Provision users with SCIM¶
Connect your identity provider (IdP) with SCIM 2.0 so it manages Jump Desktop accounts and Access Groups for you. Your IdP creates accounts and turns off remote access when you deactivate someone, so you don't update each person in the Teams dashboard. Use it to onboard new staff and offboard leavers from your IdP, and to keep Access Groups in step with IdP groups.
Applies to¶
- Jump Desktop for Teams Enterprise plan.
- Team administrators.
- A team with single sign-on set up.
1. Turn on SCIM in Jump Desktop¶
-
In the Teams dashboard, open your team and click Security.
-
In Team Single Sign On, select Enable SCIM provisioning.
- Copy the SCIM URL (click the expand button if the details are hidden). It looks like
https://api.jumpdesktop.com/v1/scim/v2/<your-sso-id>. -
Next to SCIM Credentials, click the copy button to copy the token.
Treat the token like a password. To replace it, click the refresh icon (Change SCIM API key) in the credentials field, then Yes, change token. The old token stops working immediately, so update your IdP.
2. Configure your identity provider¶
In your IdP's Jump Desktop SSO app, enter the SCIM URL and the token (a bearer token). Jump Desktop supports SCIM Users and Groups and matches users by email address.
-
In the Jump Desktop app, click General > App Settings > Edit, select SCIM provisioning, and click Save.
-
Click Provisioning > Integration.
-
Set SCIM connector base URL to the SCIM URL, Unique identifier field for users to
email, and Authentication Mode to HTTP Header. In Authorization, paste only the token; Bearer is already filled in. - Select Push New Users, Push Profile Updates, and Push Groups.
-
Click Test Connector Configuration, then Save.
-
In Provisioning > To App, turn on Create Users, Update User Attributes, and Deactivate Users.
-
In Enterprise applications, open the Jump Desktop app and click Provision User Accounts.
-
Click Get Started and choose automatic provisioning.
-
In Admin Credentials, set Tenant URL to the SCIM URL and Secret Token to the token.
- Click Test Connection, then Save.
-
Add the SCIM Provisioner with SAML (SCIM v2 Core) app.
-
In Configuration, enter the SCIM URL as the SCIM base URL and the token as the SCIM bearer token. Enable the API connection and click Save.
-
In Provisioning, select Enable provisioning and click Save.
-
In Apps & Widgets > Web Apps, open the Jump Desktop SSO app.
-
In Provisioning, enter the SCIM URL and the bearer token.
3. Add provisioned users to the team¶
SCIM creates Jump Desktop accounts but doesn't add existing accounts to your team.
- New accounts join the team automatically if Add new users to the team automatically is selected in Team Single Sign On.
- Otherwise, on the team page, click Add Users, select the users under Add Users, and click Add To The Team. See Add and manage users.
Users count toward your bill once they join the team, not when SCIM creates their account.
Provisioning depends on the email domain:
| User's email | Account doesn't exist yet | Account already exists |
|---|---|---|
| On a verified domain | Created and ready to sign in with SSO. | Linked to your SSO and managed by SCIM. |
| Not on a verified domain | The user gets an email to confirm their address. The account is created when they confirm. | Managed by SCIM only if the user has already linked your SSO. Otherwise provisioning fails. |
Access Groups¶
Groups you push from your IdP become Access Groups with a SCIM badge. Sync is one way, from your IdP to Jump Desktop.
| Change | Where |
|---|---|
| Create, rename, or delete the group | Your IdP |
| Add or remove users | Your IdP |
| Add or remove computers | Teams dashboard |
Only users who are members of the team are added to a group.
Deactivate and delete users¶
| IdP action | Result in Jump Desktop |
|---|---|
| Deactivate | Remote access is turned off in every team the user belongs to. They stay team members. |
| Reactivate | If Reactivate Users in Team is selected (off by default), remote access is turned back on in every team where it's off, even where an admin turned it off. Otherwise, an admin turns it back on. |
| Delete, with Run SCIM in 'Safe Mode' on (default) | Remote access is turned off in every team and the user is marked for deletion. Review them in the team's Users list. |
| Delete, with Safe Mode off | The user is removed from every team and their account is deleted. |
Users whose remote access is off aren't billed.
Warning
Turning off Run SCIM in 'Safe Mode' immediately deletes every account already marked for deletion. Deletions made with Safe Mode off can't be undone.
Turn off SCIM¶
- In Team Single Sign On, clear Enable SCIM provisioning.
- Click Yes, remove SCIM.
The token stops working and your IdP's requests are rejected. Provisioned users keep their accounts and status. Access Groups are no longer SCIM-managed and can be edited in the Teams dashboard.