JumpCloud SSO
Connect JumpCloud SSO to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect JumpCloud SSO to collect identity & sso evidence automatically.
| Category | Identity & SSO |
| Connect with | API token |
| What a connection produces | Automated evidence collection |
Connect with an API token
-
In JumpCloud SSO:
- Sign in to the JumpCloud Admin Portal as the administrator whose API key Safeguard will use. For least privilege, use an administrator that has the Read Only role.
- Make sure API access is enabled for that administrator; it is disabled by default and only an admin with the Billing role can enable it.
- In the bottom-left, click your account name and select My API Key.
- Click Generate New API Key. The key (prefix jca_) is displayed only at the time it is created, so copy it now.
Where to find the other values:
- Account / Org / Workspace (optional): In Settings › Organization Profile › General, next to Organization ID, click the eye icon to show all characters and the double-page icon to copy it.
JumpCloud SSO shows the secret only once, so copy it before you leave the page.
A personal API key carries the full permissions of its administrator's role, so tie it to a Read Only admin. JumpCloud also offers Service Accounts (Settings › Service Accounts, + New, pick a role such as Read Only, Key Type Client Secret, Secret Lifetime, Activate), but those issue a Client ID and Client Secret for an OAuth token exchange rather than a static API key. Leave Base URL blank unless your org is in the EU region (not confirmed on the fetched pages). The same Admin Portal API key covers SSO application data.
Source: jumpcloud.com, jumpcloud.com, support.jumpcloud.com, checked 2026-10-07.
-
On Compliance › Connectors, open JumpCloud SSO, click Connect, choose API token and fill in:
Field What to enter API token / Personal access token Required. Stored encrypted and never shown again. Base URL (optional) — Account / Org / Workspace (optional) — -
Click Connect with token.
Frameworks
Safeguard's automated tests read JumpCloud SSO and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | C1.1, CC6.1, CC6.2, CC6.3, CC6.6, CC6.8, CC7.1 | 15 |
| ISO/IEC 27001 | Automated tests | A.5.9, A.5.16, A.5.17, A.5.18, A.6.5, A.8.1, A.8.2, A.8.5, A.8.7, A.8.8, A.8.9, A.8.20, A.8.24 | 15 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.310(d)(1), 164.312(a)(1), 164.312(d), 164.312(e)(1) | 15 |
| PCI DSS | Automated tests | 1.5.1, 3.5.1, 5.2.1, 6.3.3, 7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.2.8, 8.3.4, 8.3.6, 8.4.2, 8.6.3, 12.5.1 | 15 |
| NIST CSF 2.0 | Automated tests | DE.CM-09, ID.AM-01, PR.AA-01, PR.AA-03, PR.AA-05, PR.DS-01, PR.IR-01, PR.PS-02 | 15 |
These tests are switched on per workspace by the Safeguard team.
JumpCloud, JumpCloud MDM connect to the same provider as JumpCloud SSO, and these tests run for a connection made through any of them.
Related
- Identity & SSO connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks