JumpCloud

Proofroom reads JumpCloud with an administrator’s API key and files four kinds of evidence. Add it on Integrations → Catalogue → JumpCloud → Connect.

What each collector shows

Collector	Kind	Default cadence	What it shows	Suggested controls
Users with MFA status	snapshot	quarterly	Every active user and the MFA methods they are enrolled in (TOTP, WebAuthn, push, SMS, JumpCloud Go). Users in an MFA exclusion are marked with its end date; a user with no MFA data reads as unknown.	PCI DSS 8.4.2, 8.4.3; SOC 2 CC6.1
Admin and privileged roles	snapshot	quarterly	Every JumpCloud administrator and their role.	PCI DSS 7.2.1, 7.2.2, 7.2.4; SOC 2 CC6.2, CC6.3
Leaver removals	window	monthly	Users suspended or deleted in the window, and deletions in connected apps by JumpCloud’s provisioning, from Directory Insights, with the administrator who did it and whether it succeeded. With a People directory source, each leaver’s removal is measured against their leave date (leaver lag).	PCI DSS 8.2.5; SOC 2 CC6.2
Inactive accounts	snapshot	quarterly	Every user JumpCloud holds (staged, locked and suspended ones labelled), with their newest sign-in in the last 90 days from Directory Insights, and those with none.	PCI DSS 8.2.6; SOC 2 CC6.2

JumpCloud administrators are separate accounts from users, so the MFA evidence shows administrator status as unknown; administrators are listed in the second collector.

Create the API key

An administrator with Billing enables API access for the administrator Proofroom will use (Settings → Administrators).
Give that administrator the Read Only role: it can read users and administrators and query Directory Insights.
Signed in as that administrator, open the account menu → My API Key, and generate the key. It is shown once.
Directory Insights must be enabled for your organisation, or Leaver removals and Inactive accounts fail with JumpCloud’s message. The Read Only role may query it.

Proofroom never writes to JumpCloud.

Connect

Field	Value
API key	From step 3
Region	`us`, `eu` or `in`, where your organisation is hosted
Organisation ID	Only for a multi-tenant (MSP) key

Test connection calls users, administrators and Directory Insights and names any that is refused.

Known limits

The administrators list comes from the endpoint JumpCloud’s own PowerShell module uses (Get-JCAdmin); JumpCloud does not document it, so a change on its side fails the run with a message.
Directory Insights keeps 90 days, so Leaver removals runs monthly by default; keep it at 90 days or less.
MFA exclusions. mfa.exclusion with mfa.exclusionUntil is the enrolment grace period JumpCloud gives when MFA is required or reset: until that date the user may sign in without MFA. Such users are marked “excluded from MFA until ” and named in the notes.
Inactive accounts. JumpCloud keeps no last sign-in on users, so Proofroom reads Directory Insights’ last 90 days and takes each user’s newest successful sign-in among: SSO apps (sso_auth), the User Portal (user_login_attempt), LDAP (ldap_bind), RADIUS (radius_auth) and devices with the JumpCloud agent (login_attempt). A user shown as never signed in has none of those in the 90 days; earlier sign-ins cannot be seen, and sign-ins to apps that do not go through JumpCloud are not counted. Users are matched by username or email. Before reading, Proofroom checks that Directory Insights holds events from the start of the 90 days (free accounts see only 15); if not, the run fails rather than overstate inactivity. Which field names the user on user_login_attempt and whether sso_auth events carry a success flag are UNVERIFIED (Proofroom checks every user field the event has, and counts an event without a success flag as a sign-in). Filtering by event type on JumpCloud’s side uses the documented search_term form; it is UNVERIFIED against a live organisation.
Leaver removals lists user_delete_provision events (JumpCloud deleting the user in a connected app through provisioning). Leaver lag counts only the JumpCloud account’s own suspension or deletion.

Credential expiry

An administrator’s API key may expire: JumpCloud offers 30, 60 or 90 days, a custom period or no expiry, and keys made since 15 July 2024 expire after 90 days by default. JumpCloud offers no API that reads a key’s expiry, so the integration page shows a note instead of a date. Check the key’s expiry under your account menu → My API Key; JumpCloud emails the administrator each day for the 7 days before it expires.