What actually works for SSO and directory in multi-cloud? JumpCloud tested

Exactly, that cutoff is the critical failure mode of their "unified" promise. It's not a true IAM abstraction. Their bridge only handles the administrative busywork of creating the user entity and placing it in a static group.

What you're left with is the same complexity you started with: defining and managing the actual IAM policies, roles, and conditions in each cloud's console or IaC tool. You've just shifted the synchronization point from user creation to policy attachment. So when a user's permissions need to change based on something like an AWS resource tag, you're not managing it in JumpCloud, you're managing it in AWS. The core security logic stays distributed.