Skip to main content

JumpCloud device attribution

Willow can attribute each scanned device to the employee who owns it by reading device ownership from JumpCloud with a read-only service account.

Most MDMs inject the enrolled user's email into the Scan Agent's configuration profile, so the agent already knows who owns the machine. JumpCloud cannot substitute directory variables into a profile, so its devices arrive in AI Discovery with no user attached. This integration closes that gap: Willow reads each JumpCloud system's serial number and primary system user email and links them to the device Willow already scanned with the matching serial.

How it works​

  • Willow authenticates to JumpCloud with a service account (OAuth client credentials) and calls the JumpCloud API read-only.
  • For every JumpCloud system it reads the serial number and the primary system user's email. JumpCloud often returns the primary user as an ID only. When it does, Willow looks the ID up through the JumpCloud system users API to get the email, so a system with an ID-only primary user is still attributed.
  • Each pair is matched to the scanned Willow device with the same hardware serial, and that device is attributed to the matching Willow user.
  • Nothing is created in JumpCloud, and a JumpCloud system Willow has never scanned is skipped — there is no device to attribute yet.

Attribution runs two ways:

  • Sync now — an on-demand full sweep you trigger from AI Discovery Settings.
  • On new devices — best-effort as each new device is scanned, so a machine enrolled after your last sync is attributed without waiting for the next one.

There is no background schedule; run Sync now whenever you want to reconcile the whole fleet.

Prerequisites​

  • A JumpCloud administrator with the Billing privilege — only that role can create a service account.
  • Permission to create a custom admin role (for least-privilege access).
  • The Willow Scan Agent already deployed to your JumpCloud devices. See Deploy with JumpCloud.

Step 1: Create a read-only admin role​

Grant the service account only what Willow needs to read.

  1. In the JumpCloud Admin Portal, go to Settings → Administrators → Admin Roles.

  2. Create a new custom role, for example Willow Read-Only.

  3. Set these permissions:

    AreaAccess
    User ManagementView only
    Device ManagementView only
    Everything elseNo access

  4. Save the role.

Step 2: Create the service account​

  1. Go to Settings → API & Service Accounts → Service Accounts.
  2. Create a new service account and bind it to the Willow Read-Only role from Step 1.
  3. Generate its credentials and copy the Client ID and Client Secret. The secret is shown only once — store it securely until you paste it into Willow.
  4. If you set an expiration on the secret, note the date so you can rotate it before it lapses.

Step 3: Find your Organization ID​

  1. In the Admin Portal, open Settings.
  2. Copy the Organization ID (also shown in the portal URL). Willow needs it to scope API calls to your tenant.

Step 4: Enter the credentials in Willow​

  1. In Willow, go to AI Discovery > Settings.
  2. In the JumpCloud card, turn on the integration.
  3. Enter the Client ID, Client Secret, and JumpCloud Organization ID.
  4. Select Test connection to confirm Willow can reach JumpCloud with the credentials.
  5. Select Save. The client secret is stored encrypted at rest and is never shown again — leave the field blank on future edits to keep it, or type a new value to rotate it.

Step 5: Run the first sync​

Select Sync now. Willow reads every JumpCloud system and attributes the devices it can match by serial. The card shows the time of the last sync and how many devices were attributed. After this, new devices are attributed best-effort as they are scanned.

See why a device is not attributed​

Select Diagnose next to Sync now to run a read-only check. It needs the integration turned on and a saved client secret, and it changes nothing. The report shows what JumpCloud returned (systems, how many have a serial, a primary user, and a primary user email) and what Willow has (devices, devices with a serial, devices with a user). It then lists each Willow device with the outcome a sync would give it. Select an outcome badge to filter the list.

OutcomeMeaning
Would link / Already linkedThe sync attaches the JumpCloud primary user, or the device already has them.
No serialWillow has no serial number for the device.
Duplicate serialSeveral Willow devices share the serial, so the sync skips it.
Not in JumpCloudNo JumpCloud system has this serial.
No primary userThe JumpCloud system has no primary user assigned.
Primary user, no emailJumpCloud returned the primary user without an email.
No Willow userThe primary user's email matches no Willow user.

A collapsed list at the bottom shows JumpCloud systems with no matching Willow device, usually machines where the Scan Agent is not installed yet.

Security​

  • The service account is read-only and limited to User and Device management by the custom role in Step 1.
  • The client secret is encrypted at rest with your organization's key.
  • Rotate the secret periodically. Generate a new one in JumpCloud, paste it into the Client Secret field, and save.

Troubleshooting​

SymptomCheck
Test connection failsRe-check the Client ID, Client Secret, and Organization ID. Confirm the service account is bound to a role with view access to Users and Devices.
Sync succeeds but no devices are attributedConfirm the devices have been scanned by Willow and report a serial number, and that the JumpCloud systems have a primary system user with an email that matches a Willow user.
A device is still unassignedIts serial may not match any scanned device, may be shared by several devices (ambiguous), or its JumpCloud primary user email may not correspond to a Willow user.
On this page