Through the Vanta and JumpCloud SCIM integration, you can use JumpCloud to manage your employees’ sign-in access to Vanta. The instructions in this article are specifically for configuring SCIM. This setup does not create personnel records on the People page or import devices into Vanta.

Step 1: Enable SCIM in Vanta

Open the Vanta console and click the gear icon on the top right corner
Then click the Login and Security option on the left hand menu
Scroll down to the User provisioning section and check Enable automatic provisioning. Then select Provision via SCIM to enable SCIM for your account, and click Apply to save the changes
You’ll see a message explaining that any users who cannot be provisioned through SCIM will need to be managed manually. This means that if a user is not in your SCIM directory, you’ll need to add or remove them from the Users & Permissions page to control their access to Vanta. Click Enable to continue:
Next right click and open the View the Admin Portal in a new tab
Search for JumpCloud and select it from the Select your identity provider drop-down menu. This will take you to a page with instructions on how to configure your Jumpcloud Application:
Do not close this tab, we will be configuring an application in JumpCloud next and will need values from the Admin portal for said application.

Step 2: Enable Provisioning on your Application

You need to have an existing application. If you haven’t created an application, you’ll need to first create a custom SAML application in JumpCloud. JumpCloud only supports configuring SCIM provisioning in an existing SAML application

Go to your application, select the Provisioning tab
Next go back to the WorkOS Admin portal tab and move on to step 2. You will be presented with your base url and token key. You will copy these and paste these into the appropriate fields in JumpCloud:
Copy the values from the WorkOS Admin Portal, then head back to JumpCloud and scroll down to Configuration Settings. Under API Type, select SCIM API, then paste the WorkOS values into their corresponding fields.

Next, scroll down to the Test User Email field and enter an email you can use for testing. Then do the same for the Test User Group Name, Source User, and Source User Group fields.
Click Test Connection.
- You should see a message that says, “Connection successful. Follow the next steps to finalize the integration.”nIf you do not see this message, double-check that the values you entered are correct.

Step 3: Configure Custom Attribute

You can use a custom attribute in JumpCloud to automatically assign Vanta roles based on the JumpCloud groups a user belongs to.This step is optional.

If you prefer, you can just import the groups and handle the role mapping later in WorkOS instead. You can skip this step if you plan to use that method.

Scroll down to go to Export Attribute Mapping section and then click the drop down menu.

Click the Edit button
Scroll down and select +Add Attribute:
Then select expression:
On the SCIM Attribute column click the box and select Custom User Attribute:
Enter the role of the custom attribute
- We will use rbac_role_id for this example but you can name it whatever you like:

For the JumpCloud Attribute box you will enter a modified version of this expression:
```
isMemberOfAny(jcGroups, "GROUP_ONE") ? "RBAC_ROLE_VALUE" :
isMemberOfAny(jcGroups, "GROUP_TWO") ? "RBAC_ROLE_VALUE" :
isMemberOfAny(jcGroups, "GROUP_THREE") ? "RBAC_ROLE_VALUE" :
"0000005ddeface0000000003"
```
- JumpCloud reads the expression from top to bottom and uses the first group the user matches. So if someone belongs to multiple groups, whichever group is listed first will take priority.
- Replace GROUP_ONE, GROUP_TWO, and GROUP_THREE in the expression above with your actual JumpCloud group names. We recommend organizing the groups based on the role users should have in Vanta, for example one group for Admins, another for Editors, and so on.
- Replace each RBAC_ROLE_VALUE with the correct Vanta role value. You can find these under Login and Security → User provisioning → Roles in Vanta.
- For example this expression below:
```
isMemberOfAny(jcGroups, "CHRIS_SCIM_ADMIN") ? "0000005ddeface0000000001" : isMemberOfAny(jcGroups, "CHRIS_SCIM_EDITORS") ? "0000005ddeface0000000002" : "0000005ddeface0000000003"
```
  Anybody in the CHRIS_SCIM_ADMIN is assigned the Vanta Admin role. Anyone in the CHRIS_SCIM_EDITORS is assigned the Vanta Editor role. Anyone who does not match either group is assigned the Vanta Employee role.
Click Update once you have pasted your expression in

Step 4: Assigning SCIM application in JumpCloud

You can now add your User Assignments for SCIM Provisioning:

Select the User Groups tab and then click the checkbox to assign the app to your desired groups and hit save once complete.
- If you chose not to set up a custom attribute, you’ll need to select the JumpCloud groups you want to map to each Vanta role. We recommend organizing the groups based on the access users should have in Vanta, for example one group for Admins, another for Editors, and so on.

Next head back to WorkOS and click Continue

Step 5: Select Custom RBAC Attribute

If you did not configure a custom attribute continue to step 6. If you did setup a custom attribute please continue.

On step 4 of WorkOS, select the dropdown menu on the Directory provider value field, and look for the custom attribute you created earlier:
Once selected, click continue to move on to step 6

Step 6: Map Groups to Roles in Admin Portal

WorkOS allows you to map the groups synced from JumpCloud to specific roles in Vanta. Click continue to skip this step if you are using a custom attribute.
If you chose not to set up a custom attribute, you’ll need to map the Vanta roles to the groups synced from JumpCloud. This method does not support custom Vanta roles.
Click continue to move on to the next step after you complete your mapping.

Step 7: Sync your Directory Connection

Click the start sync button to finish the setup of SCIM

Connecting Vanta & JumpCloud (SCIM)