JumpCloud
Connect JumpCloud to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect JumpCloud to collect identity & sso evidence automatically.
| Category | Identity & SSO |
| Connect with | API token |
| What a connection produces | Automated evidence collection |
Connect with an API token
-
In JumpCloud:
- Sign in to the JumpCloud Admin Portal as the administrator whose API key Safeguard will use. For least privilege, use an administrator that has the Read Only role.
- Make sure API access is enabled for that administrator; it is disabled by default and only an admin with the Billing role can enable it.
- In the bottom-left, click your account name and select My API Key.
- Click Generate New API Key. The key (prefix jca_) is displayed only at the time it is created, so copy it now.
Where to find the other values:
- Account / Org / Workspace (optional): In Settings › Organization Profile › General, next to Organization ID, click the eye icon to show all characters and the double-page icon to copy it.
JumpCloud shows the secret only once, so copy it before you leave the page.
A personal API key carries the full permissions of its administrator's role, so tie it to a Read Only admin. JumpCloud also offers Service Accounts (Settings › Service Accounts, + New, pick a role such as Read Only, Key Type Client Secret, Secret Lifetime, Activate), but those issue a Client ID and Client Secret for an OAuth token exchange rather than a static API key. Leave Base URL blank unless your org is in the EU region (not confirmed on the fetched pages).
Source: jumpcloud.com, jumpcloud.com, support.jumpcloud.com, checked 2026-10-07.
-
On Compliance › Connectors, open JumpCloud, click Connect, choose API token and fill in:
Field What to enter API token / Personal access token Required. Stored encrypted and never shown again. Base URL (optional) — Account / Org / Workspace (optional) — -
Click Connect with token.
Frameworks
Safeguard's automated tests read JumpCloud and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | C1.1, CC6.1, CC6.2, CC6.3, CC6.6, CC6.8, CC7.1 | 15 |
| ISO/IEC 27001 | Automated tests | A.5.9, A.5.16, A.5.17, A.5.18, A.6.5, A.8.1, A.8.2, A.8.5, A.8.7, A.8.8, A.8.9, A.8.20, A.8.24 | 15 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.310(d)(1), 164.312(a)(1), 164.312(d), 164.312(e)(1) | 15 |
| PCI DSS | Automated tests | 1.5.1, 3.5.1, 5.2.1, 6.3.3, 7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.2.8, 8.3.4, 8.3.6, 8.4.2, 8.6.3, 12.5.1 | 15 |
| NIST CSF 2.0 | Automated tests | DE.CM-09, ID.AM-01, PR.AA-01, PR.AA-03, PR.AA-05, PR.DS-01, PR.IR-01, PR.PS-02 | 15 |
These tests are switched on per workspace by the Safeguard team.
JumpCloud MDM, JumpCloud SSO connect to the same provider as JumpCloud, and these tests run for a connection made through any of them.
Related
- Identity & SSO connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks