- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
JumpCloud Single Sign-On (SSO)
Forty SaaS apps, forty passwords, and a leaver who still has Slack. Access is scattered across every tool — JumpCloud Single Sign-On opens every SAML and OIDC app from one User Portal login and creates or removes the accounts by SCIM, REST or JIT, and in the $11 SSO package it brings MFA, the directory and a password manager — one purchase where most firms buy three.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The JumpCloud platform family
This page covers JumpCloud Single Sign-On (SSO) — with User Lifecycle Management (SCIM, REST and SAML JIT provisioning) folded in. The rest:
Quick facts
30-second orientation- Product
- Web single sign-on over SAML 2.0 and OIDC, with User Lifecycle Management (SCIM, REST API, SAML JIT) folded in
- Maker
- JumpCloud Inc., Louisville, Colorado; launched 2012; CEO and co-founder Rajat Bhargava
- User Portal
- Users reach every assigned app from one JumpCloud portal, with access granted through user groups
- Provisioning
- SCIM examples JumpCloud names: Slack, Salesforce, AWS, GitHub and Atlassian; dynamic groups drive access
- Price
- Standalone SSO: $3 per user per month on yearly billing or $4 on monthly; lifecycle provisioning is a further $3 / $4
- SSO package
- $11 annual, $13 monthly: SSO, MFA, Cloud Directory, password manager, Directory Insights and lifecycle
- Passwordless
- Pairs with JumpCloud Go for phishing-resistant login from managed devices; Go is $5 / $6 or in Platform tiers
- Catalogue
- Pre-configured SAML and OIDC connectors; JumpCloud publishes no connector count, so test your own app list
- India
- Mumbai region for tenants created since 30 April 2026; stored data rests there, telemetry may be processed abroad
- In India via
- TechBag — app inventory, package choice, trial support, quote in INR with GST
Understand single sign-on before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is single sign-on?
SSO lets staff sign in once and open every work app, while IT switches access off in one place.
A password per app vs JumpCloud SSO — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | A password per app | JumpCloud Single Sign-On (SSO) |
|---|---|---|
| Logins | A password per SaaS tool | One User Portal sign-in for every app |
| New starters | Accounts made by hand, app by app | SCIM or JIT creates them from the group |
| Leavers | Access found weeks later in an audit | Closed in the directory, then in each app |
| Second factor | Each app with its own MFA, or none | MFA at the portal, in the SSO package |
| Apps without SAML | Shared passwords in a spreadsheet | The bundled password manager |
| What it is NOT | — | A header-based gateway for old web apps |
The cheapest test is the 30-day trial with your ten busiest apps: federate them, turn on SCIM, and disable a test user to watch every account close.
The four pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
User Portal
Staff sign in once to the User Portal and see only the apps their groups grant; a click opens each SAML or OIDC app without another password prompt.
Federation
Each app is set up as a SAML or OIDC connection, from a pre-configured connector or by hand, and JumpCloud signs the assertion the app accepts.
Lifecycle
User Lifecycle Management creates, updates and removes app accounts as group membership changes, by SCIM, the REST API or just-in-time on first login.
Policy
MFA can be required at the User Portal for everyone; rules on trusted devices, networks and locations come from Conditional Access, a separately priced add-on.
Staff sign in once at the User Portal, apps trust JumpCloud over SAML or OIDC, and lifecycle rules create and remove each app account as groups change.
Nine capabilities. Access, provision, harden.
JumpCloud SSO gives staff one login to every web app — and gives IT one place to switch that access off.
One login, every app
A single User Portal sign-in opens each assigned web app, so staff stop keeping a separate password for every SaaS tool.
SAML 2.0 apps
Federate SaaS apps over SAML 2.0 from a catalogue of pre-configured connectors, or build a custom connection with your app’s metadata.
OpenID Connect apps
Modern and in-house apps can trust JumpCloud through OpenID Connect; JumpCloud’s own how-to video walks through a custom set-up.
Accounts created for you
SCIM pushes new starters into apps such as Slack, Salesforce, AWS, GitHub and Atlassian, and removes them when they leave.
Just-in-time accounts
For apps without SCIM, SAML JIT builds the account on the user’s first sign-in, and the REST API covers the remaining cases.
Access follows attributes
Dynamic groups built from department, location or role decide which apps a person sees, so a transfer changes access without a ticket.
A factor at the door
Require push, TOTP or WebAuthn before the portal or a sensitive app opens; in the SSO package, MFA costs nothing extra.
Passwordless on managed PCs
JumpCloud Go signs users into web apps with a hardware-protected, phishing-resistant credential on devices JumpCloud manages.
For apps without SSO
The SSO package includes JumpCloud’s password manager, so apps that cannot federate still get stored, shared credentials.
Watch JumpCloud set up SSO and provisioning
Two videos from JumpCloud’s official channel, from December 2022 and January 2023: an explainer on SSO with provisioning, and a how-to that sets up an OpenID Connect app.
Single Sign-On and Provisioning Capabilities Available in the JumpCloud Open Directory Platform
A 3:13 explainer from January 2023 on how JumpCloud pairs SSO to web apps with automatic account provisioning.
How to Configure OpenID Connect SSO With JumpCloud
An 8:03 how-to from December 2022 that sets up an OpenID Connect application in the JumpCloud console, end to end.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Most firms buy SSO, MFA and a directory separately. JumpCloud sells them as one package.
Here’s what genuinely sets it apart — and exactly where it stops.
SSO, MFA and a directory for $11
Most SSO buys also need a directory and a second factor. JumpCloud’s SSO package puts single sign-on, MFA, Cloud Directory, a password manager, Directory Insights and user lifecycle in one $11 per-user price on annual terms, so a growing company is not pricing three products to switch on SSO.
Leavers lose access by themselves
Provisioning is part of the purchase: SCIM, the REST API or SAML JIT create accounts, and dynamic groups grant apps by department or location. When HR marks someone as gone, the account closes in the directory and the connected apps follow, which is what an auditor asks to see.
One identity for apps and laptops
Add a device package and the same account signs people into their Mac, Windows or Linux machine through JumpCloud’s agent, so SSO can be paired with JumpCloud Go for a passwordless, phishing-resistant login from managed devices. Pairing app sign-in with device management is what separates it from SSO-only identity providers.
Where it stops
JumpCloud publishes no connector count, so check every app you run. SSO covers SAML and OIDC web apps; LDAP or RADIUS systems need Platform tiers or $3 add-ons. Device-aware policies need Conditional Access, bundled only with Platform Prime. The India region is for new tenants, and there is no analyst placement.
The numbers behind the platform
What your JumpCloud SSO rollout looks like
List every app
Write down each SaaS and in-house app, whether it speaks SAML or OIDC, and whether it supports SCIM for accounts.
Pick package and region
Choose SSO alone or the $11 package, and the India region at sign-up; existing tenants cannot simply move there later.
Federate ten apps
Connect the ten most-used apps, switch on SCIM where offered, and send one team through the User Portal with MFA.
Test a leaver
Disable a test user in the directory and confirm each connected app closes the account; fix any app that keeps it.
Roll out and price
Move the remaining apps, decide on JumpCloud Go and Conditional Access, then lock the INR quote with GST.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Thirty SaaS tools behind one portal, and the SSO package also gave us MFA and a directory; nobody had to sell finance three products.”
“SCIM to Slack and GitHub means a leaver loses access the hour HR closes the record, which our last audit specifically asked about.”
“Two of our niche apps had no ready connector, so we built SAML connections by hand; it worked, but check your list before buying.”
“Setting up our in-house dealer portal over OpenID Connect took an afternoon, following JumpCloud’s own how-to video.”
“Dynamic groups by department mean a transfer from sales to finance swaps the app list without anyone raising a ticket.”
“We wanted device checks on every login and found Conditional Access was a separate add-on; budget for it from the start.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the workforce single sign-on market — tap any vendor to see why it sits where it does.
TechBag Single Sign-On Grid
Execution strength vs product vision — the classic market map, minus the paywall.
$3 alone or $11 in the SSO package; no analyst placement.
Lifecycle Depth × Catalogue Reach
The grid nobody publishes — how much of the joiner-to-leaver account work each product automates vs how wide its ready-made app catalogue reaches.
SCIM, REST and JIT lifecycle; directory, MFA and laptops in one tenant.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
JumpCloud SSO vs the single sign-on field
Against Okta Single Sign-On, Microsoft Entra ID P1, miniOrange SSO, Scalefusion OneIdP and Cisco Duo — on protocols, legacy apps, provisioning, device policy, catalogue, price and India data.
| Dimension | JumpCloud Single Sign-On (SSO) | Okta Single Sign-On | Microsoft Entra ID P1 | miniOrange SSO | Scalefusion OneIdP | Cisco Duo |
|---|---|---|---|---|---|---|
| What it is | SSO with a user portal | Okta’s flagship IdP | Microsoft’s paid tier | India-built SSO | Device-led SSO | MFA-first access |
| Deployment | SaaS, three regions | SaaS | SaaS | SaaS or on-prem | SaaS | SaaS plus proxy |
| Federation protocols | SAML 2.0 and OIDC | SAML, OIDC, SWA | SAML, OIDC, WS-Fed | SAML, OAuth, OIDC | SAML and OIDC | Duo SSO |
| Legacy apps | LDAP, RADIUS extra | LDAP, RADIUS, header | App proxy, headers | LDAP to Kerberos | LDAP only | RADIUS and LDAP |
| Provisioning | SCIM, REST, SAML JIT | SCIM, deep lifecycle | SCIM in every tier | Lifecycle and SCIM | Not recorded | No lifecycle |
| Phishing-resistant login | JumpCloud Go, passkeys | FIDO2, passkeys | Passkeys, Hello | FIDO2 recorded | Device as credential | Passwordless, FIDO2 |
| Device-aware policy | Add-on, $3 | Device and network | Intune-compliant devices | Recorded as full | Its whole point | Device trust |
| Directory in the price | Directory bundled | Universal Directory in | It is the directory | Sibling SKU | Built in | Newer directory |
| App catalogue | Count not published | 7,000+ connectors | Microsoft app gallery | 5,000+ apps | UEM ecosystem | IdP-agnostic |
| Pricing model | Per user, item or pack | Suites, $1,500 floor | Per user, or in M365 | Per user, INR tiers | Per device | Per user, via partners |
| Published entry price | $3 alone; $11 package | ~$6, $1,500 minimum | Free SSO; P1 $7.00 | From ₹180 (~$2.16) | $5/device, Access Pro | Free to 10; $3–9 |
| India data region | Mumbai, at rest | In-country, Jan 2026 | No India geo | On-prem, India-built | Region not recorded | India DC since 2022 |
| Lock-in and exit | Re-federate each app | Suites and connectors | Bound to Microsoft 365 | Self-host exit | Tied to Scalefusion | Light, sits in front |
| Best fit | Small IT, mixed suites | App-heavy estates | Microsoft 365 estates | Cost-led, legacy apps | Scalefusion customers | MFA in front of all |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose JumpCloud Single Sign-On (SSO) if…
- ✓You want SSO, MFA and a directory from one vendor for $11 a user a month on annual terms
- ✓Leavers must lose app access automatically through SCIM, JIT or dynamic groups
- ✓The same identity should also sign people into Mac, Windows and Linux laptops
Compare alternatives if…
- ✓You run hundreds of SaaS apps — Okta’s catalogue lists 7,000+ connectors
- ✓Microsoft 365 E3 or Business Premium already includes Entra ID P1
- ✓You need header-based or Kerberos apps covered, or an on-premises IdP — look at miniOrange
Do not expect…
- ✓A published connector count — test your own app list in the trial
- ✓Device-aware policies in the $11 package — Conditional Access is extra
- ✓India-only processing: logs and telemetry may leave the Mumbai region
JumpCloud Single Sign-On (SSO) is one of 30 iam, sso & mfa products TechBag carries. The IAM, SSO & MFA guide narrows them to a shortlist and shows the reasoning. →
What do manual app accounts cost you?
Drag the sliders (staff using SaaS apps; IT-hour cost). Estimates model the IT time spent creating and removing app accounts by hand, resetting forgotten passwords and answering access requests, at an assumed 1.5 hours per user a year, with 70% of it removed by SSO and automated provisioning. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Published. SSO on its own is $3.00 per user a month billed annually or $4.00 billed monthly (USD), with User Lifecycle Management another $3 / $4. The SSO package, $11 annual or $13 monthly, combines SSO, MFA, Cloud Directory, a password manager, Directory Insights and lifecycle. Conditional Access ($3 / $4) and JumpCloud Go ($5 / $6) are extra outside the Platform packages, which are Contact Sales. New accounts get a 30-day trial. TechBag quotes in INR with GST.
SSO package
Best for SSO, MFA and directory together
- $11 per user a month annual, $13 monthly
- SSO, MFA, directory, password manager
- Lifecycle and Directory Insights included
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
SSO à la carte
Best when a directory and MFA already exist
- $3 / $4 per user a month
- Lifecycle provisioning a further $3 / $4
- Conditional Access a $3 / $4 add-on
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Which of our apps have a pre-configured JumpCloud connector, and which need a hand-built SAML or OIDC set-up?
Which apps accept SCIM, which only JIT, and which need the REST API or manual accounts for leavers?
Is SSO alone at $3 cheaper than the $11 package once MFA, directory and password manager are counted?
Do we need trusted-device rules on sign-in? Conditional Access is a $3 add-on or comes with Platform Prime.
Which systems cannot do SAML or OIDC, and will Cloud LDAP or RADIUS cover them at extra cost per user?
Will the tenant be created in Mumbai, and which logs and telemetry may still be processed outside India?
How long are SSO sign-in events kept, and do they meet CERT-In’s 180-day log rule without an export?
Are suspended users billable on our plan? Ask TechBag to quote in INR with GST, with each item shown.
Questions buyers ask
Ready to evaluate JumpCloud SSO?
Send TechBag your app list, or let an advisor check each app against JumpCloud’s connectors, decide between SSO alone and the $11 package, and get the quote in INR with GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.