---
title: "Single Sign-On with JumpCloud (SAML)"
slug: "single-sign-on-with-jumpcloud-saml"
updated: 2025-06-10T14:09:08Z
published: 2025-06-10T14:09:08Z
canonical: "support.kandji.io/single-sign-on-with-jumpcloud-saml"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.kandji.io/kb/llms.txt
> Use this file to discover all available pages before exploring further.

# Single Sign-On with JumpCloud (SAML)

### Create a SAML Connection

1. In Kandji, navigate to the **Settings** page.
2. Click the **Access** tab.
3. Find the **Authentication** section and click the **Add** button at the bottom left of the authentication section. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0804AM@2x(1).png)
4. In the Add SSO Connection pane, select the **Custom SAML** option.
5. Click **Next**.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0806AM@2x.png)
6. Select **Show Advanced Details**.
7. Copy the **Assertion Consumer Service URL** and save it in a text document for later use.
8. Copy the **Entity ID** and save it, too.

![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/0mjc6wwscroir5kev07erpdgwauq_wzgoa(2).png)
9. Leave this browser tab open as you proceed with the instructions below.

### Add the Kandji Application to JumpCloud

1. Log in to [console.jumpcloud.com/login/admin](https://console.jumpcloud.com/login/admin) and, in the lefthand navigation bar's User Authentication section, select **SSO Applications**.
2. Click on the circular **+** button, or, if this is your first application, click **Get Started**.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/6zdwbfytghusrp-8z7wwjjg6cxhcbmsekq.png)
3. At the bottom of the screen, click **Select** in the Custom Application tile. Then, click **Next**.

![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/bdw20r7lnkdn7tqrkqpllwzvuinlesxbdw.png)
4. On the **Select Options** tab, select the following.
  - **Manage Single Sign-On (SSO)**
  - **Configure SSO with SAML**
5. Click **Next**.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/eqwr7nkhpi4imejkkowlt7gn2zidi-2ysg.png)
6. On the **Enter** **General Info** tab:
  1. Add a name for the **Display Label**.
  2. Add a **Description** if desired.
  3. Choose either a color Indicator or upload a logo for the **Display Portal Image**.
  4. Optionally, choose to show the application in the User Portal.
  5. Expand the disclosure triangle beside **Advanced Settings**.
  6. In the **SSO IdP URL** field, enter . The full URL should read [](https://sso.jumpcloud.com/saml2/)[https://sso.jumpcloud.com/saml2/kandji](https://sso.jumpcloud.com/saml2/kandji)
  7. Click **Save Application**.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/fimkz1er-vsdmqxi7g4fjimbzllubk2_zg.png)
7. After your application is saved, click **Configure Application**.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/7lgvqugun1q5w1_9r7clltbchconyn93mg.png)
8. On the **SSO** tab of the configuration modal:
  1. Copy the **Entity ID** from Kandji that you saved earlier and paste it into the **IdP Entity ID** and **SP Entity ID** fields in JumpCloud.
  2. Copy the **Assertion Consumer Service URL** from Kandji that you saved earlier and paste it into the **ACS URL** field.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/9u-5hpo4yin_ap-mlypiu4gpg8lvaw7tlg.png)
  3. Leave the **SAML Subject NameID** set to **email**.
  4. In the **SAMLSubject NameID-Format** field, select **urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress** from the dropdown menu.
  5. Set the **Signature Algorithm** to **RSA-SHA256**.
  6. Select **Sign Assertion**.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/ckff8c-alufuekmu7-wtgeexxkubli5d8g.png)
  7. Ensure the **IDP URL** is [https://sso.jumpcloud.com/saml2/kandji](https://sso.jumpcloud.com/saml2/kandji). If it is not, you will need to delete the integration and create a new one. Copy this URL and save it for use in Kandji later.
  8. Click **Save**.
9. Once saved, you can go back into the configured application, navigate to the lefthand menu bar of the modal, and click on **IdP Certificate Valid**. Select **Download certificate** when presented with the certificate options; it will be used in Kandji later.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/zfhshz3yfdglrzwvmndb8rr0nxylbt-ufq.png)
10. On the **User Groups** tab:
  - Add a user group to the SSO application. If you want to restrict who can access the SSO app, create another user group in your JumpCloud console and assign it to the SSO app.

### Configure the SAML Connection in Kandji

1. Go back to the Custom SAML modal in Kandji.
2. Give the connection a **Name**.
3. Paste in the **Sign-in URL** you copied from JumpCloud: [https://sso.jumpcloud.com/saml2/kandji](https://sso.jumpcloud.com/saml2/kandji).
4. Upload the **certificate** you downloaded from JumpCloud.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/g3hk5njg0br4g0jb-kpmz7icd-xpt8ojza.png)
5. Ensure that the **User ID Attribute** is set to the default value of:

```bash
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
```
6. Ensure that **Sign Request** is set to **Yes**.
7. Ensure that **Request Algorithm** is set to **RSA-SHA256**.
8. Ensure that **Sign Request Algorithm Digest** is set to **SHA 256**.
9. Set the **Protocol Binding** to **HTTP-POST**.
10. Click **Save** and then click **Cancel** to exit the configuration.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/bjq72-4r5fhu_6zbph5qm2be6gwgbmwccw(1).png)

### Enable the SAML Connection

Once you have configured the SAML connection in Kandji and your identity provider, you can enable it. For step-by-step instructions, please refer to the **Enable and Manage a Connection** section in our Single Sign-on support article.

### Enforce Single Sign-on

You can disable the standard authentication connection once you have configured at least one Single Sign-on connection. Disabling Kandji standard authentication will disable the ability for Kandji administrators in your tenant to authenticate via email/password, Google Sign-in, or Office 365 Sign-in. Please refer to our [](https://support.kandji.io/sso)[Single Sign-on support article](/v1/docs/single-sign-on) for step-by-step instructions.

### Add a User to Kandji

1. Add a user to the **Admin Team** in Kandji by clicking **New User**.
2. Fill in all of the corresponding user information. This user must exist in JumpCloud and must be assigned to the Kandji SSO app in your JumpCloud tenant.
3. Click **Submit**.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/kyRfUO8R2QbwIWGR00Z_WO4HZQy3Lqfihg(2).png)
4. Once the invite is submitted, close the Invite User window.
5. Refresh the Access page in Kandji. You should see the user you just added.
6. Check the user’s email to accept the invitation and log into Kandji with the new SAML SSO connection.