Configure Entra ID as an Identity Provider

This feature is in Beta.

Integrate an existing Identity Provider (IdP) with JumpCloud to allow users to securely authenticate using their IdP credentials to gain access to their managed resources. 

Prerequisites

• You must have Admin with Billing permissions to configure an IdP. 
• You need a Microsoft Entra Admin Center login with the permission to create Enterprise Applications, like a Global Administrator or Application Administrator .

Considerations

• Federated authentication will be applied to all users at once.
• Creating an IdP in JumpCloud will result in all users in the organization authenticating to supported resources (Self Service Account Provisioning, Mac ADE, local password resets, User Portal, and SSO apps) with this IdP.
• User Portal access will be available with a federated login. If you don’t want User Portal access, you can create a policy to deny this. 
• Learn how to provision users from your Entra ID directory to JumpCloud.
• You should already have a user created in JumpCloud.

Preparing your IdP to Configure with JumpCloud

To register JumpCloud in Entra ID:

1. Log in to your Microsoft Entra Admin Center. 
2. In the left hand navigation, click Identity > App registrations. 
3. On the next page, click + New registration. 
4. Enter a *Name associated with JumpCloud. 
5. Under Supported Account Types, you need to select who can use this app or API. Click Accounts in this organizational directory only.
6. For the Redirect URI, click the Select a platform dropdown menu > Web. This is the redirect URI that needs to be pasted into the URI field: https://login.jumpcloud.com/oauth/callback
7. Click Register. 
8. On the new JumpCloud app page, under Manage, click Authentication. 
9. Scroll down to Implicit grant and hybrid flows, you need to choose the token authorization endpoint, select ID tokens (used for implicit and hybrid flows). 
10. Click Save. 
11. Next, under Manage, click Token configuration. 
12. Click + Add optional claim, then under *Token Type, select ID. 
13. A list of available optional claims will populate. Next to the Claim column, click the checkbox to bulk select all of the claims. 
14. Click Add. 
15. You’ll be prompted to confirm that you want to Turn on the Microsoft Graph email, profile permission (required for claims to appear in token), click the checkbox to confirm, then click Add.
16. Next, under Manage, click API permissions. Click Grant admin consent for JumpCloud. You’ll be prompted to confirm the selection, click Yes. 
17. Now, click on Overview, then click Endpoints to get the Issuer URL. 
18. A list of URLs will populate, the first Endpoint URL called OAuth 2.0 authorization endpoint v2 is what you will need to configure in JumpCloud. Copy the entire URL up until the /oauth2/v2.0/authorize. This part can be ignored or deleted. Only copy the URL and Directory Tenant ID.

Creating Client Credentials

1. From your Microsoft Entra Admin Center, navigate to the JumpCloud app that you just registered. On the Overview page, under Essentials > Client credentials, click Add a certificate or secret.
2. On the next page, click + New client secret, then add a Description for this Client Secret. Then, click the Expires dropdown menu to change the expiration of the client secret. 
3. Click Add. 
4. The new Client Secret will populate on the page with a Value and Secret ID. In order to complete the configuration in JumpCloud, the Value is required.

Creating a New User

1. From your Microsoft Entra Admin Center, in the left hand navigation, click Users > All Users. 
2. Click + New user > Create new user.
3. On the next page, enter a User principal name.

4. For Mail nickname*, the option to Derive from user principal name is selected by default. You can change this if you’d like to. 
5. Enter a Display name*.
6. For Password*, keep the auto generated option selected. 
7. For Account enabled*, keep the checkbox selected by default.
8. Click Review + create.
9. On the next page, review your new user’s details and then click Create. 
10. The new user should populate in the list of Users, if it doesn’t, click Refresh. 
11. Next, you need to add an email to the new user. Click on the user you just created. 
12. On the user’s Overview page, click Properties. 
13. Copy the User principal name to your clipboard. This is where the ID token will be sent. 
14. Click the ‘pencil’ icon next to Contact Information to edit. 
15. In the Email field, paste the User principal name that you just copied. 
16. Click Save. If it doesn’t update right away, click Refresh.
17. Finally, in the left hand navigation, click Identity > Applications > App registrations, then click All applications.
18. Next to the JumpCloud app, under the Application (client ID), copy the ID to your clipboard. 

Now, you have a connection to JumpCloud in Entra. Next, you’ll want to configure the connection in JumpCloud. 

Configuring Entra ID as an IdP in JumpCloud

To configure Entra ID:

1. Log in to your JumpCloud Admin Portal.
2. Click DIRECTORY INTEGRATIONS > Identity Providers.
3. Click the Add Identity Provider dropdown menu, and select Azure. 
4. Enter an Identity Provider Name* as a display name (i.e., Entra OIDC).
5. Next, you’ll need to copy/paste the following information from your Microsoft Entra Admin Center into the required fields in JumpCloud:

6. Once these are all copy/pasted in, click Save. 
7. You’ll be prompted to verify that you want to enable Federated Device Authentication for your users’ login. Select I understand the impacts above, then click Yes, Continue.

Now, you can go and test the connection to ensure everything is working as expected. 

Managing the IdP 

To manage the IdP:

1. From your JumpCloud Admin Portal, click DIRECTORY INTEGRATIONS > Identity Providers.
2. You can update the Identity Provider Name, Entra IdP URL, Client ID, and Client Secret. 
3. Under Authentication, you’ll see that Federation is applied to your users, allowing them to authenticate with an IdP. 

Deleting the IdP

To delete the IdP:

1. From your JumpCloud Admin Portal, click DIRECTORY INTEGRATIONS > Identity Providers.
2. At the bottom of the IdP Configuration page, under Delete Identity Provider, click Delete IdP. 
3. You’ll be prompted to confirm your deletion, then click Yes, Delete.