> For the complete documentation index, see [llms.txt](https://docs.threatdefence.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.threatdefence.com/siem-integrations/sso-and-identity/jumpcloud.md).

# JumpCloud

By integrating **JumpCloud** with **ThreatDefence** via JumpCloud's API and event logging capabilities, you can stream identity, access, and device-related events directly into ThreatDefence for comprehensive visibility and centralized security monitoring.

This integration enables ThreatDefence to track:

* User authentication
* Directory changes
* Policy enforcement
* Endpoint activity

By correlating this with other security data, ThreatDefence supports Zero Trust access control, enhances threat detection, and accelerates incident response.

{% hint style="info" %}
**Before you begin:**

* Only an admin with the **Billing** role can enable API access and generate an API key. API access is disabled for admins by default — if you see "You don't have permission to view or generate an API Key", ask a Billing admin to enable it for you.
* The API key inherits the permissions of the admin who created it, so generate it from an account that can see the organisations and data you want ThreatDefence to collect.
* If your account is managed through the **Multi-Tenant Portal (MTP)** or your admin has access to more than one JumpCloud organisation, also collect the **Organization ID** (see Step 2).
  {% endhint %}

***

## Step 1. Generate API Key

1. On your JumpCloud dashboard, click your **account initials** in the top-right corner.
2. Navigate to **My API Key**.
3. Select **Generate New API Key** and store the value in a secure location.

{% hint style="warning" %}
The API key is displayed **only once** at creation, and generating a new key **revokes all previous keys** - any other integration using the old key will stop working. New keys default to a **90-day expiry**, so note the expiry date and plan to rotate the key in ThreatDefence before it lapses.
{% endhint %}

***

## Step 2. Retrieve your Organization ID (optional)

The **Organization ID** tells the JumpCloud API which organisation's data to return. It is sent as the `x-org-id` header on each request.

* **Single organisation** — leave this blank. The API key already resolves to your only organisation, and no Organization ID is needed.
* **Multiple organisations (MSP / Multi-Tenant Portal)** — provide the Organization ID of the tenant you want ThreatDefence to collect from. Without it, requests made with a key that can see several organisations are ambiguous and may not return the expected data.

To find it:

1. In the JumpCloud Admin Portal, go to **Settings → Organization Profile → General**.
2. Locate **Organization ID**, click the **eye** icon to reveal the full value, then click the **copy** icon to copy it.

{% hint style="info" %}
Reference: [Settings in the Admin Portal](https://jumpcloud.com/support/settings-in-admin-portal)
{% endhint %}

***

### Onboarding the integration <a href="#onboarding-the-integration" id="onboarding-the-integration"></a>

Please follow the [Managing Integrations](https://file+.vscode-resource.vscode-cdn.net/home/donkushan/Documents/Frontend/gitbook/platform-management/managing-integrations.md) instructions and onboard the integration. The credentials saved above are required in this process.

If you encounter difficulties with onboarding, please email the following credentials to <support@threatdefence.com>

* API Key
* Organization ID — only if your admin account has access to more than one JumpCloud organisation


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.threatdefence.com/siem-integrations/sso-and-identity/jumpcloud.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.