Connect JumpCloud to RoundUp
Let your staff sign in to RoundUp with their JumpCloud credentials, and keep RoundUp's staff list in step with your directory automatically.
The endpoint URLs and field values below are final. The integration is not yet enabled for centers, so the setup screens described here won't appear in your app until it ships. If you'd like to be in the first group of centers to use it, let us know.
What this connects
Two separate things, which you can adopt independently:
- SAML single sign-on — staff open RoundUp and sign in with JumpCloud instead of a RoundUp password. Your MFA, device and network policies apply automatically, because JumpCloud does the authenticating.
- SCIM provisioning — when you add, change or deactivate a staff member in JumpCloud, RoundUp follows. No more inviting each new teacher by hand, and no account left open after someone's last day.
You do not need SAML in order to use SCIM. A center can provision staff from JumpCloud while teachers continue to sign in with a RoundUp password — useful when your teachers share classroom tablets and you'd rather not add a redirect to every sign-in.
RoundUp does not support just-in-time provisioning. Someone who authenticates through JumpCloud but has no staff account at your center is refused, with a message telling them to ask their director. Accounts are created by an invitation or by SCIM — never by a sign-in. This is deliberate: it keeps a directory identity alone from opening access to children's records.
Before you start
- You are an administrator in JumpCloud, and a Director or Owner in RoundUp. Both sides need changing and neither role can do the other's half.
- Your center is live in RoundUp — this connects an existing center, it doesn't create one.
- Staff email addresses in JumpCloud match the ones in RoundUp. Matching is by email; a teacher with
ms.rivera@…in one system andmaria.rivera@…in the other will be treated as two different people. - Set aside about 20 minutes, and do it outside pickup hours — you'll sign yourself out at least once while testing.
Part 1 — SAML single sign-on
Values RoundUp gives you
In RoundUp, go to Settings → Integrations → JumpCloud and choose Set up SAML. That screen shows the three values JumpCloud asks for. They are specific to your center — don't reuse another center's.
| JumpCloud field | Value from RoundUp |
|---|---|
| ACS URL | https://ihzk9riq55.execute-api.us-west-2.amazonaws.com/integrations/jumpcloud/sso/saml/acs/<center-id> |
| SP Entity ID | https://ihzk9riq55.execute-api.us-west-2.amazonaws.com/integrations/jumpcloud/sso/saml/metadata/<center-id> |
| SP metadata (importable) | https://ihzk9riq55.execute-api.us-west-2.amazonaws.com/integrations/jumpcloud/sso/saml/metadata/<center-id> |
| NameID format | urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress |
The SP metadata URL above serves a standard SAML metadata document for your center. If your JumpCloud application offers to import service-provider metadata, use it — that fills in the ACS URL, entity id and NameID format at once and removes the three fields most often mistyped.
In JumpCloud
- Create the application In the JumpCloud Admin Portal, go to SSO Applications → Add New Application, search for RoundUp, and select it.
- Paste the three values Copy the ACS URL, SP Entity ID and Login URL from the RoundUp screen into the matching JumpCloud fields.
- Check the identifier format Set SAMLSubject NameID to the user's email, and NameID Format to
urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress. RoundUp identifies staff by email address. - Add the user attributes Configure the attributes in the mapping table below.
- Assign your staff Under User Groups, assign the group containing your center's staff. Only assigned users will be able to sign in.
- Download the certificate Save the IdP certificate and copy the IdP Entity ID and IdP URL — RoundUp needs all three next.
Back in RoundUp
- Paste JumpCloud's details On the same setup screen, enter the IdP Entity ID, the IdP URL, and upload the certificate you downloaded.
- Save and test Choose Test connection. RoundUp sends you through JumpCloud and back. A successful test confirms the certificate and the email attribute; it does not yet turn anything on for your staff.
- Turn it on Once the test passes, choose Enable for this center. From then on your staff see Sign in with JumpCloud on the RoundUp sign-in screen.
Leave at least one Director account able to sign in with a RoundUp password until SSO has worked for a few days. If a certificate expires or the JumpCloud app is changed, that account is how you get back in to fix it.
Part 2 — SCIM provisioning
- Generate a token in RoundUp On Settings → Integrations → JumpCloud, choose Enable provisioning. RoundUp shows a bearer token once — copy it now, it isn't shown again. The same screen shows your SCIM base URL:
https://ihzk9riq55.execute-api.us-west-2.amazonaws.com/integrations/jumpcloud/scim/v2 - Turn on Identity Management in JumpCloud Open the RoundUp application in JumpCloud, go to the Identity Management tab, and enable it.
- Enter the base URL and token Paste the SCIM base URL and the bearer token, then choose Test Connection.
- Choose who gets provisioned Under User Groups, pick the group holding your center's staff. Everyone in it will be created in RoundUp; anyone removed from it will be deactivated.
- Activate and watch the first sync Save to start the first sync, then check Staff in RoundUp. New arrivals appear as pending staff awaiting a room assignment.
Attribute mapping
These are the attributes RoundUp reads. Anything else JumpCloud sends is ignored.
| JumpCloud attribute | Becomes | Required |
|---|---|---|
email | Staff email — the identifier RoundUp matches on | Yes |
firstname | First name | Yes |
lastname | Last name | Yes |
jobTitle | Job title shown on the staff list | No |
employeeIdentifier | Staff ID, if your center uses one | No |
active | Whether the account can be used at all | Set by JumpCloud |
Classroom assignment is not mapped. Staff arrive unassigned and a director places them into rooms in RoundUp — rooms change far more often than directory records do, and syncing them tends to produce more surprises than it saves.
When someone leaves
Deactivating or removing a staff member in JumpCloud — or taking them out of the assigned group — sends RoundUp a deactivation. RoundUp then:
- ends their access to the roster, family contacts, photos, messages and billing;
- signs out any session they still have open, including on a shared classroom tablet;
- keeps their historical records — the incident reports they filed and the check-ins they recorded stay intact and attributed, because a licensor may ask for them.
This works whether or not the person signed in with SAML. A staff member who used a RoundUp password loses that password's access too.
Roles & permissions stay in RoundUp
JumpCloud decides who is a staff member. RoundUp decides what they can see.
Provisioned staff arrive at the lowest access level. Promoting someone to Director or Administrator is done in RoundUp by someone who already holds that access. A job title arriving from your directory never grants permissions on its own.
This is intentional. Job titles in a directory are edited casually and by more people than you'd expect; access to children's records, family contact details and billing shouldn't change because a title was corrected.
Troubleshooting
"No account is linked to your JumpCloud email"
The person authenticated successfully, but has no staff account at your center. Either they aren't in the provisioned group yet, or their JumpCloud email differs from the one on their RoundUp staff record. Check the email first — it's almost always the email.
"This account isn't registered for this app"
The sign-in reached a different center or a different RoundUp app than the one the account belongs to. Confirm the ACS URL and Entity ID in JumpCloud carry your center's identifier and weren't copied from another center's setup.
The test connection fails
Usually the certificate: confirm you uploaded the one currently active in JumpCloud, and that it hasn't expired. If you rotated it in JumpCloud, upload the new one in RoundUp — the old one stops working immediately.
SCIM says connected but nobody appears
Check that a user group is assigned to the application in JumpCloud. A connected integration with no assigned group syncs nothing, successfully.
Related: Connect Okta · All director guides