Skip to main content

SCIM setup — JumpCloud

JumpCloud is a community-tier vendor. Setup is straightforward but a few quirks are worth noting (see the compat matrix).

Prereqs​

  • MOD tenant with SCIM enabled.
  • JumpCloud Admin Portal access.
  • A SCIM bearer token from MOD Dashboard → Admin → SCIM tab.

Steps​

1. Add MOD as a SSO + SCIM application​

  1. JumpCloud Admin Portal → SSO Applications → Add application.
  2. Search for "Custom SAML App" → add.
  3. Display label: MOD.
  4. Skip the SAML config (or set it up if SSO is enabled).
  5. Save.

2. Configure provisioning​

  1. The MOD app → Identity Management tab.
  2. Base URL: https://api.modtechlabs.com/scim/v2
  3. Token Key: the plaintext bearer.
  4. Test Connection. Expected: "200 OK".
  5. Save.

3. Enable User + Group provisioning​

  1. Identity Management → Enable Provisioning.
  2. Enable: Create Users, Update Users, Deactivate Users, Create Groups, Push Group Memberships.

4. Assign​

  1. User Groups → MOD app → Add Users/Groups.
  2. Expected: MOD receives POST /Users and POST /Groups shortly after assignment.

Known JumpCloud-specific behaviours​

  • Email lower-cased — JumpCloud sends emails lower-cased even if the upstream HR record is mixed-case. MOD stores the address exactly as sent. Duplicate/auto-link detection is case-insensitive (compared in lower-case), so casing differences won't create a second account or miss an existing one.

Troubleshooting​

symptomlikely causefix
Test Connection → "400 Bad Request"Base URL has trailing path beyond /scim/v2Use exactly https://api.modtechlabs.com/scim/v2
User shows in JumpCloud but not in MODProvisioning hasn't run yetJumpCloud syncs ~hourly; wait or click "Sync Now"

Screenshots​

See CORE/docs-site/docs/assets/scim-jumpcloud-*.png.