synced to JumpCloud for the purpose of IdP login. Users are also associated to a Cloud Directory integration. This enables JumpCloud to own the password, but your IdP to own the identity. Users can change their password from their device, allowing the password to be synced to JumpCloud, and to their IdP. The user will log in with their IdP for web-based logins with the password that\u2019s managed by JumpCloud. Any Zero Trust, MFA, etc. controls will be enforced at the IdP login.<\/p>\n\n\n\n<ol>\n<li>User identities live, and are managed in an existing, external IdP like Azure AD, or Google Workspace.\u00a0<\/li>\n\n\n\n<li>Sync the user identities into JumpCloud using a Cloud Directory, or SCIM integration.\u00a0<\/li>\n\n\n\n<li>Once the users are synced, and are logging into their device for the first time, they\u2019ll be redirected to authenticate to the external IdP via JumpCloud federation.\u00a0<\/li>\n\n\n\n<li>The local user account will then be created on the device, and become managed by JumpCloud.\u00a0<\/li>\n\n\n\n<li>The user\u2019s password is managed by JumpCloud, or on the device itself, and then synced to the IdP.<\/li>\n<\/ol>\n\n\n\n<p><strong>Device password<\/strong>: JumpCloud<\/p>\n\n\n\n<p><strong>Zero Trust Controls<\/strong>: IdP<\/p>\n\n\n\n<p><strong>MFA<\/strong>: IdP<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-faq\">FAQ<\/h2>\n\n\n\n<div class=\"wp-block-cgb-accordion-faq gutenberg-accordion\"><a class=\"gutenberg-accordion-header is-type-title-default has-text-night-blue\" href=\"#will_jumpcloud_receive_the_idp_password__\" data-action=\"collapse\">Will JumpCloud receive the IdP password?\n<\/a><div id=\"will_jumpcloud_receive_the_idp_password__\" class=\"gutenberg-accordion-content-container is-collapsible\"><p class=\"gutenberg-accordion-content\">No. During the federated login flow, JumpCloud does not capture the IdP password.\n<\/p><\/div><\/div>\n\n\n\n<div class=\"wp-block-cgb-accordion-faq-wysiwyg gutenberg-accordion\"><a class=\"gutenberg-accordion-header is-type-title-default has-text-night-blue\" href=\"#how_does_the_user_log_in_to_their_device_\" data-action=\"collapse\">How does the user log in to their device?<\/a><div id=\"how_does_the_user_log_in_to_their_device_\" class=\"gutenberg-accordion-content-container is-collapsible\"><div class=\"gutenberg-accordion-content\">\n<ul>\n<li>Admins need to decide whether they want their users device passwords synced or not. <\/li>\n\n\n\n<li>If password sync is set to No, then during the local account join, the user will be prompted to set a local passcode (Mac) or PIN (Windows). This is a local passcode to the device, which is not synced to or from JumpCloud.<\/li>\n<\/ul>\n<\/div><\/div><\/div>\n\n\n\n<div class=\"wp-block-cgb-accordion-faq gutenberg-accordion\"><a class=\"gutenberg-accordion-header is-type-title-default has-text-night-blue\" href=\"#what_jumpcloud_resources_support_federated_authentication_\" data-action=\"collapse\">What JumpCloud resources support Federated Authentication?<\/a><div id=\"what_jumpcloud_resources_support_federated_authentication_\" class=\"gutenberg-accordion-content-container is-collapsible\"><p class=\"gutenberg-accordion-content\">Any resource that supports browser-based logins: User Portal, SSO apps, Self Service Account Provisioning, Mac ADE, and local password resets.<\/p><\/div><\/div>\n\n\n\n<div class=\"wp-block-cgb-accordion-faq gutenberg-accordion\"><a class=\"gutenberg-accordion-header is-type-title-default has-text-night-blue\" href=\"#what_jumpcloud_resources_do_not_support_federated_authentication_\" data-action=\"collapse\">What JumpCloud resources do not support Federated Authentication?<\/a><div id=\"what_jumpcloud_resources_do_not_support_federated_authentication_\" class=\"gutenberg-accordion-content-container is-collapsible\"><p class=\"gutenberg-accordion-content\">Any resource that does not support browser-based logins: LDAP and RADIUS<\/p><\/div><\/div>\n\n\n\n<div class=\"wp-block-cgb-accordion-faq-wysiwyg gutenberg-accordion\"><a class=\"gutenberg-accordion-header is-type-title-default has-text-night-blue\" href=\"#how_does_a_user_on_a_device_reset_their_local_password_when_password_sync_is_set_to_no_\" data-action=\"collapse\">How does a user on a device reset their local password when Password Sync is set to No?<\/a><div id=\"how_does_a_user_on_a_device_reset_their_local_password_when_password_sync_is_set_to_no_\" class=\"gutenberg-accordion-content-container is-collapsible\"><div class=\"gutenberg-accordion-content\">\n<ul>\n<li>Both Windows and Mac users can reset their PIN or local password from the device login window. See <a href=\"https:\/\/jumpcloud.com\/support\/device-password-sync#windows-self-service-pin-reset-for-local-password-users\">Windows\/Mac Self-Service PIN\/Password Reset for Local Password Users<\/a> to learn more.<\/li>\n<\/ul>\n<\/div><\/div><\/div>\n\n\n\n<div class=\"wp-block-cgb-accordion-faq-wysiwyg gutenberg-accordion\"><a class=\"gutenberg-accordion-header is-type-title-default has-text-night-blue\" href=\"#should_account_lockout_be_configured_in_jumpcloud_\" data-action=\"collapse\">Should account lockout be configured in JumpCloud?<\/a><div id=\"should_account_lockout_be_configured_in_jumpcloud_\" class=\"gutenberg-accordion-content-container is-collapsible\"><div class=\"gutenberg-accordion-content\">\n<p>Account lockout applies to all users in an organization. If all users will authenticate with an IdP, and therefore use a local device credential, the OS lockout mechanisms may be used. In this case, JumpCloud account lockout doesn\u2019t need to be configured. However, even if JumpCloud account lockout is configured, it can be overridden for individual users on devices by navigating to <strong>USER MANAGEMENT<\/strong> &gt; <strong>Users<\/strong>, clicking a specific user, then under the <strong>User Security Settings and Permissions<\/strong> dropdown, select <strong>Bypass account lockout policy for user\u2019s managed device<\/strong>.<\/p>\n<\/div><\/div><\/div>\n\n\n\n<div class=\"wp-block-cgb-accordion-faq-wysiwyg gutenberg-accordion\"><a class=\"gutenberg-accordion-header is-type-title-default has-text-night-blue\" href=\"#if_jumpcloud_account_lockout_is_configured__how_do_i_unlock_a_locked_jumpcloud_user_account_that_corresponds_to_a_local_password_account_on_a_device_\" data-action=\"collapse\">If JumpCloud account lockout is configured, how do I unlock a locked JumpCloud user account that corresponds to a local password account on a device?<\/a><div id=\"if_jumpcloud_account_lockout_is_configured__how_do_i_unlock_a_locked_jumpcloud_user_account_that_corresponds_to_a_local_password_account_on_a_device_\" class=\"gutenberg-accordion-content-container is-collapsible\"><div class=\"gutenberg-accordion-content\">\n<p>Mac (and Windows): Admins can unlock the account in the Admin Portal, see <a href=\"https:\/\/jumpcloud.com\/support\/unlock-user-accounts\">Unlock User Accounts<\/a> to learn more.&nbsp;<\/p>\n<\/div><\/div><\/div>\n\n\n\n<div class=\"wp-block-cgb-accordion-faq-wysiwyg gutenberg-accordion\"><a class=\"gutenberg-accordion-header is-type-title-default has-text-night-blue\" href=\"#can_i_configure_federation_so_that_only_some_of_the_users_in_my_organization_authenticate_with_an_idp__while_some_authenticate_with_jumpcloud_\" data-action=\"collapse\">Can I configure Federation so that only some of the users in my organization authenticate with an IdP, while some authenticate with JumpCloud?<\/a><div id=\"can_i_configure_federation_so_that_only_some_of_the_users_in_my_organization_authenticate_with_an_idp__while_some_authenticate_with_jumpcloud_\" class=\"gutenberg-accordion-content-container is-collapsible\"><div class=\"gutenberg-accordion-content\">\n<p>Yes. You can create a routing policy to have specific groups of users required to authenticate through their IdP. See <a href=\"https:\/\/jumpcloud.com\/support\/routing-policies-for-identity-providers\">Routing Policies for Identity Providers<\/a> to learn more. <\/p>\n<\/div><\/div><\/div>\n\n\n\n<div class=\"wp-block-cgb-accordion-faq gutenberg-accordion\"><a class=\"gutenberg-accordion-header is-type-title-default has-text-night-blue\" href=\"#can_i_use_the__windows___do_not_display_last_username_on_logon_screen_policy__with_federation__\" data-action=\"collapse\">Can I use the \u201cWindows &#8211; Do Not Display Last Username on Logon Screen Policy\u201d with Federation?\n<\/a><div id=\"can_i_use_the__windows___do_not_display_last_username_on_logon_screen_policy__with_federation__\" class=\"gutenberg-accordion-content-container is-collapsible\"><p class=\"gutenberg-accordion-content\">Yes, however this will prevent the user self service password reset flow from functioning by obscuring the Self Service Account Provisioning option.\n<\/p><\/div><\/div>\n\n\n\n<div class=\"wp-block-cgb-accordion-faq gutenberg-accordion\"><a class=\"gutenberg-accordion-header is-type-title-default has-text-night-blue\" href=\"#what_happens_when_a_windows_user_attempts_to_enter_a_password_as_opposed_to_their_pin_or_biometric_for_login__\" data-action=\"collapse\">What happens when a Windows user attempts to enter a password as opposed to their PIN or biometric for login?\n<\/a><div id=\"what_happens_when_a_windows_user_attempts_to_enter_a_password_as_opposed_to_their_pin_or_biometric_for_login__\" class=\"gutenberg-accordion-content-container is-collapsible\"><p class=\"gutenberg-accordion-content\">The user will not know their local account device password unless they explicitly set it after login with PIN or biometric. This will result in denied logins, and could lead to lockouts by the OS or on the JumpCloud account, if configured.\n<\/p><\/div><\/div>\n\n\n\n<div class=\"wp-block-cgb-accordion-faq-wysiwyg gutenberg-accordion\"><a class=\"gutenberg-accordion-header is-type-title-default has-text-night-blue\" href=\"#do_the_jumpcloud_password_settings_apply_to_the_local_device_account_password_or_pin_\" data-action=\"collapse\">Do the JumpCloud Password Settings apply to the local device account password or PIN?<\/a><div id=\"do_the_jumpcloud_password_settings_apply_to_the_local_device_account_password_or_pin_\" class=\"gutenberg-accordion-content-container is-collapsible\"><div class=\"gutenberg-accordion-content\">\n<ul>\n<li><strong>Windows<\/strong>: No. A randomized complex password value is set upon account creation. The PIN is set by the user and leverages the Windows default PIN length (6 digits).<\/li>\n\n\n\n<li><strong>Mac<\/strong>: Yes. The password length and complexity settings are pushed to the device and enforced. Aging settings are not evaluated.<\/li>\n<\/ul>\n<\/div><\/div><\/div>\n\n\n\n<div class=\"wp-block-cgb-accordion-faq-wysiwyg gutenberg-accordion\"><a class=\"gutenberg-accordion-header is-type-title-default has-text-night-blue\" href=\"#can_the_admin_portal_be_used_to_bind_and_unbind_accounts_to_devices_\" data-action=\"collapse\">Can the Admin Portal be used to bind and unbind accounts to devices?<\/a><div id=\"can_the_admin_portal_be_used_to_bind_and_unbind_accounts_to_devices_\" class=\"gutenberg-accordion-content-container is-collapsible\"><div class=\"gutenberg-accordion-content\">\n<p>Yes, accounts can be manually bound to devices in the Admin Portal. Use the <strong>Password Sync<\/strong> dropdown to determine if the user&#8217;s JumpCloud password will be synced to the device or not. For Federated accounts where the user logs into the device with a local password or PIN, set <strong>Password Sync<\/strong> to <strong>No<\/strong>.<br><a href=\"https:\/\/jumpcloud.com\/support\/device-password-sync\" target=\"_blank\" rel=\"noreferrer noopener\">Learn More<\/a><\/p>\n<\/div><\/div><\/div>\n\n\n\n<div class=\"wp-block-cgb-accordion-faq gutenberg-accordion\"><a class=\"gutenberg-accordion-header is-type-title-default has-text-night-blue\" href=\"#i_configured_an_identity_provider__and_now_i_m_seeing_errors_when_logging_into_the_user_portal__how_do_i_fix_this_\" data-action=\"collapse\">I configured an Identity Provider, and now I&#8217;m seeing errors when logging into the User Portal. How do I fix this?<\/a><div id=\"i_configured_an_identity_provider__and_now_i_m_seeing_errors_when_logging_into_the_user_portal__how_do_i_fix_this_\" class=\"gutenberg-accordion-content-container is-collapsible\"><p class=\"gutenberg-accordion-content\">This could be caused by an issue with the configuration for the Identity Provider on the JumpCloud side or on the OIDC Client App on the Identity Provider side. Check the details of your configuration, and make sure your client ID and secret are correct. It may be necessary to regenerate a new secret in your IdP and try the configuration again if the problem keeps happening. <\/p><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Easily onboard new users that have JumpCloud managed devices by integrating your existing Identity Provider (IdP) with JumpCloud. This allows [&hellip;]<\/p>\n","protected":false},"author":207,"featured_media":0,"template":"","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","inline_featured_image":false,"footnotes":""},"support_category":[2845],"support_tag":[],"coauthors":[2843],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v22.9 (Yoast SEO v22.9) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Get Started: Federated Authentication - JumpCloud<\/title>\n<meta name=\"description\" content=\"Easily onboard new users that have JumpCloud managed devices by integrating your existing Identity Provider (IdP).\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jumpcloud.com\/support\/get-started-federated-authentication\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Get Started: Federated Authentication\" \/>\n<meta property=\"og:description\" content=\"Easily onboard new users that have JumpCloud managed devices by integrating your existing Identity Provider (IdP).\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jumpcloud.com\/support\/get-started-federated-authentication\" \/>\n<meta property=\"og:site_name\" content=\"JumpCloud\" \/>\n<meta property=\"article:modified_time\" content=\"2024-10-11T18:21:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/01\/Docs-Diagram-Frame-1-1024x489.png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"10 minutes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data2\" content=\"sashaharrington\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/jumpcloud.com\/support\/get-started-federated-authentication\",\"url\":\"https:\/\/jumpcloud.com\/support\/get-started-federated-authentication\",\"name\":\"Get Started: Federated Authentication - JumpCloud\",\"isPartOf\":{\"@id\":\"https:\/\/jumpcloud.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/jumpcloud.com\/support\/get-started-federated-authentication#primaryimage\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/support\/get-started-federated-authentication#primaryimage\"},\"thumbnailUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/01\/Docs-Diagram-Frame-1-1024x489.png\",\"datePublished\":\"2023-06-22T20:05:12+00:00\",\"dateModified\":\"2024-10-11T18:21:11+00:00\",\"description\":\"Easily onboard new users that have JumpCloud managed devices by integrating your existing Identity Provider (IdP).\",\"breadcrumb\":{\"@id\":\"https:\/\/jumpcloud.com\/support\/get-started-federated-authentication#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/jumpcloud.com\/support\/get-started-federated-authentication\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/support\/get-started-federated-authentication#primaryimage\",\"url\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/01\/Docs-Diagram-Frame-1.png\",\"contentUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/01\/Docs-Diagram-Frame-1.png\",\"width\":2260,\"height\":1080},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/jumpcloud.com\/support\/get-started-federated-authentication#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/jumpcloud.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Support\",\"item\":\"https:\/\/jumpcloud.com\/support\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Get Started: Federated Authentication\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/jumpcloud.com\/#website\",\"url\":\"https:\/\/jumpcloud.com\/\",\"name\":\"JumpCloud\",\"description\":\"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.\",\"publisher\":{\"@id\":\"https:\/\/jumpcloud.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/jumpcloud.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/jumpcloud.com\/#organization\",\"name\":\"JumpCloud\",\"url\":\"https:\/\/jumpcloud.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"contentUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"width\":598,\"height\":101,\"caption\":\"JumpCloud\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Get Started: Federated Authentication - JumpCloud","description":"Easily onboard new users that have JumpCloud managed devices by integrating your existing Identity Provider (IdP).","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jumpcloud.com\/support\/get-started-federated-authentication","og_locale":"en_US","og_type":"article","og_title":"Get Started: Federated Authentication","og_description":"Easily onboard new users that have JumpCloud managed devices by integrating your existing Identity Provider (IdP).","og_url":"https:\/\/jumpcloud.com\/support\/get-started-federated-authentication","og_site_name":"JumpCloud","article_modified_time":"2024-10-11T18:21:11+00:00","og_image":[{"url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/01\/Docs-Diagram-Frame-1-1024x489.png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"10 minutes","Written by":"sashaharrington"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/jumpcloud.com\/support\/get-started-federated-authentication","url":"https:\/\/jumpcloud.com\/support\/get-started-federated-authentication","name":"Get Started: Federated Authentication - JumpCloud","isPartOf":{"@id":"https:\/\/jumpcloud.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/jumpcloud.com\/support\/get-started-federated-authentication#primaryimage"},"image":{"@id":"https:\/\/jumpcloud.com\/support\/get-started-federated-authentication#primaryimage"},"thumbnailUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/01\/Docs-Diagram-Frame-1-1024x489.png","datePublished":"2023-06-22T20:05:12+00:00","dateModified":"2024-10-11T18:21:11+00:00","description":"Easily onboard new users that have JumpCloud managed devices by integrating your existing Identity Provider (IdP).","breadcrumb":{"@id":"https:\/\/jumpcloud.com\/support\/get-started-federated-authentication#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jumpcloud.com\/support\/get-started-federated-authentication"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/support\/get-started-federated-authentication#primaryimage","url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/01\/Docs-Diagram-Frame-1.png","contentUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/01\/Docs-Diagram-Frame-1.png","width":2260,"height":1080},{"@type":"BreadcrumbList","@id":"https:\/\/jumpcloud.com\/support\/get-started-federated-authentication#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/jumpcloud.com\/"},{"@type":"ListItem","position":2,"name":"Support","item":"https:\/\/jumpcloud.com\/support"},{"@type":"ListItem","position":3,"name":"Get Started: Federated Authentication"}]},{"@type":"WebSite","@id":"https:\/\/jumpcloud.com\/#website","url":"https:\/\/jumpcloud.com\/","name":"JumpCloud","description":"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.","publisher":{"@id":"https:\/\/jumpcloud.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jumpcloud.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/jumpcloud.com\/#organization","name":"JumpCloud","url":"https:\/\/jumpcloud.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/","url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","contentUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","width":598,"height":101,"caption":"JumpCloud"},"image":{"@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/91797"}],"collection":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support"}],"about":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/types\/support"}],"author":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/users\/207"}],"version-history":[{"count":2,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/91797\/revisions"}],"predecessor-version":[{"id":116335,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/91797\/revisions\/116335"}],"wp:attachment":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/media?parent=91797"}],"wp:term":[{"taxonomy":"support_category","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support_category?post=91797"},{"taxonomy":"support_tag","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support_tag?post=91797"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/coauthors?post=91797"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}