JumpCloud Protect for End Users

If your JumpCloud administrator enables it, you can download the JumpCloud Protect® mobile app to secure your accounts using Multi-Factor Authentication (MFA) or 2-step verification. The app can be downloaded from the iOS App Store or the Google Play Store. Once you have downloaded the app and successfully enrolled your device, you can authenticate using Push MFA or Verification (TOTP) Code MFA.

JumpCloud Protect sends a push notification to your enrolled mobile device after you’ve attempted to access a resource with your username and password.

• You will receive the login request on the lock screen of your device, and can approve/deny with a long press (iOS) or by expanding the notification (Android).
• If your admin has required biometric authentication, the login request will not complete without it (Face ID, fingerprint, or passcode).
• When you approve the login request, you gain access to your resource. If you tap deny, the login request will be declined, which prevents bad actors from accessing your account.

You can use JumpCloud to log into the Admin Portal, User Portal, or into your Windows, Mac, or Linux devices. 

Considerations

• The JumpCloud Protect app supports iOS version 13 and above, and Android 8.0 and above.
• The JumpCloud Protect app may run on a tablet but is not optimized for tablets at this time. 
• A user can only be enrolled in JumpCloud Protect on one device.
• Mobile Push is supported for authentication into the User Portal, SAML SSO applications, device logins, and for Password Reset. 
• Protect will collect certain diagnostic data for troubleshooting issues and continuous app improvements. There is no user information collected. Although these options default to on, users can turn off data collection on the app:
  • Tap More > Settings to display options for turning off Share Diagnostic Data.

Protecting Against Push Bombing and MFA Fatigue Attacks

Push Bombing is a hacking method of triggering multiple 2FA attempts using push notifications until the user may accept the request accidentally.  MFA Fatigue is the term for when, due to the multiple 2FA requests, a user accepts the fraudulent request out of frustration Here are ways to protect yourself against such an attack:

• Make sure you are following a strong password policy.
• Enable biometric on your device and ask your administrator to enable it for JumpCloud Protect.
• Verify application and location information before approving a push request.

Setting Up JumpCloud Protect 

If your organization is using JumpCloud Protect for their MFA, follow the steps below to complete initial setup.

To set up the JumpCloud Protect app:

1. Log into your JumpCloud User Portal: https://console.jumpcloud.com/login.
2. Navigate to Security > Multi-factor Authentication > JumpCloud Protect Mobile Push > Enroll Device. 

3. Download the JumpCloud Protect App from the iOS App Store or the Google Play Store. You can do so in one of three ways:
   1. Search for “JumpCloud Protect” in the Google Play Store on Android devices or the App Store on iOS devices.
   2. Use the links provided in the notification screen to remotely download the app to your device.
   3. Click View QR Code to Launch Google Play Store or App Store to display a QR code that your phone’s camera can use to link directly to the app download.
4. Once the JumpCloud Protect app is downloaded, open it on your device. 
5. If introductory information displays, tap Next and then tap Get Started (or skip the messages).
6. Allow the app to send notifications. 
7. Tap + Add Account.

8. You will be prompted to give the app permission to use your phone’s camera. Allow it.
9. You will be directed to scan a QR code in your JumpCloud User Portal. Back in the User Portal, click I Have the App.
   1. Alternatively, you can click Enter Code Instead to view the account details and manually enter them in the JumpCloud Protect app. 
10. Scan the QR code in the JumpCloud Protect app. 
11. A green checkmark displays, indicating that the device has been verified. Click done in both the JumpCloud Protect app and the User Portal.

Transitioning to JumpCloud Protect from a Previous Authenticator

If you are already using a different authenticator to verify your identity through Verification Code (TOTP) MFA  and want to transition to JumpCloud Protect, you can do so by:

1. Log in to your user portal: http://console.jumpcloud.com.
2. Navigate to Security.
3. Click Reset TOTP.
4. In the screen that appears, enter the verification code from your current authenticator and click Clear TOTP Settings.
5. A QR code will display. In the JumpCloud Protect app, tap the + button.
6. Scan the QR Code.
7. Enter the code and click Submit.

Authenticating with JumpCloud Protect

If your organization has enabled JumpCloud Protect for your account, and if you have enrolled your device, you will receive a push notification on your device when you attempt to log into a resource secured by your JumpCloud admin. If Biometric User Verification is set to required, the login request will not complete without it (Face ID, fingerprint, or passcode). Select Approve on your device to log into the resource. Select Deny on your device if you are not the one who requested the notification.

Apple Watch

You can also see and respond to JumpCloud Protect notifications on your Apple Watch.

• The watch must be paired with an iPhone running the JumpCloud Protect app, and notifications must be enabled for the app.
  

Resetting Your Password with JumpCloud Protect Push

To reset your password from the User Portal Login screen:

1. Go to the JumpCloud User Portal: https://console.jumpcloud.com.
2. Click Reset User Password.
3. Enter your company email address and click Send Reset Request.
4. Click the secure link that has been sent to the email address you entered.
5. Enter your new password in both password fields and click Reset Password.
6. (Optional) If you only have one form of MFA enabled for your account, you will proceed to the next step. If you have multiple, select JumpCloud Protect Mobile Push.
7. Click Send Password Reset Request to Mobile Device. 
8. On your device, approve the request.

Once you complete the authentication, your password will be reset and you’ll be able to log in.

Step-Up Authentication with JumpCloud Protect

You can use JumpCloud Protect as your Step-Up Authenticator as well. Step Up Authentication is required when you’ve logged into your User Portal and you need to access an application that requires an additional layer of security through a second authentication factor. 

To log into an application that requires Step-Up Authentication:

1. Log into your User Portal: http://console.jumpcloud.com.
2. Click the application you wish to access.
3. Select JumpCloud Protect from the list of available MFA options. 
4. When the request comes into your mobile device, approve the request.

Once you approve your request, you will have access to the application. 

Using JumpCloud Protect’s TOTP for Other Applications

When you open the JumpCloud Protect app, you see a list of the accounts you have set up for MFA. This list either shows the Verification Code for the account with a timer indicating when the code will expire, or the fact that the account is registered for Push MFA. See below:

Tapping on the code itself will copy the code to the device’s clipboard. Tapping anywhere else opens the Account Details screen.

More Screen

At the bottom of the JumpCloud Protect screen, there is a More button.

• Tap Settings to access Display and Privacy options.
• The links to How it Works, Troubleshooting Guide, Terms of Service, and the Privacy Policy will open external links.
• Tapping on the App Version or the Protect ID will copy those values to your clipboard.

Deleting an Account from JumpCloud Protect

If you no longer need one of the accounts you have set up with your JumpCloud Protect mobile app, you can delete it. To do so:

1. Open the JumpCloud Protect mobile app on your device.
2. Tap the name of the account you want to delete. This brings you to the Account Details screen.
3. Tap Delete Account.
4. Tap Delete in the window that appears.