- \n
- A JumpCloud administrator account<\/li>\n\n\n\n
- JumpCloud SSO Package or higher or SSO \u00e0 la carte option<\/li>\n\n\n\n
- A Paylocity user account with administrator permissions<\/li>\n\n\n\n
- Your Paylocity company ID<\/li>\n\n\n\n
- View and Edit permission to the HR & Payroll > User Access > SSO Configuration<\/strong> Menu Item in Paylocity Security Role<\/li>\n\n\n\n
- Paylocity SCIM integration user credentials<\/li>\n<\/ul>\n\n\n\n
Important Considerations<\/strong><\/p>\n\n\n\n
- \n
- SSO is required for SCIM<\/li>\n\n\n\n
- Paylocity does not support configuration for SSO on a Company Set level\n
- \n
- An SSO Integration must be created for each individual company within the set, as individuals are matched on both the Company ID and either the full work email address or Employee ID in which they reside in Paylocity. These attributes are set as part of the SSO configuration and are provided in the attributes of the SAML response<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Authentication for the SCIM integration is OAuth2.0<\/li>\n\n\n\n
- The SCIM integration is only for importing new users from Paylocity to JumpCloud:\n
- \n
- It does not support provisioning or updating from JumpCloud to Paylocity<\/li>\n\n\n\n
- It currently only supports creating <\/em>new users. Updates to users in Paylocity will not sync back to JumpCloud<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
Attribute Considerations<\/strong><\/p>\n\n\n\n
- \n
- A default set of attributes are managed for users. See the Attribute Mappings<\/a> section for more details<\/li>\n<\/ul>\n\n\n\n
Configuring the SSO Integration<\/strong><\/h2>\n\n\n\n
To configure JumpCloud<\/strong><\/h3>\n\n\n\n
- \n
- Access the JumpCloud Admin Portal<\/a>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\"\/)
<\/p><\/div>Important:<\/strong> \nIf your data is stored outside of the US, check which login URL you should be using depending on your region. If your organization uses LDAP, RADIUS, or requires firewall allow list configuration, the Fully Qualified Domain Names (FQDNs) will also be region specific. See JumpCloud Data Centers<\/a> for the URLs, FQDNs, and IP addresses.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Go to\u00a0Identity Management ><\/strong> HR Directories <\/strong><\/li>\n\n\n\n
- In the Paylocity <\/strong>tile, click Configure.<\/strong><\/li>\n\n\n\n
- Click +Create New Application<\/strong> and then click Next<\/strong>.<\/li>\n\n\n\n
- Enter a Display Label<\/strong> in the General Info tab. Optionally, you can enter a description and adjust the logo shown for the application.<\/li>\n\n\n\n
- Click Save Application<\/strong> and then Configure Application<\/strong>.<\/li>\n\n\n\n
- Select the SSO <\/strong>tab.<\/li>\n\n\n\n
- In the IDP Entity Id<\/strong> field, replace YOUR_PAYLOCITY_COMPANY_ID<\/kbd> with your Paylocity company ID to create a unique value, which is required by Paylocity (e.g., JumpCloud-123456).<\/li>\n\n\n\n
- Optionally, configure:<\/li>\n<\/ol>\n\n\n\n
MFA Claims<\/a>\n![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\")
<\/p><\/div>Note:<\/strong> \nThe Authentication Methods References (AMR)<\/strong> is automatically included in the SAML assertion by default. No additional configuration is required to enable this.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Complete the MFA Claim Configuration<\/strong> to define how the authentication context is sent in the SAML assertion. <\/p>\n\n\n\n
- \n
- Under Auth Context<\/strong>, choose one of the following options based on your SP’s requirements:\n
- \n
- Send a single value for all successful MFA factors<\/strong> – select if the Service Provider accepts a generic confirmation for any MFA login. Enter the single URL or URN they accept<\/li>\n\n\n\n
- Send specific factors<\/strong> – select this option to map individual JumpCloud MFA methods to distinct values. In the Factor Mapping<\/strong> table, add each MFA factor enabled in your organization and enter the corresponding value required by the Service Provider<\/li>\n\n\n\n
- Send single value and specific factors<\/strong> – select to send both a generic identifier and<\/em> specific factor details in the assertion<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\")
<\/p><\/div>Tip:<\/strong> \nRefer to your Service Provider’s documentation to determine the specific URN or URL values required (e.g., Salesforce Session Security Levels). The values entered in this configuration must exactly match<\/strong> what the Service Provider expects.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
\n\n - Send specific factors<\/strong> – select this option to map individual JumpCloud MFA methods to distinct values. In the Factor Mapping<\/strong> table, add each MFA factor enabled in your organization and enter the corresponding value required by the Service Provider<\/li>\n\n\n\n
- Send a single value for all successful MFA factors<\/strong> – select if the Service Provider accepts a generic confirmation for any MFA login. Enter the single URL or URN they accept<\/li>\n\n\n\n
- In the Paylocity <\/strong>tile, click Configure.<\/strong><\/li>\n\n\n\n
- Go to\u00a0Identity Management ><\/strong> HR Directories <\/strong><\/li>\n\n\n\n
- Access the JumpCloud Admin Portal<\/a>.<\/li>\n<\/ol>\n\n\n\n
- A default set of attributes are managed for users. See the Attribute Mappings<\/a> section for more details<\/li>\n<\/ul>\n\n\n\n
- Paylocity SCIM integration user credentials<\/li>\n<\/ul>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\"){kind=icon}
<\/p><\/div>