SCIM with JumpCloud

Connect JumpCloud to Conduit with SCIM 2.0 so JumpCloud automatically creates, updates, and deactivates Conduit users — and optionally materializes JumpCloud user groups as Conduit teams — without you managing membership by hand.

This page walks through the whole setup on its own. You will generate a SCIM token in Conduit first, then paste its two values into a JumpCloud SSO application. For the shared concepts behind SCIM — what a token is, what gets provisioned, and how sign-in binds a provisioned user — see the SCIM provisioning overview.

Prerequisites:

• Owner or Admin on the Conduit organization (needed to generate the SCIM token).
• A JumpCloud admin who can manage SSO Applications.

---

Step 1 — Generate the SCIM token in Conduit

This step is identical for every identity provider, and it happens in Conduit first. The two values it produces — the Tenant URL and the Secret token — are exactly what JumpCloud needs.

1. In Conduit, go to Provisioning (/org/scim).
2. Click Connect IdP.
3. Choose JumpCloud.
4. Pick the default role new SCIM-provisioned users will receive — member is the safe default.
5. Click Generate token.
6. Copy the Tenant URL and Secret token.

Caution

The secret token is shown once and cannot be retrieved later. Keep the Conduit tab open while you configure JumpCloud, then move the values across.

Step 2 — Create the SSO application in JumpCloud

JumpCloud’s SCIM provisioning lives inside a SAML/SSO application — there is no standalone SCIM app, so you create a Custom SAML app and use only its Identity Management tab.

1. In the JumpCloud admin console, go to User Authentication → SSO Applications → + Add New Application.
2. Search for Custom SAML App and select it.
3. Set a Display Name (for example, “Conduit”), then click Save Application.
4. Open the application and switch to the Identity Management tab.

Step 3 — Configure SCIM 2.0

1. On the Identity Management tab, set Configuration Type to SCIM 2.0.
2. Set Base URL to the Conduit Tenant URL.
3. Set Token Key to the Conduit Secret token.
4. Click Test Connection and confirm it succeeds.
5. If you want JumpCloud groups to become Conduit teams, set Group Management to On before you activate — see the note below.
6. Click Activate.

Note

Turn Group Management on before clicking Activate. If the application is activated with Group Management off, users provision correctly but their group memberships don’t sync. You can recover by toggling Group Management on and re-saving — JumpCloud replays memberships on the next sync — but setting it first avoids the round trip.

Step 4 — Assign users and groups

1. Open the application and go to the User Groups tab.
2. Tick the groups you want to provision, then Save. Each ticked group syncs as a Conduit team, and its members sync as Conduit users at the connection’s default role.
3. Optionally, assign individual users on the Users tab.

JumpCloud syncs about every 5 minutes. To push the first batch immediately, force a sync by toggling Identity Management → Activate off and back on.

What gets provisioned

The mapping is the same as every other IdP:

JumpCloud concept	Conduit concept
User assignment (direct or via group)	users row + org_members row at the connection’s default role
Group assignment	org_teams row + org_team_members for each member
User disabled / unassigned	org_members row removed; users.active = false (re-activatable)

Note

SCIM creates a “shadow” user record keyed by email. A provisioned user must still sign in through Conduit’s existing SSO — on first sign-in the shadow record binds to their identity.

How Conduit handles JumpCloud

JumpCloud is mostly SCIM 2.0–compliant, with one small quirk: it occasionally omits the schemas array on PATCH requests. Conduit injects the default schemas value when it’s missing, so those updates apply normally. There is no workaround for you to configure — provisioning just works.

Verify

After the first sync completes, confirm the results in Conduit:

• Members (/org/members) — provisioned users appear at the connection’s default role.
• Teams (/org/teams) — each synced JumpCloud group appears as a Conduit team with its members.

Troubleshooting

• Test Connection fails. Re-paste the token into Token Key — a trailing space copied along with the token is the most common cause. If it still fails, generate a fresh token in Conduit (Provisioning → Connect IdP) and try again.
• Users provisioned but no group memberships. Group Management was off when the application was activated. Set Identity Management → Group Management to On, re-save, and assign the groups on the User Groups tab; JumpCloud replays group memberships on the next sync.
• Sync seems stuck. Force a sync by toggling Identity Management → Activate off and back on. JumpCloud otherwise syncs about every 5 minutes.
• A user can’t do anything after signing in. SCIM assigns the connection’s default role. Check the user’s role on /org/members; the default role is fixed at token-generation time, so to change it for future users, generate a new connection with the role you want.

Revoking access

To disconnect JumpCloud, go to Conduit’s Provisioning page (/org/scim) and click Revoke on the connection. This invalidates the token immediately — JumpCloud receives a 401 on its next sync. Teams and users the connection created remain in place until you remove them manually. See the overview for details.

Related

• SCIM provisioning — the shared SCIM concepts and the other supported IdPs.