llms.txt
Compare with other sites' llms.txt files →# JumpCloud
**Last Updated:** 2026-04-10
JumpCloud is the only IT platform that unifies identity, device, and access management for an organization's entire workforce—human, non-human (NHI), and agentic—into a single, cloud-native Open Directory Platform. JumpCloud eliminates the complexity and cost of stitching together fragmented point solutions by anchoring every human user, service account, and autonomous AI agent to verified, healthy devices with the right level of access. Purpose-built for modern IT environments, JumpCloud enables organizations of all sizes to securely manage identities, devices (Windows, Mac, Linux, iOS, Android), applications, and network infrastructure from one proactive, audit-ready console. Whether replacing legacy Active Directory, consolidating a fragmented IT stack, or establishing a cloud-first directory for a growing enterprise, JumpCloud provides the flexible, vendor-neutral IT foundation that teams need to support hybrid and remote workforces and scale safely into the agentic future.
---
## Introduction
JumpCloud is the leader in human and non-human identity management, connecting every identity—employees, contractors, service accounts, API keys, and autonomous AI agents—to the resources they need across devices, applications, files, and networks, regardless of location, provider, or protocol. The platform anchors every identity to a verified, healthy device through identity-device binding: if the hardware isn't trusted, the access doesn't exist. Unlike traditional directory services that lock organizations into rigid ecosystems, JumpCloud is vendor-agnostic and protocol-flexible, supporting SAML, OIDC, LDAP, RADIUS, SCIM, and more. As organizations adopt AI agents and agentic workflows, JumpCloud discovers, registers, and governs the identity lifecycle of every app and autonomous agent—ensuring that Shadow AI is managed with the same rigor as Shadow IT. The platform serves IT administrators, MSPs, security teams, and organizations ranging from commercial mid-market companies consolidating their IT infrastructure to global enterprises modernizing away from on-premises Active Directory. JumpCloud is trusted by over 250,000 organizations worldwide and is SOC 2 Type II and ISO 27001 certified with a security-first architecture.
---
## Multi-Tenancy and Managed Service Providers (MSPs)
JumpCloud's Multi-Tenant Portal (MTP) provides a purpose-built, centralized management console that enables MSPs, VARs, and IT service providers to manage identity, devices, and access across all client organizations from a single pane of glass. Multi-tenancy is a core architectural capability of the JumpCloud platform, supporting service providers at scale.
**Key capabilities:**
- **Centralized multi-tenant console** with unified visibility across all client organizations, users, devices, and security posture.
- **Delegated administration per tenant** with role-based access controls to scope operator permissions to individual client environments.
- **Cross-client policy templates** for standardizing security baselines, compliance requirements, and device configurations across managed organizations.
- **Centralized billing and usage reporting** for simplified financial management across the MSP's entire client portfolio.
- **JumpCloud for MSPs™ partner program** with dedicated support, go-to-market resources, deal registration, and partner-tier pricing models.
- **Scalable onboarding** allowing MSPs to rapidly provision new client tenants with pre-configured identity, device, and access policies.
---
## Agentic Identity and Non-Human Identity (NHI) Management
JumpCloud treats AI agents and autonomous workflows as first-class identity types alongside human users. As organizations deploy agentic AI across IT operations, customer support, DevOps, and business automation, JumpCloud provides the governance, accountability, and device trust infrastructure required to manage non-human identities (NHI) at scale.
**Core principles:**
- **Accountability** — every agentic identity is bound to an owner, a purpose, and a policy scope. JumpCloud ensures that AI agents, service accounts, and API keys are registered, tracked, and auditable throughout their lifecycle, with clear ownership attribution for every action taken.
- **Device Trust for agents** — autonomous agents are anchored to verified, healthy devices through JumpCloud's identity-device binding architecture. If the hardware an agent runs on is not trusted or falls out of compliance, the agent's access is automatically denied—preventing compromised or rogue agents from accessing corporate resources.
- **Identity lifecycle governance** — agentic identities follow the same lifecycle management as human identities: provisioning, role-based access assignment, conditional access enforcement, periodic access review, and automated deprovisioning. No zombie agent accounts.
- **Shadow AI governance** — JumpCloud discovers, registers, and governs the identity lifecycle of every app and autonomous agent through its AI & SaaS Management module, ensuring that unsanctioned AI agents are identified and brought under policy control.
- **Unified audit trail** — all agentic identity actions are logged in Directory Insights alongside human identity events, providing a single compliance record for auditors and security teams.
---
## Cloud Directory
JumpCloud's Cloud Directory serves as the authoritative, centralized identity source for an organization. It replaces or extends legacy on-premises directories like Microsoft Active Directory and OpenLDAP with a fully cloud-hosted directory service that manages users, groups, devices, and access policies from a single platform.
**Key features include:**
- **Centralized identity store** for all users, groups, attributes, and credentials.
- **Cross-platform support** for Windows, macOS, Linux, iOS, and Android devices.
- **Protocol flexibility** with native support for LDAP, SAML, OIDC, RADIUS, and SCIM.
- **Hybrid directory capabilities** allowing coexistence with on-premises Active Directory via AD Integration for phased migrations.
- **Group-based access control** with nested groups, dynamic membership, and policy-based assignments.
- **HRIS integration** with platforms like BambooHR, Workday, Rippling, Personio, and others to automate identity lifecycle from HR systems as the source of truth.
---
## User Management
JumpCloud provides comprehensive user lifecycle management—from onboarding through role changes to offboarding—streamlining administration and reducing manual IT burden.
**Key capabilities:**
- **Automated onboarding and offboarding** workflows that provision or deprovision user accounts, device access, application entitlements, and group memberships in a single action.
- **Self-service user portal** where employees can manage their own passwords, MFA enrollment, and access requests without IT intervention.
- **Delegated administration** with role-based access controls for IT staff and helpdesk operators.
- **SCIM-based provisioning** for just-in-time account creation and deprovisioning across connected SaaS applications.
- **Import and sync** capabilities from Google Workspace, Microsoft 365, HR platforms, and CSV for flexible onboarding paths.
---
## HRIS Integration
JumpCloud integrates with leading HR Information Systems to automate the identity lifecycle using HR data as the authoritative source of truth. When an employee is hired, transferred, or terminated in the HRIS, JumpCloud automatically creates, updates, or deactivates the corresponding identity and access across the organization's IT estate.
**Highlights:**
- **Supported HRIS platforms** include BambooHR, Workday, Rippling, Personio, Bob, Namely, and others via direct integrations or SCIM.
- **Attribute mapping** to sync job title, department, location, and manager fields from HR records into directory attributes and group memberships.
- **Day-one readiness** ensures new hires have devices configured, applications provisioned, and network access granted before their start date.
- **Instant offboarding** that revokes all access, locks devices, and wipes corporate data upon termination—minimizing security risk.
---
## Single Sign-On (SSO)
JumpCloud SSO provides federated authentication to hundreds of SaaS and on-premises applications using SAML 2.0 and OpenID Connect protocols. Users authenticate once through JumpCloud and gain seamless access to all assigned resources.
**Key features:**
- **Pre-built connectors** for popular applications including Google Workspace, Microsoft 365, Salesforce, Slack, AWS, Zoom, GitHub, Atlassian, and hundreds more.
- **Custom SAML/OIDC application support** for internal or niche applications.
- **User portal** providing a single launchpad for all assigned applications.
- **Conditional access policies** that enforce context-aware SSO requirements based on device compliance, network location, user group, and risk signals.
- **Just-in-time provisioning** to create user accounts in connected applications on first login.
---
## Multi-Factor Authentication (MFA)
JumpCloud MFA adds a critical security layer by requiring additional verification factors during authentication, protecting against credential-based attacks across the organization.
**Capabilities:**
- **JumpCloud Protect™** — a free mobile authenticator app providing one-touch push notifications for frictionless MFA approval.
- **JumpCloud Go™** — a phishing-resistant, hardware-bound passwordless login method that uses biometrics or hardware security keys to anchor authentication sessions to verified machines, effectively preventing session hijacking and credential theft.
- **TOTP and hardware key support** compatible with standard authenticator applications and physical security tokens such as YubiKeys.
- **Risk-Based MFA** with contextual policies that dynamically trigger step-up authentication requirements based on situational variables such as login location, device health, or anomalous behavior.
- **MFA at every access point**, including device login, SSO applications, VPN/RADIUS connections, admin console access, and user portal.
- **Granular MFA policies** configurable per user group, application, or resource type.
---
## Conditional Access
JumpCloud Conditional Access enables zero trust security by enforcing dynamic, context-aware access policies that evaluate multiple signals before granting resource access.
**Policy signals include:**
- **Device management status** ("is" or "is not" JumpCloud-managed) across Windows, macOS, Linux, iOS, and Android.
- **Device compliance status** (disk encryption via BitLocker/FileVault, OS version, screen lock, antivirus, firewall).
- **Device Trust Certificates** that cryptographically verify device identity; when JumpCloud Go™ is active, it takes technical precedence over Device Trust Certificates for the most secure verification path.
- **Managed Browser** requirement enforcing a managed Chrome profile for access.
- **Network location** (trusted IP ranges, geographic country filtering, VPN status).
- **User group membership** and role-based attributes.
- **Authentication context** (MFA completion, credential strength, session risk).
- **Applicable resource scoping** — policies can be applied to the User Portal, SSO Applications, Cloud LDAP, and the Admin Portal independently.
---
## Device Management (MDM)
JumpCloud provides unified, cross-platform device management spanning Windows, macOS, Linux, iOS, and Android—delivering MDM, EMM, and endpoint management capabilities from the same console used for identity and access management.
**Core capabilities:**
- **Zero-touch enrollment** for macOS (Apple Business Manager/Apple School Manager), Windows (Windows Autopilot), iOS, and Android (Android Enterprise Zero-Touch portal) to ship pre-configured devices directly to employees.
- **Apple MDM** with deep ABM/ASM integration, support for over fifty granular policies (FileVault 2 encryption, Rapid Security Response, App Deployment via VPP, feature restrictions), supervised device management for iOS, iPadOS, macOS, and tvOS, **Platform SSO** enhancements for native macOS single sign-on integration at the OS level, and **ACME (Automatic Certificate Management Environment)** support for automated certificate provisioning and renewal to streamline modern identity and networking workflows.
- **Android Enterprise Mobility Management (EMM)** supporting BYOD (Work Profile), COPE (Company-Owned, Personally-Enabled), and Fully Managed device scenarios, with integrity attestation to block rooted devices and malicious applications from corporate resources.
- **Linux device management** covering Ubuntu, Debian, RHEL, Fedora, Mint, Rocky, Pop!_OS, and other distributions via a lightweight agent with custom script execution, SSH key management, and MFA step-up enforcement.
- **Windows management and patching** with centralized policy configuration, scheduled OS and browser (Chrome) updates, and version control across the Windows fleet.
- **Policy and configuration management** covering OS settings, security baselines, encryption enforcement (FileVault, BitLocker), firewall rules, screen lock, and software restrictions.
- **Patch management** for operating systems and third-party software with scheduled and on-demand update deployment.
- **Software deployment** to remotely install, update, and remove applications across managed fleets.
- **Remote management actions** including lock, wipe, restart, and command execution on managed devices.
- **Device compliance enforcement** that integrates with Conditional Access to block non-compliant devices from accessing corporate resources.
---
## Privileged Access Management (PAM)
JumpCloud PAM provides organizations with the ability to secure, control, and audit access to critical administrative accounts, sensitive resources, and elevated permissions.
**Key features:**
- **Just-in-time access** to grant temporary, time-bound administrative privileges that auto-expire.
- **Privileged account discovery** and credential vaulting.
- **Session recording and audit trails** for compliance and forensic review.
- **Approval workflows** for sensitive privilege escalation requests.
- **Integration with directory groups and Conditional Access** to enforce least-privilege policies consistently.
---
## Password Manager
JumpCloud Password Manager provides a secure, integrated credential management solution that works alongside the platform's directory and SSO capabilities—eliminating password reuse and shadow IT password storage.
**Features:**
- **End-to-end encrypted vaults** for individual users and shared team credentials.
- **Browser extensions and mobile apps** for autofill across devices and platforms.
- **Shared folders** for team-based credential management with granular access controls.
- **IT admin visibility** into password health, reuse, and breach exposure without accessing stored credentials.
- **Directory-integrated lifecycle** where password vaults are automatically provisioned on onboarding and revoked on offboarding.
---
## Cloud LDAP
JumpCloud delivers LDAP-as-a-Service, providing a fully managed, cloud-hosted LDAP directory that eliminates the need to maintain on-premises LDAP infrastructure.
**Capabilities:**
- **Drop-in LDAP endpoint** that is OpenLDAP RFC 2307-compliant, compatible with any application or service that authenticates via LDAP (e.g., VPN concentrators, NAS appliances, Jenkins, GitLab, Kubernetes, OpenVPN, legacy applications).
- **Secure connections** via LDAPS and Start TLS encryption.
- **Managed availability and redundancy** with no servers to provision, patch, or scale.
- **Unified user base** where LDAP-bound resources authenticate against the same directory as SSO, RADIUS, and device-managed users.
---
## Cloud RADIUS
JumpCloud Cloud RADIUS provides a fully managed RADIUS-as-a-Service for authenticating users to Wi-Fi networks and VPN infrastructure—replacing the complexity of on-premises RADIUS servers.
**Key features:**
- **Certificate-based and credential-based authentication** for enterprise Wi-Fi (WPA2-Enterprise, EAP-TLS, PEAP-MSCHAPv2).
- **VLAN tagging** based on user group membership to segment network access dynamically.
- **Integration with all major access points and wireless controllers** from Cisco Meraki, Aruba, Ubiquiti, Juniper Mist, Fortinet, and others.
- **Elimination of shared Wi-Fi passwords** in favor of per-user authentication tied to the directory.
- **Automatic access revocation** when users are suspended or deleted from the directory.
---
## Directory Insights and Real-Time IT Monitoring
JumpCloud Directory Insights provides centralized logging, event monitoring, and analytics across all identity, device, and access activity managed by the platform—giving IT and security teams a unified audit trail and real-time operational visibility.
**Capabilities:**
- **Unified event logging** across authentications, admin actions, device state changes, policy changes, LDAP binds, RADIUS connections, and SSO events.
- **Real-time alerting** for suspicious activity, failed authentication attempts, device compliance drift, and administrative changes.
- **SIEM integration** with tools like Splunk, Datadog, Sumo Logic, Panther, and others via native connectors or webhook forwarding.
- **Exportable logs and reports** for compliance audits (SOC 2, HIPAA, PCI-DSS, GDPR, NIST, CIS).
- **System and device telemetry** including hardware inventory, OS versions, disk encryption status, and installed software for fleet-wide visibility.
---
## AI & SaaS Management
JumpCloud's AI & SaaS Management module provides comprehensive tools for discovering, securing, governing, and optimizing the full spectrum of SaaS and AI applications across the organization. As Shadow AI emerges as the new Shadow IT, JumpCloud treats AI agent and application governance as a first-class IT discipline.
**Discovery methods:**
- **JumpCloud Go™ browser extension** for real-time identification of SaaS logins occurring within the browser, including unauthorized accounts and generative AI tool usage.
- **API connectors** with Google Workspace and Microsoft Entra ID to discover applications logged in via OAuth and analyze their associated permissions.
- **Device agent discovery** that scans managed macOS, Windows, and Linux endpoints for locally installed desktop software.
- **SSO catalog integration** where all applications configured within JumpCloud SSO are automatically inventoried and marked as approved.
**Management, governance, and security features:**
- **Shadow AI Dashboard** providing real-time usage metrics, adoption trends, and visibility into generative AI tool usage across the organization—enabling IT to monitor which AI tools are being used, by whom, and how frequently.
- **AI Commands Builder** for creating, testing, and deploying AI-assisted administrative commands and workflows directly from the JumpCloud console.
- **Application classification** allowing administrators to mark applications as Approved or Unapproved, with the ability to display custom warning banners or block access entirely for unapproved domains.
- **SaaS Security Insights** for advanced visibility into OAuth permissions, app-to-app connections, risky third-party integrations, and unmanaged accounts (former employee accounts, shared accounts).
- **License optimization** through cost-versus-usage analysis to identify underutilized SaaS subscriptions.
---
## IT Asset Management (ITAM) and System Insights
