> For the complete documentation index, see [llms.txt](https://support.suptask.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.suptask.com/integrations-automations-and-workflows/integration-guides/jumpcloud.md).

# JumpCloud

Integrate with JumpCloud and manage users, devices and groups from tickets directly

The JumpCloud connector links Suptask to your JumpCloud organization. Once connected, the AI Assistant on an Inbox can look up users, devices, groups and applications — and, depending on the tools you enable, reset passwords, unlock accounts, manage group membership and run device actions directly from a ticket in Slack.

JumpCloud is connected natively through its MCP Server for admins. There is no app registration and no API key to create: you pick your JumpCloud region, click **Authorize**, sign in to JumpCloud, and approve access.

{% hint style="info" %}
You set up this connector in the Suptask Web App as an admin under Intelligence. Your agents then use it from Slack while working on tickets.
{% endhint %}

***

### What you can use it for

* **Answer identity questions from a ticket** — an agent asks whether the requester's account is locked, which groups they belong to, or when their password expires, without leaving Slack.
* **Resolve access requests** — a user asks for access to an application, the Assistant finds the right user group and adds them, with an agent approving the change.
* **Handle account issues** — unlock a locked-out user, send a password reset, or reset MFA from the ticket thread.
* **Run device actions** — lock, restart or shut down a device from the ticket, with an agent approving each action.
* **Enrich tickets with directory context** — attach the requester's department, manager, devices or group memberships to the ticket automatically.
* **Close the loop on IT requests** — the ticket, the action and the audit trail all stay connected.

***

### Before you begin

You'll need:

* An **admin** role in Suptask.
* A **JumpCloud** organization with **MCP Server for admins** turned on. See [Step 1](/integrations-automations-and-workflows/integration-guides/jumpcloud.md#step-1-turn-on-the-mcp-server-in-jumpcloud).
* A JumpCloud administrator with the permissions you want the Assistant to have. The connector acts as the admin who authorizes it — see [How permissions work](/integrations-automations-and-workflows/integration-guides/jumpcloud.md#how-permissions-work).
* Knowing which **JumpCloud region** your organization is hosted in — **US** (console.jumpcloud.com) or **EU** (console.eu.jumpcloud.com).
* The **Inbox** you want to connect JumpCloud to.

What you'll do:

* Turn on the MCP Server for admins in JumpCloud
* Add the JumpCloud connector on your Inbox and pick your region
* Authorize with JumpCloud using OAuth
* Choose which tools your Assistant may use

***

### Step 1: Turn on the MCP Server in JumpCloud

JumpCloud's MCP Server is off by default. An admin needs to enable it once for the organization:

1. Log in to the **JumpCloud Admin Portal** for your region.
2. In the left menu, click **Settings**.
3. Open the **JumpCloud AI** tab.
4. Toggle on **MCP Server for admins**.

{% hint style="info" %}
Already using JumpCloud's MCP Server with another AI tool? Then this is already done — skip to Step 2.
{% endhint %}

***

### Step 2: Connect JumpCloud in Suptask

1. In the Suptask Web App, open the **Inbox** you want to connect JumpCloud to.
2. Go to the **AI Assistant** settings and open **Connectors**.
3. Add the **JumpCloud** connector.
4. Select your **region** — **JumpCloud Global (US)** or **JumpCloud EU**. This must match where your JumpCloud organization is hosted.
5. Click **Authorize**.
6. A JumpCloud sign-in window opens. Sign in with the JumpCloud administrator you want the Assistant to act as, review the requested access, and click **Approve and continue**.

When it's done, the connector status changes to **Connected**.

{% hint style="info" %}
No Client ID, Client Secret or redirect URL is needed. JumpCloud is a native MCP connector — the entire setup is choosing the region and approving the OAuth request.
{% endhint %}

{% hint style="warning" %}
Not sure which region you're in? Check the URL you use to log in to JumpCloud. console.jumpcloud.com is US; console.eu.jumpcloud.com is EU. Picking the wrong region means the sign-in window won't find your organization.
{% endhint %}

***

### Step 3: Choose which tools your Assistant may use

The connector provides a set of **tools** to the AI Assistant. Each tool can be set individually, so you can let the Assistant read your directory without allowing it to change anything.

Each tool can be set to:

* **Auto** — the Assistant uses the tool on its own when it's relevant.
* **Ask** — the Assistant prepares the action and pauses for an agent to approve before it runs.
* **Off** — the Assistant can't use the tool at all.

{% hint style="info" %}
A common setup is Auto for every read tool and Ask for every write tool. That gives agents instant answers while keeping a human in the loop before an account is changed or a device is touched.
{% endhint %}

{% hint style="warning" %}
JumpCloud also exposes destructive tools such as erasing devices and deleting users. We recommend leaving these on Off unless a specific Inbox needs them — and never on Auto.
{% endhint %}

***

### How permissions work

The connector inherits the permissions of the JumpCloud administrator who authorized it. It cannot grant access that the admin account doesn't already have.

* If the authorizing admin can't reset a password in the Admin Portal, the Assistant can't either.
* The Assistant only sees the users, devices and groups that the admin account already has access to.
* Tool settings in Suptask sit **inside** those permissions. They can restrict what the Assistant does, never expand it.

{% hint style="warning" %}
Authorize with an admin role that has the right scope — no more. If you authorize with a full administrator, every tool set to Auto runs with full administrator rights in JumpCloud. Consider a dedicated admin with a narrower role, such as Help Desk, for the Inbox.
{% endhint %}

***

### Use different JumpCloud access per Inbox

Each Inbox in Suptask has its own connector, so different teams can work against JumpCloud in different ways:

* **IT Helpdesk Inbox** — read users and devices, unlock and password reset on **Ask**.
* **Security Inbox** — read directory events and alerts, suspend users and lock devices on **Ask**.
* **HR Inbox** — read users and groups only, all write tools **Off**.

A ticket in one Inbox only reaches the tools enabled on that Inbox's connector. To separate access fully, authorize each Inbox with a different JumpCloud admin.

***

### How to use the integration

The connector is used by the AI Assistants you set up in Suptask. Agents work with it in Slack, from inside the ticket.

Examples of what an agent can ask in a ticket thread:

```
@Suptask is the requester's JumpCloud account locked?
```

```
@Suptask which user groups is this person in?
```

```
@Suptask add the requester to the Figma Users group
```

```
@Suptask send a password reset email to the requester
```

When a tool is set to **Ask**, the Assistant posts the prepared action in the ticket and waits for an agent to approve it before running.

{% content-ref url="/pages/EMXzCysY1oz2JPFXI8gH" %}
[AI Assistants](/suptask-ai/ai-assistants.md)
{% endcontent-ref %}

***

### Auditing and revoking access

Everything the Assistant does in JumpCloud is recorded in **Directory Insights**, alongside actions taken in the Admin Portal. Filter on **User Agent Name** to see MCP-originated events.

In JumpCloud, under **Settings → JumpCloud AI → MCP Server for admins → Connected OAuth clients**, click **Manage** to see every AI client connected to your organization — including who authorized it, when it was last used, and when it auto-revokes. Click **Revoke** next to the Suptask session to cut off access immediately. The connector stops working until it's authorized again.

{% hint style="info" %}
JumpCloud automatically expires MCP sessions after the period set under Auto revoke access (for example, 30 days). When that happens, the connector needs to be re-authorized in Suptask. Set the period to match how often you want to re-approve the connection.
{% endhint %}

***

### Troubleshooting

* **Authorization window can't find my organization** — the wrong region is selected. Remove the connector, add it again with the region that matches your JumpCloud login URL, and authorize.
* **Authorization fails with an error about MCP** — **MCP Server for admins** isn't turned on under **Settings → JumpCloud AI**. See Step 1.
* **The Assistant can't find a user or device** — the authorizing JumpCloud admin doesn't have access to it, or it belongs to a different organization than the one you connected.
* **The Assistant can read but won't make changes** — the write tool is set to **Off**, or it's set to **Ask** and is waiting for an agent to approve. Check the tool settings on the Assistant.
* **JumpCloud denies an action the tool allows** — the authorizing admin's role lacks that permission in JumpCloud. Tool settings in Suptask can't grant access the account doesn't have.
* **It worked before and stopped** — the session reached its **Auto revoke access** limit, was revoked from **Connected OAuth clients**, or the authorizing admin was removed. Re-authorize the connector.
* **A tool disappeared or changed name** — JumpCloud's MCP tool list evolves over time. Reopen the connector to review the current tools and their settings.

***

### Need help?

Reach out to [Suptask Support](/getting-started/contact-support.md) and our team will help you connect JumpCloud.