- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
JumpCloud Privileged Access Management (PAM)
Your database vendor logs in tonight. They have had the same admin password since 2023 — JumpCloud Privileged Access Management brokers SSH, RDP, VNC, database and web sessions through a browser gateway, rotates server passwords by script and records sessions on the Premium connector — with Access Requests for just-in-time elevation, run from the JumpCloud directory.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The JumpCloud platform family
This page covers JumpCloud Privileged Access Management — called ‘JumpCloud Vault’ in the docs, with Access Requests folded in. The rest:
Quick facts
30-second orientation- Product
- Brokered privileged access to servers, databases and web consoles, with session recording and scripted rotation
- Origin
- VaultOne of Curitiba, Brazil, acquired 20 May 2025; JumpCloud said existing VaultOne customers keep their service
- Naming
- Help Center articles call it ‘JumpCloud Vault’; it is not the $3 workforce Password Vault
- Architecture
- Hybrid: the JumpCloud cloud console plus a Connector you host on Ubuntu Server 24.04 with Docker
- Targets
- SSH, RDP (including a macOS RDP connector), VNC, RemoteApp, databases, and websites via Web Shield
- Recording
- Video needs the Premium connector; SSH sessions can be recorded, native-client RDP sessions cannot
- Just-in-time
- Access Requests ($5 per user a month, or in Platform Prime) grants temporary elevated device rights
- Price
- Contact Sales: JumpCloud publishes no list price for PAM and no licence meter
- India
- A dedicated India AWS region keeps Vault secrets and session recordings in India for India-region tenants (Mar 2026)
- In India via
- TechBag — target count, Connector sizing, a quote in INR with GST, and a pilot on your own servers
Understand privileged access management before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
PAM run from the JumpCloud directory
Brokered, recorded access to servers, databases and web consoles for users synced from JumpCloud.
Shared admin passwords and a jump box vs JumpCloud PAM — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | Shared admin passwords and a jump box | JumpCloud Privileged Access Management (PAM) |
|---|---|---|
| Admin passwords | Shared in a team chat | Vaulted, brokered and rotated by script |
| Remote admin | VPN plus a jump box | Browser gateway sessions, no VPN needed |
| Local admin rights | Permanent on every laptop | Temporary elevation through Access Requests |
| Audit evidence | Screenshots on request | Session video on the Premium connector |
| Third parties | Handed the real password | Brokered sessions; the password stays hidden |
| What it is NOT | — | Agentless SaaS, or a list-priced product |
The cheapest test is ten servers behind one Connector: broker SSH and RDP through the browser for a fortnight and replay a recorded session.
The four pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Cloud console
Privileged users arrive by SCIM sync from the JumpCloud directory, and admins set who may reach which server, database or site; Entra ID sign-in is also documented.
Connector
An Ubuntu Server 24.04 host running Docker, with 80 GB of disk or more and ports 443 and 2222: it proxies each session, records it and backs up vaulted passwords.
Browser gateway
SSH, RDP, VNC and RemoteApp sessions open in the browser with no VPN; isolated sessions can strip extensions and block downloads, JumpCloud says.
Access Requests
A user asks for a resource or temporary elevated device rights, an approver signs off, and the request is logged in Directory Insights; requests lapse after 30 days.
Policy lives in the JumpCloud cloud console; a Connector you host on Ubuntu proxies, records and rotates — and Access Requests decides who gets in, for how long.
Nine capabilities. Broker, control, record.
JumpCloud PAM gives privileged users from your JumpCloud directory brokered, recorded access to servers and databases — through a Connector you host.
SSH, RDP, VNC and RemoteApp
Privileged sessions open through the browser gateway, so admins need neither a VPN nor a copy of the target’s password.
Remote sessions to Macs too
A macOS RDP connector extends brokered remote sessions to Apple machines, alongside the Windows and Linux servers.
Websites and admin consoles
Web Shield brokers access to websites and SaaS admin consoles, and isolated sessions can remove extensions and stop downloads.
Scripted password rotation
Passwords on Windows and Linux/Unix servers are rotated by scripts, so shared admin passwords stop surviving for years.
Blocking rules for databases
Database access runs through the Connector with blocking rules and an audit of each session, so risky access is fenced in.
Temporary elevation on request
Access Requests lets users ask for a resource or short-lived admin rights on their device, with an approval step first.
Session video on Premium
Video recording runs on the Premium connector; SSH sessions can be captured, but RDP opened in a native client cannot.
Logged in Directory Insights
Access requests and their approvals are written to Directory Insights, beside the tenant’s sign-in and device events.
PAM rules for AI agents
Agentic IAM applies PAM rules to registered AI agents; a PAM MCP Server is planned for Q4 2026 and has not shipped yet.
Watch JumpCloud PAM and Access Requests in action
Two videos from JumpCloud’s official channel, both from 2025: an IT Hour discussion with VaultOne on PAM after the acquisition, and a live demo of Access Requests.
The IT Hour | MSP Report & PAM Insights: A JumpCloud & VaultOne Discussion 6.6.25
A 32-minute IT Hour episode in which JumpCloud and VaultOne talk through PAM for MSPs, weeks after the 2025 acquisition.
The Deep Dive | Simplify User Access with JumpCloud Access Requests 11.14.2025
A 54-minute live demo of Access Requests, JumpCloud’s self-service, approval-based route to temporary access.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Too many incidents still begin with an admin password someone shared. JumpCloud PAM keeps it out of their hands.
Here’s what genuinely sets it apart — and exactly where it stops.
PAM fed by the directory you already run
Standalone vaults keep a user list of their own. Here privileged users arrive by SCIM sync from the JumpCloud directory that already runs SSO and devices, and access approvals are written to Directory Insights beside sign-in events. For a JumpCloud tenant, privileged access stops being a separate identity island.
Browser sessions, no VPN, no shared password
Admins and suppliers open SSH, RDP, VNC, RemoteApp and database sessions in the browser through a gateway, so the target’s password never reaches their laptop. Web Shield stretches that to websites and admin consoles, and JumpCloud says isolated sessions can remove extensions and stop downloads.
Just-in-time without a second vendor
Access Requests, at $5 per user a month à la carte or inside Platform Prime, lets staff ask for a resource or for temporary admin rights on their own device, behind an approval flow. Paired with scripted rotation on Windows and Linux servers, it shrinks the standing admin rights auditors keep flagging.
Where it stops
You host and patch the Connector. Video recording needs the Premium connector, and RDP opened in a native client is not recorded. Account discovery is not documented, network devices are not among the listed targets, there is no list price, and no customer scale has been published since the May 2025 VaultOne deal.
The numbers behind the platform
What your JumpCloud PAM rollout looks like
Count targets and admins
List the servers, databases and web consoles in scope, and who needs each, so the quote has a meter to work from.
Stand up the Connector
Build an Ubuntu Server 24.04 host with Docker and 80 GB of disk, open ports 443 and 2222, and decide on Premium.
Pilot ten servers
Broker SSH and RDP to ten servers through the browser, switch on scripted rotation, and record a session to test playback.
Add requests and approvals
Turn on Access Requests for one team’s temporary admin rights, and trace each request and approval in Directory Insights.
Roll out and settle
Add the remaining targets and third parties, confirm the India region for recordings, then settle the INR quote with GST.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Admins come straight from our JumpCloud directory, so there was no second user list. Linux SSH moved to the gateway in a week.”
“Our database vendor now logs in through the browser and never sees the password. The blocking rules gave our DBAs comfort.”
“We built and patch the Ubuntu connector ourselves, and video came only with the Premium connector. Budget for both early.”
“Access Requests replaced permanent local admin on developer laptops. Approvals take minutes and every one is logged.”
“With an India-region tenant our session recordings stay here, which was the first thing our auditors wanted to know.”
“No list price meant two rounds with sales, but the final number sat below the enterprise vaults on our shortlist.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the privileged access management market — tap any vendor to see why it sits where it does.
TechBag PAM Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Contact Sales; VaultOne-based, part of JumpCloud since 2025.
Access Control × Vault Breadth
The grid nobody publishes — how much a PAM tool controls the moment of access (JIT, brokering, approvals) vs how much of the estate its vault reaches: targets, discovery and rotation.
Browser gateway and JIT requests; no discovery, scripted rotation.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
JumpCloud PAM vs the privileged access field
Against Okta Privileged Access, miniOrange PAM, Securden Unified PAM, ARCON PAM and Devolutions PAM — on deployment, targets, recording, JIT, rotation, discovery, scale, price and India data.
| Dimension | JumpCloud Privileged Access Management (PAM) | Okta Privileged Access | miniOrange PAM | Securden Unified PAM | ARCON PAM | Devolutions PAM |
|---|---|---|---|---|---|---|
| What it is | Directory-native PAM | PAM inside Okta | India-built value PAM | All-in-one per-user PAM | Mumbai-built PAM | PAM inside RDM |
| Deployment | Cloud + your Connector | SaaS, agent-based | On-prem, self-host, SaaS | On-prem or PAMaaS | On-prem common in BFSI | Self-host or cloud |
| Targets covered | Servers, DBs, web | Servers and cloud | Servers, DBs, cloud, SaaS | Six target families | Incl. network devices | Network gear too |
| Session recording | Video, Premium only | Full recording | Full recording | Every session recorded | Full, audit-ready | Video, no keystrokes |
| Just-in-time access | Access Requests | Zero standing privilege | JIT with approvals | JIT in the licence | JIT documented | JIT + approved checkout |
| Password rotation | Scripts, Win and Linux | Server credentials | Automatic rotation | Passwords and SSH keys | Vault with rotation | Some reset-only |
| Account discovery | Not documented | Not documented | Discovery included | Discovery included | Discovery included | Discovery included |
| Identity tie-in | SCIM from its directory | Native to Okta | Own IAM suite | AD, Entra ID, LDAP | Own MFA, SCIM API | Built around RDM |
| Proven scale | Not published | Verified at scale | Mid-market scale | Flagged above 1,000 | 1,500+ orgs, ARCON says | No PAM customer named |
| Pricing model | Contact Sales | Bundled per user | Per user, INR | Per user, all-in | Per user and target | Per named user |
| Published entry price | Not published | ~$17 in Essentials | From ~$2.16 (₹180) | Quote | Quote in INR | $50/user/month |
| India data region | Dedicated India region | In-country, confirm | India-built, on-prem | On-prem in India | Mumbai-built, on-prem | Self-host to stay |
| Lock-in and exit | Suite-bound | Okta-bound | Your hosting choice | On-prem keeps data | Deep in BFSI stacks | RDM habits |
| Best fit | JumpCloud tenants | Okta estates | Cost-led Indian estates | One price, all features | Indian BFSI | Small IT teams |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose JumpCloud Privileged Access Management (PAM) if…
- ✓You run JumpCloud already and want privileged users drawn from the same directory and groups
- ✓Admins and suppliers should reach servers and databases through a browser, with no VPN and no shared password
- ✓Session recordings must stay in India and you will run an India-region tenant
Compare alternatives if…
- ✓You need a list price before talking to sales — Devolutions publishes $50 per named user a month
- ✓Network devices and RBI or SEBI audit formats matter — ARCON is built for them
- ✓You need discovery of unknown admin accounts — Securden, miniOrange and ARCON document it
Do not expect…
- ✓Agentless SaaS — you host, size and patch the Connector
- ✓Session video without the Premium connector, or recording of native-client RDP
- ✓An analyst rating — JumpCloud publishes no Gartner or Forrester placement for this line
JumpCloud Privileged Access Management (PAM) is one of 30 privileged access management products TechBag carries. The Privileged Access Management guide narrows them to a shortlist and shows the reasoning. →
What does managing privileged access by hand cost you?
Drag the sliders (privileged admins and suppliers; staff-hour cost). Estimates model the time spent sharing and changing admin passwords, opening VPN and jump-box access and assembling audit evidence, at an assumed 25 hours per privileged user a year, with 50% of it removed by brokered sessions, rotation and logged requests. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Contact Sales. JumpCloud lists Privileged Access Management in its own block on the pricing page with no figure, and does not say whether users, targets or Connectors are counted, or what the Premium connector needed for video recording adds. Access Requests, the just-in-time add-on, is the one published number nearby: $5 per user a month, annual or monthly, or included in Platform Prime. TechBag gets the quote itemised in INR with GST.
JumpCloud PAM
Best for JumpCloud tenants brokering server and database access
- Contact Sales; meter not published
- Browser gateway, scripted rotation
- Video recording on the Premium connector
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
+ Access Requests
Best for removing standing admin rights
- $5 per user a month, annual or monthly
- Included in Platform Prime
- Temporary elevated device privileges
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
What does the quote count: privileged users, targets or Connectors? JumpCloud publishes no meter for PAM.
Who builds, patches and backs up the Ubuntu Connector host, and how many do your sites and networks need?
Is the Premium connector in the quote? Video needs it, and RDP opened in a native client is not recorded.
How will unknown admin accounts be found? Discovery is not documented, so plan a separate account inventory.
Are routers, switches and firewalls in scope? They are not among the documented targets; ask JumpCloud.
Is your tenant in the India region, so recordings stay here? Existing tenants can only move by paid migration.
Can JumpCloud name a PAM customer of your size in India? No scale figure has appeared since the VaultOne deal.
Is Access Requests in scope? It is $5 a user à la carte or part of Platform Prime; get both routes in INR.
Questions buyers ask
Ready to evaluate JumpCloud PAM?
List the servers, databases and consoles your admins and suppliers reach, or let a TechBag advisor get the licence meter, Connector sizing and Premium recording terms from JumpCloud in writing.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.