Skip to main content
Connect JumpCloud to Oleria to gain continuous visibility into who has access across your directory. Oleria reads identity and access data from the JumpCloud Directory Platform API - mapping every user, their group memberships, and the admin roles and applications in your tenant - so you can see where access is over-provisioned and take action directly from Oleria.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your JumpCloud directory:
  • Accounts - every directory (system) user in your JumpCloud tenant, plus the console administrators.
  • User groups - all user groups and their membership, including whether a group is dynamic (membership set by a query) or static (membership set manually).
  • Admin roles - the admin-portal roles defined in your tenant, and which administrators hold them.
  • Applications - active SSO applications, with the users and groups that are bound to them.
  • Non-human identities - administrators’ API keys and service accounts. Oleria doesn’t read any key or secret.
  • Activity - Directory Insights events. On JumpCloud’s free plan, Directory Insights retains 15 days, so Oleria skips older windows.

​
Prerequisites

  • A JumpCloud administrator account. To create a service account, you also need an administrator with the Billing role.
  • The data center your organization is hosted in: US, EU, or India. It matches your JumpCloud console URL.
Use a dedicated administrator account rather than a personal employee account for the API key, because the key stops working if that administrator is removed.

​
Permissions

The API key or service account acts with its administrator role, which must hold these read permissions. The built-in Read Only role is enough to read users, groups, roles, SSO applications, administrator API keys, and service accounts. For activity, the role also needs directoryinsights.readonly. If activity doesn’t sync, check that the role has it. The remediation actions need a higher role. See Remediation actions.

​
Choose an authentication method

Credentials work only in the data center that issued them. A US key doesn’t authenticate against the EU or India data center.

​
Get your credentials from JumpCloud

1

Enable API access for your admin account

Sign in to JumpCloud as an administrator and go to Settings -> Administrators. Select your admin account and enable API access.
2

Copy your API key

Select your account menu in the top right of the JumpCloud console, then select My API Key. Copy the key shown.
Treat this key like a password - it authenticates as your admin account with whatever permissions that account holds. See Remediation actions for how the admin account’s role affects what Oleria can do.

​
Connect JumpCloud to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select JumpCloud.
2

Complete the connection form

Fill in the connection form:
3

Authenticate

Select Authenticate. Oleria checks the credentials against JumpCloud before saving the integration.

​
Verify the integration

Confirm the JumpCloud instance appears on the Connected tab of your Oleria Integrations page. After the first sync completes, you can review the discovered accounts, groups, and roles in your Oleria workspace.
If you rotate the API key or the service account secret, update the credentials in Oleria by editing the integration. A revoked or expired credential causes discovery to stop.

​
Remediation actions

Beyond discovery, Oleria can act on JumpCloud access to remediate risk.
Reactivating a suspended account isn’t a standalone action you select in Oleria - it’s only available as the automatic revert of a prior Suspend user account action.
Suspending or reactivating a user needs at least the Help Desk role. Changing group membership needs at least the Manager role. Oleria can’t change membership of groups that JumpCloud manages automatically, because JumpCloud keeps their membership unchanged.
JumpCloud has no API to check in advance whether the credential can perform these actions. A credential for a Read Only Administrator connects successfully and passes validation, but any remediation action fails when it runs. Use an administrator, or a service account, with the role the action needs.

​
Known limitations

  • Scope - this integration doesn’t cover JumpCloud’s device/MDM management or RADIUS/LDAP.
  • No SSO signal on users - Oleria can’t tell whether a user is required to sign in with SSO.
  • Multi-organization (MSP) accounts - if your credential has access to more than one JumpCloud organization, Oleria connects to and syncs only the first organization returned by JumpCloud. Other organizations under the same MSP account are not synced.

​
Contact us

For questions about this integration, contact us at support@oleria.com.