JumpCloud unifies clients' technology stack across identity, access, and device management. Deel's JumpCloud integration uses a robust SCIM API infrastructure to sync EOR employees, direct employees, independent contractors, and Worker Profiles without a Contract (PWACs). This keeps user management accurate and up-to-date across both platforms.
With this integration, Deel HR clients can:
- Add users to JumpCloud when added in Deel
- Deprovision (suspend) users when offboarded in Deel
- Sync worker details when updated in Deel
This article explains how clients can set up the JumpCloud integration on Deel for SSO.
In this article
- Before Starting
- Step 1. Prepare JumpCloud
- Step 2. Connect the Integration
- Step 3. Configure the Integration
- Step 4. Sync Data Manually
- JumpCloud Integration Reference
- Frequently Asked Questions (FAQs)
- Troubleshooting
Before Starting
To successfully set up the JumpCloud integration, you’ll need:
- A user with one of the following admin roles on Deel: Organization Admin, IT Developer Admin, Integrations Admin - People, or Deel IT (Approver + Manager + Configurer)
- A user with an admin role on JumpCloud
Step 1. Prepare JumpCloud
You'll need an API Key from JumpCloud to connect the integration.
To generate an API key from JumpCloud:
1. Click the profile avatar in JumpCloud and select My API Key.
2. From the API Key modal, select an expiration date and click Generate New API Key.
3. Copy the generated API key.
Now that you have an API Key, you can go back to Deel to connect the integration.
Step 2. Connect the Integration
1. In the left sidebar, click Apps & Automation to expand the section, then click App Store.
2. If the Welcome to your Deel Apps & Integrations dialog appears, click I'll do that later.
3. In the Find apps field, enter JumpCloud, then select the JumpCloud result with the description Helping companies manage users.
4. On the JumpCloud details page, click Connect JumpCloud.
5. On the JumpCloud form, enter your API Key. The form saves automatically, so you can return after obtaining the key if necessary.
6. Click Connect & go to settings after the key is accepted.
The integration is now connected, and you can start to configure the integration. If Connect & go to settings is disabled, confirm that the full valid API Key is entered.
Step 3. Configure the Integration
In this section, we’ll guide you through configuring the integration so that data can sync successfully.
After connecting JumpCloud, open it from Apps & Automation > App Store and select Plugins and settings. Configuring it consists of:
Configure the Field Mapping Plugin
This plugin allows you to select and sync specific fields between Deel and JumpCloud.
To configure field mapping, you must have one of the following Deel permissions: Deel IT: Approver + Manager + Configurer, Integrations Admin - People, IT Developer Admin, or Organization Admin.
To configure the field mapping plugin:
- From the JumpCloud integration page, go to the Plugins and settings tab.
- Click Field Mapping.
- Customize the user field mapping for JumpCloud.
The Field Mapping plugin is configured. Changes in employee data will be synced from Deel to JumpCloud.
Map Deel fields to custom JumpCloud attributes
You can create your own JumpCloud attributes and fill them with Deel data, such as officeLocation or contractEnd. This is available to all organizations, including Identity Enhanced.
- In Deel, go to Apps & Automation > App Store > JumpCloud > Plugins and settings > User provisioning and sync settings > Field mapping.
- In the JumpCloud field dropdown, type a name that doesn’t exist yet and select Add {name}.
- Choose the Deel field to map to that attribute.
- Save. Deel runs a full sync of all users in scope.
| Rule | Behavior |
|---|---|
| Attribute name | Letters and numbers only, 1 to 31 characters, case kept as typed |
| Renaming | Not possible. The name is fixed when you select Add {name}. To fix a typo, delete the row and create it again |
| Deel fields you can map | Text, date, email, first name, last name, full name, country, and custom fields of type text, list, date, currency or percentage |
| Deel fields you can’t map | Address, phone, multiselect |
| Value formats | Dates as YYYY-MM-DD (no time). Currency as code and amount, for example USD 1234.56
|
| Empty Deel value | Nothing is written and nothing is removed. The current JumpCloud value stays |
| Sync policy | Not supported. Custom attributes always sync |
| Number of mappings | No limit set by Deel. JumpCloud dynamic groups accept up to 5 custom attributes |
| Changing a custom mapping | You can switch it to a standard JumpCloud field, or delete it |
| Effect of adding, deleting or changing a mapping | Deel runs a full sync of all users in scope |
Configure the User Provisioning Plugin
This plugin automatically creates JumpCloud accounts for new hires and suspends accounts upon termination.
To configure the user provisioning plugin:
1. From the JumpCloud integration page, go to the Plugins and settings tab.
2. Next to the User provisioning plugin, click Enable.
3. Choose the events you want to sync.
The User Provisioning Plugin is configured, new hires will be automatically provisioned in JumpCloud, and terminated accounts will be suspended.
Any HR fields that change on Deel will be synced.
If you want users to be provisioned as Active immediately, you need to update this setting in JumpCloud.
On JumpCloud, go to Users > Settings > Default User State for User Creation and change from Staged to Active.
Filtering by custom field
In addition to filtering by worker type, admins can restrict auto-provisioning to workers matching a specific Deel custom field and value under Apps and Automation → App Store → Integration Overview → Plugins and Settings → User Provisioning and sync settings → Filter by custom field.
Only text and list custom fields are supported. date, multiselect, currency, and percentage fields are excluded because their values can't be matched reliably. Matching is exact and case-sensitive, and it applies only to the auto-provisioning step (account creation), not to sync or deprovisioning. Workers who don't have the selected field set on their profile are simply skipped. They will not be auto-provisioned until the field is set or the filter is removed.
This filter is combined with the worker-type filter using AND logic, and it is not available when Identity Enhanced is enabled for the connection. The whole provisioning drawer (including this control) is hidden in that case, and any previously stored custom-field filter is cleared automatically when Identity Enhanced is turned on.
Configure the Dynamic Groups Plugin
This plugin enables advanced group management by syncing Deel's dynamic groups to JumpCloud. With it you can:
- Create granular dynamic groups with custom membership rules
- Automatically sync group memberships between platforms
- Apply specific access rules or applications to synced groups
To set up Dynamic Group Syncing:
1. From the JumpCloud integration page, go to the Plugins and settings tab.
2. Click Dynamic groups syncing.
3. On the Dynamic groups syncing page, click Create dynamic group.
4. After creating dynamic groups, click Add dynamic group(s) and choose one or more groups.
5. Enter a unique group email address for each group.
6. Click Add and Sync to create these groups in JumpCloud.
7. Use View details to go to the User Groups page in JumpCloud.
The Dynamic groups syncing plugin is configured. As workers are added or removed from these groups in Deel, it will be reflected in JumpCloud.
Step 4. Sync data manually
Automatic syncs happen in near real time, but you can trigger manual syncs:
- If you’ve made important changes and need them to sync immediately
- If you notice missing data or errors, that suggests that the last sync didn’t complete correctly
To sync data manually:
1. In the left sidebar, expand Apps & Automation and select App Store.
2. Search for JumpCloud in Find apps, then select the JumpCloud result.
3. On the integration page, click Sync JumpCloud to start an immediate sync.
If you see Connect JumpCloud instead, the integration is not connected and a manual sync is not available. Complete Step 2 first.
4. Wait for Deel to display the sync confirmation. Do not click Sync JumpCloud again while confirmation is pending.
If you see Your authentication is invalid, click Reconnect JumpCloud to open the API-key authorization form. If Connect JumpCloud is shown instead, click it to open the equivalent form. Enter a valid API Key, click Connect & go to settings, then return to the connected integration and run the sync.
Recent changes in employee data will be synced from Deel to JumpCloud.
JumpCloud Integration Reference
This section provides information about the capabilities and limitations of the integration. You can use it to understand whether the integration can sync the data you need to sync.
Supported Contract Types
The JumpCloud integration supports the following contract types:
- Independent contractor
- Employer of record (EOR)
- Global payroll
- Professional employer organization (PEO)
- Worker Profile without a Contract (PWAC)
Supported sync fields
The JumpCloud integration supports the sync of the following fields:
| Mapped from Deel | Description | Mapped by default? |
|---|---|---|
| First Name | Worker’s legal first name | Yes, to First Name |
| Middle Name | Worker’s legal middle name | No |
| Last Name | Worker’s legal last name | Yes, to Last Name |
| Department | The department the worker belongs to | Yes, to Department |
| Username | The first part of the worker’s work email (before the @ symbol) | Mandatory, to Username |
| Work Email | The worker's primary email | Mandatory, to Primary Email |
| Display Name | Worker’s display name | No |
| Company Email | Worker’s work email address | No |
| Employee ID | Worker’s identifier | No |
| Job Title | Worker’s official job title | Yes, to Job Title |
| Worker Type | Worker's type of employment | Yes, to Employee Type |
| Company | Company linked to the worker | No |
| Legal Entity Name | Cost center linked to the worker | Yes, to Cost Center |
| Location | Worker's location | No |
| Work Phone | Worker’s work phone number | No |
| Work Address | Worker’s work address | No |
| Home Phone | Worker’s home phone number | No |
| Home Address | Worker’s home address | No |
| Birth Date | Worker’s date of birth | No |
| Direct Manager Work Email | Work email of the worker's direct manager | No |
| Direct Report Work Email(s) | Work email(s) of the worker’s direct reports | No |
| End Date | Worker’s employment end date | No |
| External ID | External identifier for the worker | No |
| Full Name | Worker’s full name | No |
| Nationalities | Worker’s nationalities | No |
| Number of Direct Reports | Number of direct reports under the worker | No |
| Personal Email | Worker’s personal email | No |
| Preferred First Name | Worker’s preferred first name | No |
| Preferred Last Name | Worker’s preferred last name | No |
| Seniority | Worker’s seniority level | No |
| Start Date | Worker’s employment start date | No |
| Time Zone | Worker’s time zone | No |
| Worker Country | Country where the worker is based | No |
| Worker ID | Worker’s unique identifier | No |
| Worker Status | Worker’s current status | No |
Frequently Asked Questions (FAQs)
Why isn't JumpCloud creating profiles for some of my Deel workers?
Workers who existed before the provisioning or integration was set up won't be created automatically. You can fix this in one of two ways:
- Manually: go to the worker's profile in Deel, click Apps, click JumpCloud, then click Provision.
- Upload the missing workers into JumpCloud directly. Once their profiles are created in JumpCloud, Deel will match them automatically.
Also make sure there are no duplicate names with the same first and last name, because JumpCloud creates usernames in the format firstName.lastName. Make sure the API key hasn't been rotated. Finally, check the provisioning settings and make sure you aren't filtering out certain worker types from being provisioned in JumpCloud.
If a worker's details are changed, how often will the changes sync in JumpCloud?
Profile changes, new user additions, and terminations sync to JumpCloud in near real time automatically.
Why are some workers not syncing?
Confirm that the worker's personal email and work email were entered correctly when the profile was created in Deel. If either is missing or incorrect, the integration won't work properly for that worker.
How often will the integration sync?
Automatic syncs happen in near real time.
If a worker is terminated, what happens to their JumpCloud profile?
When a worker is terminated in Deel, their user state in JumpCloud changes to Suspended during the next sync.
A user state in JumpCloud can change from Staged to Active, from Active to Suspended, and from Suspended to Active. Staged users can't receive emails. A user state can't be changed back to Staged once it has been activated.
What does this integration use for setting up SSO?
Currently, this integration only includes SCIM provisioning and de-provisioning.
Any client can use the generic SAML 2.0 connector base to set up SSO, including with JumpCloud.
Can I map Deel fields to custom JumpCloud attributes?
Yes, for all organizations. In the field mapping table, type a new name in the JumpCloud dropdown and select Add {name}. Only text-type Deel fields can be mapped.
What happens if I delete a custom attribute mapping?
The attribute is removed from every user in scope when you save, with no confirmation. The name stays managed by Deel, so a hand-made attribute with that name is also removed.
Can Deel see the custom attributes we already have in JumpCloud?
No. JumpCloud doesn't offer a way to list them, so type the attribute name exactly as it should appear.
Troubleshooting
| Problem | Did you try? | How to fix |
|---|---|---|
| A custom attribute disappeared from all users | Checking whether the mapping was deleted | This is expected after a deletion. Recreate the mapping with the same name. |
| A custom attribute is missing for one user | Checking the provisioning event log | Check the event log. The next sync retries the write. |