- \n
- A JumpCloud administrator account<\/li>\n\n\n\n
- JumpCloud SSO Package or higher<\/li>\n\n\n\n
- A Workday user account with Security Administrator<\/strong> and Report Administrator<\/strong> permissions<\/li>\n\n\n\n
- Your Workday tenant name and domain<\/li>\n<\/ul>\n\n\n\n
Considerations:<\/strong><\/p>\n\n\n\n
- \n
- Enabling SAML affects all users for this application; they won’t be able to sign in through their regular login page<\/li>\n\n\n\n
- Importing users from Workday to JumpCloud with the new SCIM integration requires a custom report in Workday and the custom API import integration in JumpCloud. It supports full user lifecycle management.\u00a0<\/li>\n\n\n\n
- JumpCloud imports only JSON formatted data<\/li>\n\n\n\n
- Importing data from Workday into custom attributes in JumpCloud is not currently supported<\/li>\n<\/ul>\n\n\n\n
Important Considerations:<\/strong><\/p>\n\n\n\n
The legacy Workday integration will be deprecated in May 2026<\/p>\n\n\n\n
Creating a new JumpCloud Application Integration<\/strong><\/h2>\n\n\n\n
- \n
- Log in to the JumpCloud Admin Portal<\/a>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\"\/)
<\/p><\/div>Important:<\/strong> \nIf your data is stored outside of the US, check which login URL you should be using depending on your region. If your organization uses LDAP, RADIUS, or requires firewall allow list configuration, the Fully Qualified Domain Names (FQDNs) will also be region specific. See JumpCloud Data Centers<\/a> for the URLs, FQDNs, and IP addresses.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Go to Access <\/strong>> SSO<\/strong> Applications<\/strong>.<\/li>\n\n\n\n
- Click + Add New Application<\/strong>.<\/li>\n\n\n\n
- You can also enter the name of the application in the Search <\/strong>field and select it.<\/li>\n\n\n\n
- You can either select an application from the available list or select Custom Application<\/strong>, and click Next<\/strong>.<\/li>\n\n\n\n
- Select the required options from the Select Options<\/strong> page and click Next<\/strong>. The Enter General Info<\/strong> page is displayed.<\/li>\n\n\n\n
- On the Enter General Info<\/strong> page, you can customize the display label, description and how the application displays:\n
- \n
- Description<\/strong> – add a description that users will see in their user portal<\/li>\n\n\n\n
- User Portal Image<\/strong> – choose Logo <\/strong>or Color Indicator<\/strong><\/li>\n\n\n\n
- Show in User Portal<\/strong> – select to ensure the app is visible in the user portal<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Optionally, expand the Advanced Settings <\/strong>section and customize the IdP URL:\n
- \n
- Enter a custom value to replace the default application name in the SSO IdP URL endpoint ( https:\/\/sso.jumpcloud.com\/saml2\/{custom_value}<\/kbd>)<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/warning-icon.png\")
<\/p><\/div>Warning:<\/strong> \nThe SSO IdP URL<\/strong> is not editable after the application is created. If you need to change this URL later, you must delete and recreate the connector.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Click Save<\/strong> Application.<\/strong><\/li>\n\n\n\n
- Next, click:\n
- \n
- Configure Application<\/strong> and go to the next section <\/li>\n\n\n\n
- Close<\/strong> to configure your new application at a later time <\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\")
<\/p><\/div>Tip:<\/strong> \nUsers are implicitly denied access to applications. See Authorize Users to an SSO Application<\/a>. <\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Configuring the SSO Integration<\/h2>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\")
<\/p><\/div>Note:<\/strong> \nJumpCloud sends a value, the NameID, in the SAML Assertion that Workday uses to identify which user is attempting SSO. This value must match a user’s Workday username. If your users’ Workday usernames already exist within JumpCloud (as their emails or JumpCloud usernames), you may choose which of these attributes to send as the NameID for each user. If your users’ Workday usernames do not match any pre-existing attributes in JumpCloud, you will need to add a WorkdayID custom attribute for every user that will be using SSO to Workday.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
To add the WorkdayID custom attribute for SSO users:<\/p>\n\n\n\n
- \n
- In the JumpCloud Admin Portal, navigate to Identity Management<\/strong> > Users<\/strong>.<\/li>\n\n\n\n
- Select the user for whom you will add a custom attribute.<\/li>\n\n\n\n
- Select the Details <\/strong>tab and then scroll down to the Custom Attributes<\/strong> section.<\/li>\n\n\n\n
- Select add new custom attribute<\/strong>.<\/li>\n\n\n\n
- In the Attribute Name<\/strong> field, enter WorkdayID<\/strong>.<\/li>\n\n\n\n
- In the Attribute Value<\/strong> field, enter the user’s Workday username.<\/li>\n\n\n\n
- Select Save User<\/strong>.<\/li>\n<\/ol>\n\n\n\n
To navigate to your JumpCloud SSO connector<\/strong><\/h3>\n\n\n\n
- \n
- Log in to the JumpCloud Admin Portal<\/a>.<\/li>\n<\/ol>\n\n\n\n<\/p><\/div>Important:<\/strong> \n
If your data is stored outside of the US, check which login URL you should be using depending on your region. If your organization uses LDAP, RADIUS, or requires firewall allow list configuration, the Fully Qualified Domain Names (FQDNs) will also be region specific. See JumpCloud Data Centers<\/a> for the URLs, FQDNs, and IP addresses.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Go to Access > SSO Applications<\/strong>. <\/li>\n\n\n\n
- Create a new application<\/a> or select it from the Configured Application<\/strong>s list.<\/li>\n\n\n\n
- Select the SSO<\/strong> tab.<\/li>\n<\/ol>\n\n\n\n
To configure JumpCloud<\/h3>\n\n\n\n
- \n
- Optionally, configure:<\/li>\n<\/ol>\n\n\n\nMFA Claims<\/a>\n
<\/p>\n\n\n\n
<\/p><\/div>Note:<\/strong> \nThe Authentication Methods References (AMR)<\/strong> is automatically included in the SAML assertion by default. No additional configuration is required to enable this.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Complete the MFA Claim Configuration<\/strong> to define how the authentication context is sent in the SAML assertion. <\/p>\n\n\n\n
- \n
- Under Auth Context<\/strong>, choose one of the following options based on your SP’s requirements:\n
- \n
- Send a single value for all successful MFA factors<\/strong> – select if the Service Provider accepts a generic confirmation for any MFA login. Enter the single URL or URN they accept<\/li>\n\n\n\n
- Send specific factors<\/strong> – select this option to map individual JumpCloud MFA methods to distinct values. In the Factor Mapping<\/strong> table, add each MFA factor enabled in your organization and enter the corresponding value required by the Service Provider<\/li>\n\n\n\n
- Send single value and specific factors<\/strong> – select to send both a generic identifier and<\/em> specific factor details in the assertion<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
<\/p><\/div>Tip:<\/strong> \nRefer to your Service Provider’s documentation to determine the specific URN or URL values required (e.g., Salesforce Session Security Levels). The values entered in this configuration must exactly match<\/strong> what the Service Provider expects.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
\n\n\n\n
\n \n MFA Factor <\/th>\n \n Service Provider <\/th>\n \n Notes <\/th>\n <\/tr>\n \n \n Password <\/td>\n \n Reference your Service Providers's documentation for the values they expect for each factor <\/td>\n \n <\/td>\n <\/tr>\n \n \n TOTP <\/td>\n \n <\/td>\n \n <\/td>\n <\/tr>\n \n \n WebAuthN <\/td>\n \n <\/td>\n \n <\/td>\n <\/tr>\n \n \n Push Notification <\/td>\n \n <\/td>\n \n JumpCloud Protect or other authenticator application <\/td>\n <\/tr>\n \n \n Duo Security <\/td>\n \n <\/td>\n \n <\/td>\n <\/tr>\n \n \n Device Trust <\/td>\n \n <\/td>\n \n <\/td>\n <\/tr>\n \n \n Device Trust + User Verification <\/td>\n \n <\/td>\n \n JumpCloud Go <\/td>\n <\/tr>\n \n \n API Key <\/td>\n \n <\/td>\n \n <\/td>\n <\/tr>\n \n \n External Identity Provider <\/td>\n \n <\/td>\n \n <\/td>\n <\/tr>\n <\/table>\n<\/div><\/div>\n\n\n\n Learn more<\/a> about MFA Claims.<\/p>\n<\/div><\/div><\/div>\n\n\n\n
- Send specific factors<\/strong> – select this option to map individual JumpCloud MFA methods to distinct values. In the Factor Mapping<\/strong> table, add each MFA factor enabled in your organization and enter the corresponding value required by the Service Provider<\/li>\n\n\n\n
- Send a single value for all successful MFA factors<\/strong> – select if the Service Provider accepts a generic confirmation for any MFA login. Enter the single URL or URN they accept<\/li>\n\n\n\n
- Under Auth Context<\/strong>, choose one of the following options based on your SP’s requirements:\n
- Create a new application<\/a> or select it from the Configured Application<\/strong>s list.<\/li>\n\n\n\n
- Go to Access > SSO Applications<\/strong>. <\/li>\n\n\n\n
- Close<\/strong> to configure your new application at a later time <\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
- Next, click:\n
- Click Save<\/strong> Application.<\/strong><\/li>\n\n\n\n
- User Portal Image<\/strong> – choose Logo <\/strong>or Color Indicator<\/strong><\/li>\n\n\n\n
- Click + Add New Application<\/strong>.<\/li>\n\n\n\n
- Go to Access <\/strong>> SSO<\/strong> Applications<\/strong>.<\/li>\n\n\n\n
- Log in to the JumpCloud Admin Portal<\/a>.<\/li>\n<\/ol>\n\n\n\n
- Your Workday tenant name and domain<\/li>\n<\/ul>\n\n\n\n