JumpCloud vs authentik: which to choose

JumpCloud or authentik: when each fits your identity stack

JumpCloud fits organizations that want a managed cloud directory and are content to keep SSO, LDAP, RADIUS and device management in one vendor's cloud. authentik fits organizations that need SSO, LDAP and RADIUS to run inside their own network, and that can staff the operation of a self-hosted service. The question is rarely which product has more features. It is where authentication traffic must terminate, which devices must keep working if the cloud service is unavailable, and who will patch, back up and upgrade the platform after cutover. A renewal, a per-user price change or an EU data residency requirement usually raises these questions, but the answers come from your own network design and staffing, not from the invoice alone. Three decision factors settle most cases. The first is protocol placement: authentik runs an LDAP outpost and a RADIUS provider that you deploy close to Wi-Fi controllers, VPN concentrators and LDAP-bound applications, so bind and authentication traffic need not leave your network. Confirm each device's protocol and whether it tolerates the latency and outage profile of your chosen hosting. The second is device management. authentik does not replace the macOS, Windows or Linux device management that JumpCloud provides, so if MDM, policy enforcement and device inventory must move with identity, plan a separate tool or keep JumpCloud for that function. The third is operations: ask whether your team can own PostgreSQL, the server and worker containers, upgrades and backups, or whether a fixed-scope implementation partner will do it under a retainer.

Ask for specific answers before you decide. Ask the vendor for its current per-user and external-user terms, including how suspended users are billed, and compare them with the cost of servers, PostgreSQL, migration and staff time. Check whether the Enterprise features you need, such as the Microsoft Entra ID or Google Workspace integrations, are present in the open-source edition, which the authentik pricing page describes as community support only. Confirm which authentik release line your security team accepts. Finally, export a test set of users and groups from JumpCloud and check which attributes survive, because passwords and MFA enrollments will not transfer in a standard export and every device and application will need a re-enrollment plan. If your answer to the three factors points to in-network protocols and a team that can run the platform, authentik is a credible fit. If device management or the operating effort is the constraint, keep the cloud directory or scope the migration more narrowly.

Which scenarios favor JumpCloud and which favor authentik

This table maps common JumpCloud estate patterns to the platform that usually fits them better, and names the condition that would reverse the choice. Read each row against your own inventory of RADIUS clients, LDAP binds, SaaS apps and device fleet, because the answer depends on which of those carries the most weight.

Scenario	Better fit and why	Choose the other option when
Wi-Fi and VPN estate bound to RADIUS	authentik, if the RADIUS clients can sit on your network and authentik's RADIUS provider covers your authentication method. Outposts run inside your network, so the shared secret and the auth path stay local.	Your access points or VPN concentrators need a cloud-hosted RADIUS endpoint you do not operate, or you need features you have not confirmed in authentik's RADIUS provider.
SaaS apps that need SAML or OIDC	authentik, which lists OAuth2/OIDC and SAML providers in its documentation and gives you direct control over application mappings and MFA policies.	Your SaaS catalog depends on JumpCloud's prebuilt app connectors, or you need a provider you have not verified in authentik's provider list.
LDAP-bound NAS devices and appliances	authentik's LDAP outpost, when your bind accounts and group filters are simple and you can test each device against it before cutover.	Your devices need a long-established directory schema, or you have many bind accounts and nested groups that you would rather keep in a dedicated directory such as FreeIPA.
Windows and macOS fleets that need device policy	JumpCloud, which covers device management alongside the directory. authentik does not replace MDM or endpoint policy, so you would need a separate device management tool.	Your fleet is mostly Linux or you already run a separate MDM product, so device management is not a reason to keep JumpCloud.
Small IT team with no Kubernetes experience	JumpCloud, because it is a managed service with no servers for your staff to patch. For authentik, Docker Compose is the documented starting point for test and small production setups.	You can run a container host with PostgreSQL and backups, and you have someone who will own upgrades on a regular schedule.
Organization with an in-house platform team	authentik, when the team can operate PostgreSQL, container deployments and upgrades, and wants identity configuration in version control.	The platform team is already stretched, so operating identity infrastructure would compete with higher-priority work.
Compliance evidence needs a vendor report	JumpCloud, if your assessor expects a vendor-issued attestation for the identity service itself. Ask JumpCloud which reports it publishes.	Your assessor accepts evidence from your own controls, configuration records and logs, which you produce for a self-hosted service.
Enterprise support requirement	JumpCloud, which is a commercial service with support contracted from the vendor. Confirm the support tiers you need in writing.	You want commercial support from authentik, which offers ticket-based support on Enterprise and SLAs on Enterprise Plus, so confirm the terms before you decide.

Which protocols authentik covers and where JumpCloud's cloud directory differs

Protocol support decides whether authentik can replace JumpCloud's cloud directory for a given workload. Each card below covers one protocol or service, what the open-source edition supports according to the researched facts, and what to confirm against your current JumpCloud configuration before planning a cutover.

OIDC and OAuth 2.0

authentik's free edition supports OpenID Connect and OAuth 2.0 through its OAuth2/OIDC provider type, which covers most modern web and API integrations. Map every application that uses JumpCloud SSO today and record its client registration, redirect URIs, scopes and token lifetimes. Confirm the claims each app reads from the token, because JumpCloud attribute mappings and custom claims rarely transfer one to one.

SAML 2.0 federation

authentik's free edition includes a SAML provider, so SAML-based applications such as older SaaS tools and internal portals can be re-federated without a commercial license. Each SAML app needs its entity ID, assertion consumer URL, signing certificate and NameID format rebuilt in authentik. Check certificate rollover, since JumpCloud's signing certificates and metadata URLs will change when the IdP moves and each service provider must trust the new metadata.

LDAP through the outpost

authentik provides LDAP through a separate outpost, so LDAP binds from NAS devices, Linux hosts and applications are served from your own network rather than JumpCloud's cloud LDAP. The outpost must be reachable from every client subnet, and bind accounts, base DNs and group filters must be recreated exactly. Confirm how JumpCloud Cloud LDAP handles bind DNs, search bases and secure LDAPS connections on each client before you assume the same queries will return the same results.

RADIUS through the outpost

The RADIUS provider runs as an outpost in authentik's free edition, which is the usual path for Wi-Fi and VPN authentication once JumpCloud's cloud RADIUS is retired. Shared secrets, client IP allow lists and any certificate-based EAP methods must be rebuilt on the access points, firewalls or VPN concentrators. Confirm which EAP types your devices use and how JumpCloud presents its RADIUS certificates, because the new certificate chain must be trusted by every supplicant before cutover.

SCIM provisioning

authentik supports SCIM in its free edition, which lets it push users and groups to downstream SaaS applications and receive provisioning from other systems. JumpCloud typically provisions accounts through its own connectors, so each connector must be replaced by a SCIM or native integration and tested for deprovisioning. Confirm which applications JumpCloud provisions today and whether each supports SCIM 2.0 on the receiving end, since a missed connector can leave orphaned accounts after offboarding.

Kerberos and device-bound identity

authentik's free edition lists Kerberos among its supported protocols, but Kerberos for Linux hosts, SSH and Windows or macOS login is a different operating model from JumpCloud's device management. Kerberos-based login depends on keytabs, time synchronization and host enrollment that authentik does not manage on endpoints. Ask whether any JumpCloud-managed devices depend on Kerberos or on device policy, because authentik does not replace JumpCloud's device management, and that gap needs its own plan.

Capability comparison: JumpCloud and authentik side by side

This table sets JumpCloud's cloud directory services against self-hosted authentik, row by row, with the supplied authentik facts and the points to confirm with JumpCloud. Read the device management note in each row where it applies, because authentik does not manage Windows, macOS or Linux endpoints. Use the table to scope which identity services you still need after a move.

Capability	JumpCloud	authentik (self-hosted)
Hosting model	Cloud service operated by JumpCloud. Confirm the current regions and data processing terms in writing.	Self-hosted in your own servers or cloud account. A server container, a worker container and PostgreSQL make up the deployment.
Directory location	Directory held in JumpCloud's cloud. Confirm where user records are stored for your tenant.	Users and configuration stored in PostgreSQL in your environment, except uploaded files.
LDAP	Cloud LDAP service for apps and devices. Confirm bind, group and attribute behavior with your clients.	LDAP provider and LDAP outpost supported in the free edition. Test bind accounts and group filters against each client.
RADIUS	Cloud RADIUS for Wi-Fi and VPN. Confirm shared secret handling and MFA options for your devices.	RADIUS provider supported in the free edition. The outpost runs on your network, so you manage its availability.
SAML, OIDC and OAuth 2.0 SSO	SSO to SaaS and custom apps. Confirm the supported app catalog and protocols for your apps.	OAuth2/OIDC, SAML and proxy providers supported. Google Workspace and Microsoft Entra ID integrations are Enterprise-only.
SCIM provisioning	Confirm which SaaS apps JumpCloud provisions through SCIM and which need manual setup.	SCIM provider documented. Confirm the connectors you need for each downstream application.
Kerberos	Confirm whether JumpCloud offers Kerberos for your Linux or Windows hosts.	Kerberos supported in the free edition. Confirm the setup details for your domain before relying on it.
MFA	Confirm which MFA factors and policies JumpCloud applies to LDAP, RADIUS and SSO.	MFA is available within authentik. Confirm the factors and policies you need, and how they apply to LDAP and RADIUS.
Device management (Windows, macOS, Linux)	JumpCloud manages devices. Confirm each OS feature you rely on, such as policies and software deployment.	Outside authentik's scope. You need a separate MDM or endpoint tool, or a Linux-native approach such as FreeIPA for hosts.
Editions and licensing	Packages or per-product pricing. Confirm which products and billing terms apply to your user count.	Open Source edition under MIT for the core, Enterprise under a separate EE license. Check the license file for code under the enterprise directory.
Vendor support options	Support tiers included in your JumpCloud plan. Confirm response terms in your contract.	Open Source edition has community support only. Enterprise adds ticket-based support, and Enterprise Plus adds SLAs. Device management stays outside this support scope.

What authentik's Enterprise edition adds and what the license means

The open-source edition is built on authentik's core, which the repository licenses under the MIT license. Most of the code falls under that license, so you can run, modify and redistribute it without a subscription. The free edition covers the protocols most directory replacements need: OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and proxy authentication. Support comes from the community Discord, not from a vendor contract.

MIT-licensed core: Most of the repository is MIT licensed, and the license file is the authoritative reference for what you may do with it.
Protocol set: OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and proxy authentication are available without a paid edition.
Community-only support: Help comes through the community Discord, with no ticket queue or response commitment.
Your costs: Software licensing is zero, but you pay for servers, PostgreSQL operations, upgrades and the staff who run them.
Upgrade cadence: Security fixes follow the supported versions in the security policy, so plan upgrades inside that window.

Before you rely on the free edition for production identity, confirm with your security team that community support meets your incident response requirements.

Device management that authentik does not replace

The key point is that authentik is an identity provider and outpost platform, not a device management product. It handles who signs in and how applications and network services verify that person, but it does not push operating system policy to Windows, macOS or Linux machines, deploy software, or keep a device inventory the way an MDM or endpoint management tool does. If your JumpCloud estate uses device policies, agent-based enrollment, software deployment or device-level compliance checks, those functions need a home before you decommission JumpCloud. Authentik will not take them over.

Start with an inventory of what JumpCloud actually does on each endpoint. Export the list of device policies and bindings, note which machines run the JumpCloud agent, and record which of those policies enforce settings such as disk encryption, screen lock, firewall state or software installs. Separate SSO and directory functions (sign-in to SaaS apps, LDAP binds, RADIUS for Wi-Fi and VPN) from device functions. Confirm with JumpCloud's documentation and your own test devices which features depend on the agent staying installed, because some device behavior does not survive removal of the agent. Ask your security team which of these controls appear in your compliance evidence, since those must have a replacement that produces equivalent records.

You have two realistic paths. The first is to choose a separate MDM or endpoint management tool for devices and keep authentik for SSO, LDAP and RADIUS, which means two systems to license, operate and document. The second is to keep JumpCloud for device management while authentik handles SSO and protocol services, which avoids a device migration but keeps a JumpCloud dependency and its renewal terms. A third option is to replace only the protocol side now and defer device management to a later project, but then the directory cutover must still keep devices able to sign in. Put the decision in writing with the owner of endpoint compliance, and price each path from the written scope of the device work, not from assumptions about agent behavior.

How hosting and data control change when identity moves in-house

Moving identity from JumpCloud's cloud to authentik changes where directory data lives, who restores it, how branch sites reach LDAP and RADIUS, and what evidence your team must gather. Each card below marks one decision to settle before cutover.

Where directory data lives

JumpCloud holds your directory in its own cloud regions, while authentik stores all configuration and data in PostgreSQL in your environment, except uploaded files. Confirm which region, cloud account or data center will host the database, who holds administrative access to the hosts, and whether any SSO apps or outposts will send user attributes to third parties. Document the data flows before you move a single user, because they become your records.

Who owns backups and restores

With JumpCloud, the provider runs the service and its recovery. With authentik, your team owns backup schedules, restore testing and point-in-time recovery of the PostgreSQL database, plus the worker and server containers. Name a backup owner, set a restore test cadence, and confirm that a restored instance can still authenticate existing LDAP and RADIUS clients. Untested backups are a common gap in self-hosted identity.

Reaching LDAP and RADIUS from branch sites

JumpCloud's cloud LDAP and RADIUS endpoints are reachable from any network with internet access. authentik's LDAP and RADIUS outposts must be reachable from every branch, Wi-Fi controller and VPN concentrator that authenticates against them, which usually means placing outposts close to those sites and opening the right ports across your WAN. Map each branch, its clients and their latency and failover paths before deciding between central and local outposts.

Compliance evidence you must produce

Once identity runs in your infrastructure, your team must collect the access reviews, change records, MFA enforcement settings, log retention and administrator activity that an assessor will ask for. JumpCloud's provider reports may cover parts of this for its own service, but they do not cover your authentik deployment. DeployOpen can prepare controls and evidence for an assessment, but it does not issue audit reports or certifications; independent auditors and certification bodies do.

Enterprise support and hosted options

authentik's free edition is supported by community channels only, while Enterprise adds ticket-based support, and Enterprise Plus adds SLAs and multi-instance support. If your teams cannot run identity on their own, compare that paid support against a managed identity service from a vendor you already trust. Ask each option for the written support scope, incident response times, and who performs backups and upgrades.

What a self-hosted authentik deployment costs to run each year

The main cost difference is that JumpCloud bills a recurring subscription by user or by package, while authentik's open-source edition has no license fee. Before comparing totals, ask JumpCloud for the line items on your current invoice: per-user or per-package charges, any products billed separately, whether you pay monthly or annually, and whether suspended or inactive accounts still count toward billing. Those last two points often change the bill more than the list price does. On the authentik side, the open-source edition costs nothing to license, but you pay for servers, PostgreSQL, backups, the migration project and staff time. If you need features such as Google Workspace or Microsoft Entra ID integrations, mTLS client certificates, privileged access management or ticket-based support, the authentik pricing page lists Enterprise at $5 per user per month billed annually plus $0.02 per external user per month, and Enterprise Plus starting at $20k annually. Those figures are the published list prices at the time of writing, so confirm them with authentik before you budget.

Infrastructure is the cost most teams underestimate after licensing. The authentik Docker Compose guide calls for at least 2 CPU cores and 2 GB of RAM, and positions Compose for test setups and small-scale production, so a larger or high-availability deployment will need more capacity and a separate design. Since the 2025.10 release, authentik no longer uses Redis and moves caching, tasks, sessions and WebSocket work into PostgreSQL. The 2025.10 release notes warn of roughly 50% more PostgreSQL connections after upgrading, so a managed or self-run database may need a larger instance, a connection pooler or revised limits. Budget for backups and restore tests for PostgreSQL, since it holds all configuration and data except uploaded files. In a written quote, ask the implementer to price the servers, database sizing, backup tooling, the one-time migration and the ongoing upgrade and monitoring hours separately.

Staff time recurs after go-live, and it is the cost that most depends on your team. authentik publishes security releases with at least 24 hours of notice and supports only specific release lines for security fixes, so someone must track the security policy and schedule upgrades within the supported window. Monitoring, certificate renewal, outpost health and user lifecycle requests all draw on the same people. Ask for a quote that states who performs each recurring task, how often, and what is excluded, such as after-hours incident response or upgrades that require a schema change. Compare that recurring effort with the JumpCloud subscription you would stop paying, and remember that the migration itself is a one-time project with its own testing and cutover work.

What a move from JumpCloud to authentik involves, at a high level

The sequence moves users, groups, LDAP and RADIUS clients, SSO applications and MFA enrollments to authentik in an order that keeps devices and applications signing in throughout the cutover. The result is a tested authentik deployment that replaces each JumpCloud service one dependency at a time.

Inventory applications, LDAP clients and RADIUS devices
Your team lists every application using JumpCloud SSO, every system that binds to Cloud LDAP (NAS devices, Linux hosts, internal apps), and every Wi-Fi controller or VPN gateway that sends RADIUS requests to JumpCloud. For each item, record the protocol, the bind account or shared secret, the group filters it relies on, and the owner who can test it. Done means you have one list that maps each JumpCloud service to the dependent system and to an authentik provider or outpost. Effort scales with how many clients and applications you run, so this list sets the size of the project.
Export users and groups from the Admin Portal
An administrator exports user and group data from the JumpCloud Admin Portal in the format the portal offers, then checks the file against the directory. Confirm with JumpCloud which fields the export omits, which usually include passwords and MFA enrollments, and plan for those to be re-established rather than copied. Done means you have a complete user and group inventory stored under your own access controls, with a record of what is missing so that the cutover plan accounts for it.
Deploy authentik in a test environment
The platform team installs authentik in a non-production environment with its server, worker and PostgreSQL components, following the vendor's installation guide for the chosen method. Import the exported users and groups, then create the test providers for the applications and directory services identified in step one. Confirm which edition covers your requirements, since some integrations listed on the pricing page are Enterprise-only. Done means a test instance signs in test users through each provider type you plan to use in production.
Repoint LDAP and RADIUS clients to outposts
Engineers create authentik LDAP and RADIUS outposts, then point one client at a time to the new endpoints using a test bind account or test shared secret. They verify group filters, search results and authentication responses against the expected users. Keep the JumpCloud configuration in place until each client has passed its checks. Done means each LDAP and RADIUS client authenticates successfully against authentik in test, with the rollback path documented for the production change.
Re-federate SSO applications
For each SaaS or internal application, the application owner creates the matching authentik provider (OIDC, SAML or another supported type), registers the new metadata or client settings with the application, and tests sign-in with a pilot group. Record the claims and attribute mappings the application expects, because those often break first. Done means each application has a tested authentik sign-in path and an owner who has signed off on it.
Re-enroll MFA for users
Users enroll their authenticators again in authentik because JumpCloud MFA enrollments are not carried over by the directory export. Communicate the enrollment steps, provide a support path for users who cannot complete it, and confirm recovery methods before retiring the old factors. Done means a defined share of the user population has enrolled, and the help desk runbook covers lost devices and failed enrollments.
Sequence the cutover so devices keep authenticating
The team sets an order for moving groups of clients and applications, starting with low-risk systems and ending with Wi-Fi, VPN and the most widely used SSO applications. Each change has a go or no-go check, a named owner and a rollback step that restores the JumpCloud endpoint. Monitor authentication logs after each change. Done means every dependency points to authentik, JumpCloud is no longer in the authentication path, and the team has a record of each change for audit and operations. Detailed procedures are covered in the dedicated migration guide.

Questions buyers ask before moving from JumpCloud to authentik

How much does a move from JumpCloud to authentik cost?

The cost is set by the components, not by a single figure: the authentik edition you choose, the servers and PostgreSQL you run, the migration work and the ongoing operations. The authentik pricing page lists Open Source as free with community Discord support only, Enterprise at $5 per user per month billed annually plus $0.02 per external user per month, and Enterprise Plus starting at $20k annually. Your JumpCloud invoice is the baseline to compare against. Recurring costs are licenses (if any), infrastructure and staff time; one-time costs are the migration and testing. Ask any provider for a written, fixed-scope quote that lists each component separately.

How long does the migration take?

Duration depends on the number of applications, LDAP and RADIUS clients, groups and MFA enrollments, and on how many cutovers you need. No supplied figure gives a fixed timeline, so treat any single number as unverified until it is tied to your inventory. The largest drivers are the count of devices that bind to LDAP or RADIUS, the number of SSO applications that must be re-federated, and whether you can run both directories in parallel while devices move over. A fixed-scope plan agreed in writing before work starts makes the timeline reviewable.

Can an internal team run authentik on its own?

Yes, if the team has Linux, container and PostgreSQL skills and someone owns the upgrade cycle. authentik deployments have a server container, a worker container and PostgreSQL, and the Docker Compose guide positions Compose for test setups and small-scale production, starting from at least 2 CPU cores and 2 GB of RAM. Larger or more critical deployments usually need Kubernetes and a tested backup routine. Ask whether your staff can cover on-call, patching and identity-specific troubleshooting. DeployOpen can plan, implement, harden and document the setup, and offers ongoing support and upgrades as retainers.

Can MFA enrollments and passwords be exported from JumpCloud?

Confirm this in JumpCloud's current documentation and with your account team before you plan around it, because the answer decides how users re-enroll. Passwords are typically not exportable in plain form from a cloud directory, and MFA enrollments are usually tied to the originating service. Plan for users to re-enroll MFA in authentik, and for password resets or a controlled credential handover where needed. Other vendors show the same pattern: Auth0 includes no password hashes in standard exports, and paid plans request them through a support ticket with no guaranteed delivery date.

Does authentik replace JumpCloud device management?

No. authentik covers identity protocols such as OIDC, SAML, LDAP, SCIM and RADIUS, plus proxy and remote access providers, but it does not manage Windows or macOS devices, their policies or their software. If your JumpCloud deployment handles device enrollment, configuration and compliance, you need a separate device management tool or an equivalent for those endpoints. Map each device function before you decommission JumpCloud so that nothing is left without an owner.

Is the free authentik edition enough for our organization?

It depends on which features you need. The Open Source edition is MIT licensed and supports OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and proxy authentication, but it comes with community support only. The Enterprise features listed on the pricing page include Google Workspace and Microsoft Entra ID integrations, mTLS client certificate authentication, privileged access management, password history, enhanced audit logging and ticket-based support. If you need contractual support, SLAs, multi-instance deployment or FIPS compliance, those sit in Enterprise Plus. Check each required feature against the pricing page and the license in the repository before deciding.

How are upgrades and security releases handled?

Upgrades are your responsibility to schedule and test. authentik names releases by year and month, and its security policy lists 2026.5.x and 2026.8.x as the supported versions receiving security fixes, with security releases announced at least 24 hours in advance. Plan a maintenance window, a staging environment and a rollback path. The 2025.10 release notes also show that upgrades can change resource demands: the project removed Redis and warned of roughly 50% more PostgreSQL connections after upgrading. Assign an owner to watch release notes and apply patches within your own policy.

What does the work need from our staff?

Expect to provide a named technical owner, access to JumpCloud's admin console and exports, the list of applications and devices that authenticate, and the people who approve cutover windows. Your network team must confirm reachability for LDAP and RADIUS outposts, and your security team should review MFA policy, audit logging and access roles. A decision-maker should sign off on the scope and the retirement date for JumpCloud. Ask any implementation partner to list these inputs in the written scope so that your team's time is planned up front.

How DeployOpen helps evaluate, implement and migrate authentik

DeployOpen is a Chainscore Labs company that plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure. For JumpCloud vs authentik, we start with the directory, protocol and device requirements you actually have, then build the authentik side in your environment and hand over the runbooks your team needs to operate it.

How we scope

We inventory the LDAP clients, RADIUS devices and SSO applications that depend on JumpCloud today.
We document which device management and MFA functions remain outside authentik and need another component.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.

How we build

We deploy authentik in your own cloud account, data center or air-gapped network, with PostgreSQL as the data store.
We configure LDAP and RADIUS outposts, SSO providers and MFA policies against a tested pilot group first.
We test each protocol path, including failure cases such as an unreachable outpost, before any production cutover.

How we hand over

We deliver architecture, configuration and backup documentation written for your operations and security teams.
We prepare control and evidence documentation for your compliance assessments, while independent auditors issue any opinions.
We walk your administrators through upgrades, release security notices and the Enterprise edition decision you will need to make.

How we support

Ongoing support, upgrades and continuous security testing are available as retainers after handover.
Retainers can cover authentik version upgrades, outpost maintenance and periodic testing of authentication paths.
Any change to scope after signature is handled as a written change to the agreed scope.

JumpCloud vs authentik