JumpCloud SSO: what the SSO plan includes, and where the per-user price lands

Short answer: JumpCloud sells SSO as a per-user subscription, not a free feature. The SSO plan is $11 per user per month with annual billing, or $13 month to month, and includes SSO, MFA, password management, a cloud directory and lifecycle management. LDAP and RADIUS are not in that plan; they require the quote-only Platform plans.

That matters because the products people compare JumpCloud with often bundle LDAP, RADIUS and SCIM at no extra per-user cost. The right comparison is the whole bill, not the SSO line item.

What the SSO plan includes

JumpCloud's SSO plan covers the core identity work for a cloud directory:

• SSO for applications that speak SAML or OIDC.
• MFA, including the policies that decide when it is required.
• Password management and a cloud directory of users and groups.
• Lifecycle management, so joiners, movers and leavers can be automated.
• Directory insights, for audit and troubleshooting.

What it does not include is device management or the protocols older infrastructure uses. For those you move up the plan ladder or buy an add-on.

Plans and prices

All prices are per user per month. Annual means annual billing, monthly means month to month.

JumpCloud also sells standalone add-ons: SSO, MFA, LDAP and RADIUS are each $3 per user per month with annual billing, or $4 monthly; device management is $5 or $6. The add-on pricing is useful for understanding the shape of the bill, but the bundled plans are the normal purchase.

There is no ongoing free tier. JumpCloud offers a 30-day trial with full platform access. Billing is monthly in arrears, annual billing saves up to 18%, and invoicing is available above $2,000 per month.

The LDAP and RADIUS surprise

A network device, a NAS, a VPN or an older application that only speaks LDAP or RADIUS cannot use the SSO plan. Those protocols start at the Platform tier, which is quote-only. If your environment includes Wi-Fi controllers, VPN gateways, Linux hosts or appliances, get the Platform quote before comparing JumpCloud with a product that includes LDAP and RADIUS in the base price.

This is the most common mismatch in a JumpCloud evaluation: the SSO price looks competitive, and then the protocols that the infrastructure needs move the deal to a quote.

What it costs at different sizes

Using list prices for the SSO plan:

The same 1,000 users on Casdoor Cloud cost a flat instance price from $9 per month, with unlimited users, because Casdoor is not priced per seat. The comparison is not only price: JumpCloud also manages devices, and Casdoor does not. If device management is the reason you are buying JumpCloud, the identity comparison is secondary.

When JumpCloud fits

JumpCloud is a good fit when:

• you want one cloud directory for users, devices and SSO, especially in a small IT team without Active Directory;
• device management and patching are part of the requirement;
• your application estate is mostly SAML and OIDC, so the SSO plan is enough;
• a per-user SaaS bill is acceptable and predictable enough for your headcount.

It fits less well when:

• the environment needs LDAP or RADIUS and the Platform quote is out of range;
• the user count is large and mostly occasional or frontline workers;
• you want self-hosting or data residency you control;
• you want identity and authorization in one platform rather than identity plus device management.

Setup and migration

Moving from JumpCloud to another identity provider is mostly an application and directory exercise:

1. Inventory the applications and note whether each uses SAML, OIDC or a JumpCloud-specific connector.
2. Export users and groups. JumpCloud is the directory of record; plan how the new provider will receive users and how passwords will be handled.
3. Recreate applications with new metadata: entity ID, ACS URL, client ID and secret, or OIDC endpoints.
4. Move devices and LDAP clients last, because they are the part that depends on JumpCloud-specific agents and protocols.
5. Run both directories during the transition and keep the old one readable until the last application is moved.

If the goal is only to replace the identity provider and keep the device fleet, a dedicated IdP can run next to JumpCloud rather than replacing it, at least during the transition.

A dedicated identity provider as the alternative

Casdoor is an Apache-2.0 identity provider with OIDC, SAML, CAS, LDAP, RADIUS and SCIM, plus Casbin authorization. It does not manage devices and does not replace an MDM. It replaces the identity layer: application SSO, MFA, directory sync, LDAP and RADIUS for infrastructure, and B2B organizations for customers.

Self-hosting is free with no user cap; a dedicated managed instance starts at $9 per month with unlimited users. For the broader category, see self-hosted identity provider and Active Directory alternatives.

FAQ

How much does JumpCloud SSO cost? $11 per user per month with annual billing, or $13 month to month, for the SSO plan.

Does JumpCloud SSO include LDAP and RADIUS? No. LDAP and RADIUS are available on the Platform plans, which are quote-only.

Is there a free JumpCloud plan? No ongoing free tier is listed. There is a 30-day trial with full platform access.

Can I buy SSO as an add-on instead of a plan? JumpCloud lists SSO, MFA, LDAP and RADIUS as standalone add-ons at $3 per user per month annual, or $4 monthly. The bundled plans are the usual purchase.

What is the cheapest alternative to JumpCloud SSO? Self-hosted Casdoor or Keycloak has no licence fee. For managed hosting, Casdoor Cloud is a flat price per instance from $9 per month with unlimited users, and includes LDAP and RADIUS.