Directory & Identity
JumpCloud
Run your JumpCloud directory conversationally - users, groups, devices, SSO apps, policies, commands, and fleet inventory.
Dex connects to the JumpCloud Admin API (v1 and v2) so admins can operate the directory end-to-end - onboard and offboard users, manage user and device groups, assign SSO applications and RADIUS network access, apply policy groups, run and inspect remote commands, and answer fleet questions from System Insights device inventory. Employees can self-serve their own account through Dex Go: unlock a lockout, reset MFA enrollment, expire their own password, and check their groups, devices, and app access. Available as an MSP global app - one shared admin API key, with each Dex tenant confined to its own JumpCloud Organization by a forced x-org-id header, and every by-id call ownership-verified before it is sent.
What Dex does with JumpCloud
Dex handles both admin workflows and employee self-service — all policy-guardrailed and audit-logged.
A
For admins (Dex Pro)
- Onboard, update, suspend, reactivate, and delete directory users - onboarding prefers an activation email so the user sets their own password
- Manage user and device groups, membership, and what they grant, with warnings when membership is dynamic and driven by a query
- Assign SSO applications and RADIUS network access to users and groups - binding a group is the SSO grant
- Inventory and act on devices - read status and encryption, lock, restart, shutdown, erase, or un-enroll a machine
- Answer fleet questions from System Insights - disk encryption, OS versions and patches, installed software, USB devices, and more
- Create and bind remote commands, read command results, and apply policy groups (policy objects are read-only; policy groups are how a policy is applied)
- Manage Active Directory and Google Workspace directory sync, translation rules (with a dry-run preview), and bulk user operations
- Deploy as an MSP global app - one shared admin API key, each customer confined to its JumpCloud Organization by a forced x-org-id header
E
For employees (self-service)
- Clear a failed-login lockout on your own account
- Reset your own MFA enrollment after a new phone or lost authenticator, then re-scan the QR code at next sign-in
- Expire your own password so you choose a new one at next sign-in
- Check your own status, groups, devices, and SSO app access
- Look up your own device inventory - whether it is encrypted, up to date, or has a given app installed
Just ask Dex
Your team types a request in plain language. Dex investigates, plans, and executes — with the right guardrails.
Admin prompts
- >Onboard jane.doe@example.com as a directory user and add her to the Sales group
- >Suspend the account for david.lee@contoso.com and list what he loses access to
- >How many of our devices report FileVault or BitLocker off? Name them.
- >Lock the laptop assigned to alex.kim@acme.com - it was reported stolen
- >Assign the Salesforce SSO app to the Sales user group
Employee prompts
- >I'm locked out of my account - can you unlock it?
- >I got a new phone and my authenticator is broken - reset my MFA
- >Expire my password so I can set a new one
- >Is my laptop encrypted and up to date?
Policy actions
Every action Dex can take on JumpCloud is declared, scoped, and guardrailed. Admins control which apply, who approves them, and whether they're limited to self-service.
| Action | What it does |
|---|---|
jumpcloud_read_user | Read one directory user: status, lockout, MFA enrollment, SSH keys, HR attributes |
jumpcloud_list_users | List directory users in this JumpCloud organization |
jumpcloud_search_users | Search directory users with a multi-condition filter (POST search - a read) |
jumpcloud_password_reset | Set a directory user's password directly |
jumpcloud_expire_password | Expire a user's password so they must choose a new one at next sign-in |
jumpcloud_unlock_user | Clear a failed-login lockout on a user account |
jumpcloud_reset_mfa | Clear a user's MFA enrollment so they can re-enroll (new phone / lost authenticator) |
jumpcloud_enforce_mfa | Require MFA for a user |
jumpcloud_reactivate_user | Reactivate a suspended or deactivated directory user - restores their access |
jumpcloud_manage_sshkeys | Add an SSH public key to a user - grants that key login on every device the user is bound to |
jumpcloud_delete_sshkey | Remove an SSH public key from a user - revokes that key's login on every bound device |
jumpcloud_update_push_endpoint | Change a user's MFA push endpoint - the registered device that approves their push prompts |
jumpcloud_delete_push_endpoint | Remove a user's MFA push endpoint - they must re-enrol before push MFA works again |
jumpcloud_user_associations | Bind or unbind a user to applications, devices, groups, directories or policies - this is how access is granted, and sudo grants local admin |
jumpcloud_create_user | Create a directory user (onboarding) - creates an identity that can sign in |
jumpcloud_update_user | Update a directory user: attributes, suspend/restore, and password fields - carries the same weight as those actions |
jumpcloud_delete_user | Delete a directory user - IRREVERSIBLE: destroys the identity, group memberships, app assignments and device bindings |
jumpcloud_read_group | Read a user group and everything it grants: members, applications, devices, directories, policies |
jumpcloud_list_groups | List user groups |
jumpcloud_list_all_groups | List every group in the organization, user and device groups together |
jumpcloud_group_membership | Add or remove a user from a user group - membership usually carries application and device access |
jumpcloud_group_associations | Bind or unbind a user group to applications, devices, directories or policies |
jumpcloud_group_suggestions | Apply a user group's suggested membership changes in bulk |
jumpcloud_manage_group | Create a user group |
jumpcloud_update_group | Update a user group, including its dynamic membership query |
jumpcloud_delete_group | Delete a user group - removes the access every member held through it |
jumpcloud_read_fdekey | Read a device's FileVault/BitLocker RECOVERY KEY - a credential that unlocks the disk. Only for a user locked out of their own device |
jumpcloud_read_device_access | Read what a device has: bound users, groups, commands, policy compliance, software status |
jumpcloud_read_device | Read one device: OS, agent state, last contact, disk encryption |
jumpcloud_list_devices | List managed devices |
jumpcloud_search_devices | Search managed devices with a multi-condition filter (POST search - a read) |
jumpcloud_lock_device | Lock a device immediately (lost or stolen laptop response) |
jumpcloud_restart_device | Restart a device immediately - interrupts the person using it and loses unsaved work |
jumpcloud_shutdown_device | Shut down a device immediately - interrupts the person using it and loses unsaved work |
jumpcloud_erase_device | ERASE a device - remote wipe. IRREVERSIBLE and destroys all local data. Only for a confirmed lost or stolen device |
jumpcloud_device_associations | Bind or unbind a device to users, user groups, commands or policies |
jumpcloud_update_device | Update a device's display name, tags and SSH/MFA login settings |
jumpcloud_delete_device | Un-enroll a device from JumpCloud - it stops being managed and needs the agent reinstalled to return |
jumpcloud_read_device_group | Read a device group: members, bound users, commands, policies |
jumpcloud_list_device_groups | List device groups |
jumpcloud_device_group_membership | Add or remove a device from a device group - membership carries policies and commands |
jumpcloud_device_group_associations | Bind or unbind a device group to users, user groups, commands or policies |
jumpcloud_device_group_suggestions | Apply a device group's suggested membership changes in bulk |
jumpcloud_manage_device_group | Create a device group |
jumpcloud_update_device_group | Update a device group, including its dynamic membership query |
jumpcloud_delete_device_group | Delete a device group - removes the policies and commands applied through it |
jumpcloud_read_device_inventory | Read System Insights device inventory: disk encryption, installed programs, OS versions and patches, browser extensions, USB devices, logged-in users, WiFi, certificates, startup items, secure boot and TPM |
jumpcloud_read_app_access | Read an SSO application's assignments and its provisioning import state |
jumpcloud_read_application | Read one SSO application's configuration |
jumpcloud_list_app_templates | List the catalog of SSO application connectors JumpCloud offers |
jumpcloud_list_applications | List the SSO applications configured in this organization |
jumpcloud_app_assignment | Assign or unassign an SSO application to a user or user group - this IS the SSO grant |
jumpcloud_app_import | Start an application user-import (provisioning) job |
jumpcloud_manage_application | Create an SSO application from a connector template |
jumpcloud_update_application | Update an SSO application's configuration, including its SAML/OIDC settings |
jumpcloud_delete_application | Delete an SSO application - every user assigned to it loses that access |
jumpcloud_read_policy_group | Read a policy group: its member policies and what it is applied to |
jumpcloud_list_policy_groups | List policy groups |
jumpcloud_list_policy_templates | List the catalog of device-policy templates JumpCloud offers |
jumpcloud_read_policy_results | Read device-policy execution results and compliance state |
jumpcloud_list_policies | List the device policies configured in this organization |
jumpcloud_policy_group_membership | Add or remove a policy from a policy group |
jumpcloud_policy_group_associations | Apply or unapply a policy group to devices, device groups, users or user groups |
jumpcloud_manage_policy_group | Create a policy group |
jumpcloud_update_policy_group | Update a policy group |
jumpcloud_delete_policy_group | Delete a policy group - every device it applied to stops receiving those policies |
jumpcloud_read_command_access | Read which devices and device groups a command is bound to |
jumpcloud_read_command | Read one remote command, including its script text |
jumpcloud_read_command_queue | Read queued command workflows waiting to run |
jumpcloud_read_command_results | Read remote command execution results |
jumpcloud_list_commands | List remote commands defined in this organization |
jumpcloud_search_commands | Search remote commands (POST search - a read) |
jumpcloud_search_command_results | Search command results (POST search - a read) |
jumpcloud_command_associations | Bind or unbind a command to devices or device groups - this is what makes it run there |
jumpcloud_manage_command | Create a remote command - its script runs as root/SYSTEM on every device it is bound to |
jumpcloud_update_command | Edit a remote command's script or targets - the script runs as root/SYSTEM |
jumpcloud_delete_command | Delete a remote command |
jumpcloud_delete_command_result | Delete a stored command result |
jumpcloud_read_software | Read a managed software application and its deployment status per device |
jumpcloud_list_software | List managed software applications |
jumpcloud_software_assignment | Assign or unassign managed software to devices or device groups - this installs or removes it |
jumpcloud_manage_software | Create a managed software application |
jumpcloud_update_software | Update a managed software application's configuration or version |
jumpcloud_delete_software | Delete a managed software application |
jumpcloud_preview_translation_rules | Preview Active Directory translation rules without applying them (a read) |
jumpcloud_read_directory_sync | Read Active Directory integrations: sync agents, translation rules, associations |
jumpcloud_read_gsuite | Read Google Workspace directory integrations and their associations |
jumpcloud_read_ldap | Read the LDAP-as-a-service directories |
jumpcloud_read_workday | Read Workday HR integrations |
jumpcloud_read_duo | Read Duo MFA integrations |
jumpcloud_list_directories | List every directory this organization runs through JumpCloud (LDAP, AD, Google, Office 365) |
jumpcloud_directory_sync_associations | Bind or unbind an Active Directory integration to users or user groups |
jumpcloud_manage_ad_agent | Create an Active Directory sync agent - installs a sync bridge into the customer's AD |
jumpcloud_delete_ad_agent | Delete an Active Directory sync agent - IRREVERSIBLE: stops the sync bridge between the customer's AD and JumpCloud |
jumpcloud_manage_translation_rules | Create or bulk-change Active Directory translation rules, which decide how AD objects map into JumpCloud |
jumpcloud_update_translation_rule | Update one Active Directory translation rule - changes how a set of AD objects maps into JumpCloud |
jumpcloud_delete_translation_rule | Delete one Active Directory translation rule - the AD objects it mapped stop syncing |
jumpcloud_gsuite_associations | Bind or unbind a Google Workspace integration to users or user groups |
jumpcloud_update_gsuite | Update a Google Workspace directory integration |
jumpcloud_manage_directory_sync | Create an Active Directory integration |
jumpcloud_update_directory_sync | Update an Active Directory integration |
jumpcloud_delete_directory_sync | Delete an Active Directory integration - stops syncing that directory |
jumpcloud_read_radius_access | Read RADIUS server associations (network access for WiFi/VPN) |
jumpcloud_read_radius | Read one RADIUS server |
jumpcloud_list_radius | List RADIUS servers |
jumpcloud_radius_associations | Bind or unbind a RADIUS server to users, user groups or device groups - this grants network access |
jumpcloud_manage_radius | Create a RADIUS server |
jumpcloud_update_radius | Update a RADIUS server |
jumpcloud_delete_radius | Delete a RADIUS server - every user or group bound to it loses that network access |
jumpcloud_bulk_read | Read the status of a bulk user job |
jumpcloud_bulk_update_users | Bulk-update directory users - one call changes many identities |
jumpcloud_bulk_create_users | Bulk-create directory users (onboarding at scale) |
jumpcloud_bulk_expire | Bulk-expire user passwords - every named user must change password at next sign-in |
jumpcloud_bulk_unlock | Bulk-clear failed-login lockouts |
jumpcloud_bulk_userstates | Schedule a bulk user state change (activate / suspend / delete) - high blast radius |
jumpcloud_read_auth_policies | Read conditional-access (authentication) policies and their evaluation history |
jumpcloud_evaluate_auth_policies | Read conditional-access policy evaluation summaries and details (POST search - a read) |
jumpcloud_read_ip_lists | Read IP allow/deny lists used by conditional access |
jumpcloud_read_admin_roles | Read the administrator role catalog |
jumpcloud_read_service_accounts | Read service accounts (metadata only - creation and credentials are not available) |
jumpcloud_read_apple_mdm | Read the Apple MDM (ABM/ASM) integration state |
How to configure JumpCloud
Onboarding takes minutes. Dex validates your credentials before saving them.
Setup steps
- 1In the JumpCloud Admin Console, open the user menu (top right) > My API Key and generate an admin API key - it is shown once, so copy it immediately.
- 2For a Multi-Tenant Portal (MSP) key, find each customer's 24-character hexadecimal Organization ID under the organization's Settings > Organization ID, or run GET /api/organizations on the master connection.
- 3Note your console region - us (default), eu, or in - only if the console host is console.eu.jumpcloud.com or console.in.jumpcloud.com.
- 4In Dex, enable the JumpCloud integration and paste the admin API key. Leave organization blank for a standalone single-organization tenant, or set it per customer for an MSP fleet.
- 5Dex validates the key with a live call before saving - a scoped connection proves it can reach that Organization, and a typo in the Organization ID fails at save time.
Credentials required
- api_key
- JumpCloud admin API key (secret) - Admin Console user menu > My API Key. An admin key, not a Connect or system-context key
- organization
- This tenant's 24-character hexadecimal JumpCloud Organization ID (non-secret). Leave blank for a standalone single-organization tenant or the MSP master connection
- region
- Console region: us (default), eu, or in (non-secret). Leave blank unless the console is console.eu.jumpcloud.com or console.in.jumpcloud.com
Requirements
- •A JumpCloud admin API key with a role that covers the actions you enable
- •For MSPs, a Multi-Tenant Portal key with each Dex customer mapped to its own Organization ID - unmapped customers are refused, never answered from another organization
- •System Insights is a paid JumpCloud feature - an empty inventory result means it is not enabled, not that the fleet is clean
- •Command triggering on demand, cross-organization user or device transfers, Apple MDM device commands, and the Directory Insights event log are not available in this integration
Related integrations
Directory & IdentityOkta
Run Okta user, group, and app-assignment operations in natural language.
Learn more →
Directory & IdentityMicrosoft Entra ID
Manage Entra ID users, groups, licenses, and sign-in risk through Microsoft Graph.
Learn more →
Directory & IdentityGoogle Workspace
Run Google Workspace user, group, and org-unit operations in natural language.
Learn more →
See Dex run JumpCloud
Book a 30-minute walkthrough with our team and see how autonomous IT works in your environment — or get started for free.