Set up JumpCloud SSO (and optional SCIM) for Hyperbound

Let your team sign in to Hyperbound with their JumpCloud accounts using SAML 2.0. Once single sign-on works, you can also turn on SCIM so people are added to and removed from Hyperbound automatically.

Before you start

• Get your setup link. Your Hyperbound account team sends a secure link that starts with https://auth.hyperbound.ai/setup_saml/. It's unique to your workspace and shows the exact values you'll copy. Links expire, so if yours opens a sign-in or home page, ask for a new one.

• Decide who gets access. Anyone you assign to the Hyperbound app in JumpCloud can sign in, and is added to your workspace (and counts toward your licensed seats) the first time they do. Assign a specific group, not everyone.

• Check your email domains. Your workspace is linked to your company's email domain. If some people use another domain, for example from an acquired company, tell your account team before you start.

• Use one email everywhere. People are matched by email, so each person's email should be the same one they use in your call recorders (Gong, Zoom and others).

Part 1: Set up single sign-on

Step 1: Open your setup link

Open the link from your account team and choose JumpCloud. Keep the tab open: you'll copy values from it into JumpCloud, and paste values from JumpCloud back into it.

Step 2: Create the Hyperbound app in JumpCloud

JumpCloud's labels change a little between console versions. If one doesn't match, the JumpCloud guide inside your setup link shows the current screens.

1. In the JumpCloud Admin Portal, go to SSO Applications, click Add New Application, and choose Custom Application with single sign-on through SAML. Name it Hyperbound.

2. On the SSO tab, fill in these fields:

   JumpCloud field	Value
   IdP Entity ID	A unique value of your choice, e.g. jumpcloud-hyperbound
   SP Entity ID	Audience URI / SP Entity ID from your setup guide
   ACS URL	Single sign-on URL from your setup guide
   SAMLSubject NameID	email
   SAMLSubject NameID Format	urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
   Signature	Sign the assertion

3. Under Attributes, add these, then save:

   Service provider attribute name	JumpCloud attribute
   email	email
   first_name	firstname
   last_name	lastname

Step 3: Give Hyperbound your JumpCloud details

Copy each value into its own field in your setup guide:

Step 4: Assign people

On the app's User Groups tab, bind the group that should use Hyperbound, and save.

Step 5: Test the connection

In your setup guide, click Test Connection and sign in as someone who's assigned to the app. They don't need a Hyperbound account yet.

Step 6: Go live

When the test succeeds, click Finish & Go Live in your setup guide.

How your team signs in

• From JumpCloud: click the Hyperbound app in the JumpCloud User Portal.

• From Hyperbound: go to app.hyperbound.ai, type your work email, and you're sent to JumpCloud to sign in.

• Adding people later: assign them in JumpCloud. They don't need an invitation from Hyperbound, and email invitations shouldn't be sent to people who sign in with single sign-on.

Part 2: Automatic provisioning with SCIM (optional)

With SCIM, Hyperbound stays in sync with JumpCloud:

• People you assign in JumpCloud get a Hyperbound account right away.

• Profile changes in JumpCloud update Hyperbound.

• People you unassign or deactivate in JumpCloud are blocked from Hyperbound and signed out.

Step 1: Get your SCIM details

Open the SCIM step in your setup guide. It shows a SCIM base URL and a secret token. Store the token somewhere safe.

Step 2: Connect JumpCloud to Hyperbound

1. In the same JumpCloud application, open the Identity Management tab and choose SCIM 2.0.

2. Paste the base URL and the token (as a bearer token), click Test Connection, then Activate and save.

Check it's working

• Add a test person to the bound group. They should appear in Hyperbound within a few minutes.

• Remove them from the group. They should be blocked from Hyperbound and signed out.

Set roles from JumpCloud (optional)

Everyone starts with the Member role. You can keep managing roles in Hyperbound, or send them from JumpCloud so they follow group membership. Your account team will help you decide which role each group should get.

Send the role as a SAML attribute named role, using the values above. With SCIM on, send it through SCIM as externalRole, as your setup guide shows. Use one method, not both.

Send extra user details (optional)

You can also send details like department, region or manager in a user_attr_metadata field (a JSON string). JumpCloud can send groups as a SAML attribute too, though groups don't create Hyperbound teams by themselves. See How To: Ingest User Attributes From SSO.

Troubleshooting

Still stuck?

Reply in your shared Slack channel or email help@hyperbound.ai with a screenshot, the email of the person who tried to sign in, and the time they tried. We'll check our sign-in logs for that attempt.