JumpCloud | Atomicwork | Documentation

JumpCloud: Single sign-on (SSO)

Configure JumpCloud SAML SSO so your users sign in with their existing JumpCloud credentials.

Configure Single Sign-On between JumpCloud and Atomicwork using SAML 2.0. Once complete, your users sign in to Atomicwork with their existing JumpCloud credentials — no separate password, with centralized access control through your JumpCloud directory.

Why use JumpCloud SAML SSO

Enabling JumpCloud SAML SSO offers:

Single sign-on: Users log in with their JumpCloud credentials, removing the need for a separate Atomicwork password.
Improved security: Authentication is handled by JumpCloud, so passwords stay inside your identity provider — Atomicwork never sees or stores them.

Before you begin

You need:

A JumpCloud account with Administrator privileges.
Org admin access on Atomicwork

[!NOTE] Only one SSO provider can be active at a time. If you already have another SSO provider enabled (Azure AD, Okta, Google, or another option), disable it first before enabling JumpCloud SSO.

Go to Settings > Organization > Security in your Atomicwork tenant in a second browser tab before you start. Atomicwork pre-populates two values — the SP Entity ID and the ACS URL — that you’ll paste into JumpCloud.

[!NOTE] How the values flow

Atomicwork → JumpCloud: Copy the SP Entity ID and the ACS URL from the Atomicwork Security page into the JumpCloud custom SAML connector.

JumpCloud → Atomicwork: Copy the JumpCloud IdP metadata URL and paste it into the matching field in Atomicwork.

Set up JumpCloud SAML SSO

Step 1: Create a custom SAML application in JumpCloud

Sign in to the JumpCloud Admin Portal.
From the left navigation, open User Authentication > SSO Applications.
Click + Add New Application, then choose Custom SAML Application.
In the General Info tab, enter a display name (for example, “Atomicwork”) and click Next.

Step 2: Enter the SP Entity ID and ACS URL

In Atomicwork, open Settings > Organization > Security > JumpCloud SSO. Atomicwork displays the SP Entity ID and the ACS URL — these are the values you’ll paste into JumpCloud.

In the JumpCloud SSO tab, paste the SP Entity ID from Atomicwork into the SP Entity ID field.
Paste the ACS URL from Atomicwork into the ACS URL field. Leave this as the only ACS URL (index 0) — do not add a second one.

[!NOTE] Only one ACS URL is needed. Atomicwork uses JumpCloud’s default (index 0) ACS URL for all sign-ins. Adding a second ACS URL won’t be used and can cause confusion later.

Step 3: Configure assertion signing and NameID format

Under SAMLSubject NameID, choose email.
Set SAMLSubject NameID Format to urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress.
Set Sign (or Signature) to Assertion. If JumpCloud only offers a combined option, choose Response & Assertion (also labeled Both in some JumpCloud versions).

[!NOTE] Required: sign the assertion. Atomicwork only accepts SAML assertions that are signed at the assertion level. If JumpCloud is configured to sign only the outer SAML Response (without signing the assertion inside it), the integration will fail at install time with an error asking you to set Sign = Assertion in JumpCloud.

Step 4: Confirm the attribute mappings

Under Attributes, add the following three mappings using the standard JumpCloud Basic attribute format:

Service Provider Attribute Name	JumpCloud Attribute Name
`email`	`email`
`firstName`	`firstname`
`lastName`	`lastname`

Click Activate to save the application.

Step 5: Copy the JumpCloud IdP metadata URL

After activating the application, JumpCloud exposes an IdP metadata URL that contains its signing certificate, sign-in endpoints, and entity ID — everything Atomicwork needs to trust JumpCloud.

Open the application you just created in JumpCloud.
Under the SSO tab, locate JumpCloud Metadata URL (sometimes labeled IdP Metadata URL).
Copy the URL — you’ll paste it into Atomicwork in the next step.

Step 6: Paste the metadata URL into Atomicwork

Switch back to the Atomicwork JumpCloud SSO page.
Paste the JumpCloud Metadata URL into the JumpCloud SAML metadata URL field.
Click Connect to activate SSO for your organization.

Atomicwork imports the metadata, validates that the signing certificate is present, and activates the integration. If validation fails, you’ll see a specific error indicating what to fix in JumpCloud.

Step 7: Assign users in JumpCloud

In JumpCloud, open the application you created and switch to the User Groups tab.
Assign the user groups (or individual users) that should be able to sign in to Atomicwork.

Open an incognito browser window and go to your Atomicwork workspace login page. Click Continue with SSO (or equivalent) and enter your work email. You should be redirected to JumpCloud, authenticate, and land back inside Atomicwork.

Troubleshooting

Symptom	Cause	Resolution
Install fails with “set Sign = Assertion in JumpCloud”	JumpCloud is signing only the outer SAML Response, not the assertion itself.	In your JumpCloud SAML application, change the Sign setting to Assertion or Response & Assertion (Both). Save, then click Connect again in Atomicwork.
”Enable” button is disabled with a tooltip about an existing SSO provider	Another SSO provider (Azure AD, Okta, Google, etc.) is already active. Only one SSO can be enabled at a time.	Disable the existing SSO provider in Settings > Organization > Security first, then enable JumpCloud SSO.
”JumpCloud SSO is not enabled for this tenant”	JumpCloud SSO is not yet available on your Atomicwork workspace.	Contact Atomicwork support to enable JumpCloud SSO for your workspace.
”Invalid signature” or “Signature validation failed” after JumpCloud sign-in	The JumpCloud metadata URL was copied while a certificate change was in flight, or the signing certificate is missing from JumpCloud’s metadata.	Re-copy the JumpCloud Metadata URL from your JumpCloud application and paste it again in Atomicwork. Confirm assertion signing is still enabled in JumpCloud.
Loop back to the sign-in page	A mismatched ACS URL — often a trailing space or the ACS URL was added at a non-zero index in JumpCloud.	Verify the ACS URL in JumpCloud matches the one shown in Atomicwork exactly. Make sure it’s the only ACS URL configured.
Email or name missing in the user profile	The attribute mappings in JumpCloud are missing or use unexpected names.	In JumpCloud, open the application’s Attributes tab and confirm the three mappings — `email`, `firstName`, and `lastName` — match what’s shown in Step 4.
User can authenticate but can’t access Atomicwork	The user isn’t assigned to the JumpCloud SAML application.	In JumpCloud, open the application’s User Groups tab and assign the user (or a group containing them).

If you also use JumpCloud for user provisioning and identity management, see JumpCloud: Overview and setup.

JumpCloud: Overview and setup

Automate user provisioning and identity management by integrating JumpCloud with Atomicwork.

The JumpCloud integration centralizes identity and access management, eliminating the manual work of provisioning users across disconnected systems.

JumpCloud now covers users, assets, applications, Call API actions, and SSO in Atomicwork. Alongside identity, it’s a device management source: JumpCloud-managed devices sync in as assets, and you can run remote actions on them. See Asset sync and Remote device actions.

You can automate user onboarding and offboarding, manage group memberships, and sync identity data directly from Atomicwork. This reduces provisioning delays, cuts down on access-related requests, and ensures employees get the right access at the right time without manual intervention.

Usecases

Connecting JumpCloud to Atomicwork unlocks several key capabilities for your IT and HR teams:

Identity governance: Automate user provisioning and deprovisioning as part of your workflows.
Group management: Add or remove users from user groups automatically during role changes.
Account recovery: Unlock locked user accounts via self-service.

Permissions

To connect your Atomicwork and JumpCloud accounts, you need:

Org admin access in Atomicwork
A JumpCloud API key with read and write access to the following areas:
- System Users
- User Groups
- Directory Insights

Permission	Purpose
View users	To sync user profiles and ensure workflows have access to the necessary user data.
Create users	To create new users automatically as part of workflows and journey actions.
Delete users	To remove users through workflows and journey actions.
Suspend users	To temporarily suspend user accounts through workflows and journey actions.
Deactivate users	To deactivate users through workflow and journey actions.
Activate users	To reactivate users who need to regain access to your JumpCloud applications.
Edit users’ profile attributes	To update user attributes, ensuring the latest data is synced to Atomicwork and used in workflows.
Reset passwords	To support resetting passwords as part of skills.
MFA resets	To allow resetting multi-factor authentication as part of workflows.
Manage API tokens	To create an API token that will be shared with Atomicwork for setting up the integration.
View API tokens	To view and access the API token shared with Atomicwork.
View groups	To retrieve the list of groups and associated information for workflow actions and skills.
Manage group membership	To add or remove users from groups through workflows and journey actions.
Create groups	To create groups through workflows and journey actions.
Manage applications	To view application details and client credentials, and to assign users to applications based on their group membership or direct assignment.
View roles	To ensure workflows have visibility into user roles for proper access control and auditing.
View admin assignments	To verify administrators who are responsible for specific roles, ensuring proper workflow execution.

Setup

[!NOTE] Your JumpCloud API key is required to authorize the integration. This key is sent securely in every request to authenticate your workspace.

Generate a new JumpCloud API key:
- Log in to the JumpCloud Admin Portal and click your account initials in the bottom-left or top-right
- Click My API Key > Generate New API Key
- Copy and securely store the API key
In your Atomicwork account, go to Settings > Enterprise integrations > App store > JumpCloud.
Enter your API key and click Test to test the connection.
Click Connect to activate the integration

Supported workflow actions

Once connected, you can automate the following JumpCloud actions within your Atomicwork workflows:

Action	Description
Get system user	Retrieve a specific system user by their ID.
List users	List all system users.
Create user	Create a new system user in JumpCloud.
Update user	Update an existing system user’s profile.
Delete user	Delete a system user account.
Unlock user	Unlock a locked user account.
Suspend user	Temporarily suspend a user account.
Deactivate user	Deactivate a user account entirely.
Add user to group	Assign a user to a specific user group.
Remove user from group	Remove a user from a specific user group.
Get last logged event	Query user events from Directory Insights.
Call API	Make a generic API call to any JumpCloud endpoint

Troubleshoot common issues

If you encounter issues while setting up or using the JumpCloud integration, review the following common errors:

Error message	Cause	Resolution
api_key is null	The integration configuration is missing the API key.	Re-enter your API key in the integration settings.
401 or 403 errors	Your API key lacks the required permissions or has been revoked.	Generate a new key with the correct permissions in the JumpCloud Admin Console.
JumpCloud client error JumpCloud server error	The API call to JumpCloud encountered an error response.	Check the JumpCloud API status page to ensure their services are operational.

Asset sync

Sync every JumpCloud-managed device into Atomicwork as an asset — laptops, desktops, and servers.

To set it up, go to Settings > Organization > Directory objects > Assets and connect JumpCloud through the Import or sync option.

The first time you enable asset sync, Atomicwork runs an initial sync automatically. After that, a sync runs every 24 hours.

Device data comes in as linked records on each asset:

Disk
Disk encryption
Network interfaces
Installed software
Local user accounts
Battery
USB devices
TPM
Security posture

Remote device actions

You can act on a JumpCloud-managed device directly from its asset in Atomicwork. Open the asset and choose one of these from its unified Actions menu:

Lock
Restart
Shutdown
Erase
Enable Lost Mode