JumpCloud

Example values

The tenant-specific values (the sg_ab12cde parts) show the shape only — Safeguard displays your real ACS URL and SP Entity ID in the Add Provider dialog after you click Save. This table makes it unambiguous which value goes on which side.

In JumpCloud — the SAML app / SP details (you enter these at the IdP):

In Safeguard — Add Provider → SAML 2.0 (you copy these from the IdP):

-----BEGIN CERTIFICATE-----
MIIDdDCCAlygAwIBAgIGAX...(full cert from your IdP)...P3B/k0SolrFYPo
-----END CERTIFICATE-----

1. In the JumpCloud Admin Console, go to SSO Applications → + Add New Application → Custom SAML App.
2. Set SP Entity ID to the SP Entity ID Safeguard shows after Save, and ACS URL to the ACS URL Safeguard shows after Save.
3. Set the SAML Subject NameID to email with format EmailAddress.
4. Under SAML Attributes, also add a constant attribute named email mapped to the user's email — separate from the Subject NameID above.
5. Save, then reopen the app and copy the IdP URL and IdP Entity ID, and download the Certificate from the Export Metadata tab.
6. In Safeguard, click Add Provider → SAML 2.0 → JumpCloud, and enter those three values.
7. Assign User Groups to the application under the app's User Groups tab.
8. Click Test in Safeguard to confirm.

Common errors: users see "Access Denied" at JumpCloud — they exist in JumpCloud but haven't been added to a User Group bound to this SSO app.