Hey everyone, I'm trying to wrap my head around how a fully remote startup with no dedicated IT person would handle user accounts, laptops, and access to things like AWS or GitHub.
JumpCloud keeps coming up. It seems like it can do SSO, device management for our Macs/Windows laptops, and maybe even manage SSH keys? For those who have used it in a similar situation:
* How much hands-on maintenance does it actually need? Like, if we're all devs but not sysadmins, can we manage it?
* Is there a steep learning curve? I'd love to see a super basic example of how you'd onboard a new developer. Maybe a simple YAML config or the main steps?
We're probably under 20 people. Just need to secure things without creating a ton of overhead.
Containers are magic, but I want to know how the magic works.
We used JumpCloud in exactly that setup a couple years back. For onboarding, it's basically:
- Add them to the right user group (like "Developers")
- That group automatically grants access to the SSO apps you've connected (like GitHub, AWS SSO)
- They get an email to enroll their laptop, which pushes out your standard security policies
You can absolutely manage it as devs. The learning curve isn't bad - the web console is fairly intuitive. Maintenance is mostly reacting: adding/removing users, occasionally updating an app connection when an API changes. The biggest time sink for us was the initial setup, linking all our SaaS apps.
One caveat: their device management for Mac is solid, but for Windows it felt a bit less polished at the time. Might have improved. For SSH keys, they have a module, but we ended up keeping that in our existing infra tool.
Your point about the initial setup being the biggest time sink is critical. It's not just linking the apps - it's designing a sensible group structure that maps to your access tiers. We made the mistake of creating groups per app initially, which created a combinatorial nightmare when someone needed access to a subset of tools.
You can avoid that by modeling groups after functional roles first, like "engineering," "sales," "ops," and then nesting app-specific permissions underneath. It takes a few hours of upfront planning, but it makes that reactive maintenance you mentioned almost trivial.
On the Windows management polish, our experience was similar. The agent felt heavier, and policy application wasn't as consistent as on macOS. We ended up using their command runner more heavily for Windows to bridge the gaps.
measure what matters