Get Started: Mobile Device Trust

Overview

JumpCloud Mobile Device Trust brings JumpCloud Go™ to mobile devices and enables seamless, secure access to JumpCloud-protected resources on the go. Using the JumpCloud Protect® mobile app, users register their device with JumpCloud Go, enabling biometric, passwordless verification when accessing protected resources. 

When you create Conditional Access Policies in combination with JumpCloud Go for Mobile, you enforce Device Trust. This protects your company’s resources by ensuring users can access them only on trusted devices. Using a combination of JumpCloud Device Management, JumpCloud Go, JumpCloud Protect, and Conditional Access Policies (CAPs), you can safeguard access to both the JumpCloud User Portal and individual SSO apps. 

Mobile devices can be trusted when they are enrolled in JumpCloud Device Management, have the JumpCloud Protect app deployed using Software Management, and are registered with JumpCloud Go. After registration, users verify their identity using JumpCloud Go for Mobile and biometrics on their device.

Prerequisites

JumpCloud Go for Mobile

• JumpCloud Go is enabled for your org. See Get Started: JumpCloud Go to learn more.
• Device Management is enabled for your org:
  • For Apple devices, see Set up Apple MDM to learn more.
  • For Android devices, see Set Up Android EMM to learn more.
• Mobile devices are enrolled in JumpCloud Device Management:
  • Apple devices are enrolled in Apple MDM with the following supported enrollment types:
    • Automated Device Enrollment (ADE).
    • Profile-driven Device Enrollment.
    • Profile-driven User Enrollment.
  • Android devices are enrolled in Android EMM with the following supported enrollment types:
    • Work Profile (Personal device).
    • Work Profile (Company-owned device).
    • Fully managed device.
    • Dedicated device.
• Users are bound to their devices in JumpCloud, otherwise the JumpCloud Go for Mobile registration process will fail.
  • Company-owned devices using Android Zero Touch, Apple Automated Device Enrollment (ADE), or Admin Portal enrollments require you to bind the user to the mobile device record in JumpCloud. See Bind Users to Devices to learn more. 
  • BYOD devices using User Enrollment for iOS or Work Profile for Android automatically bind the user to the device during enrollment if initiated via the User Portal.
    • BYOD/User Enrolled Apple devices require Managed Apple IDs (MAIDs) to enroll in MDM. 
• Apple VPP and/or Software Management for Android are enabled for your org to deploy the managed JumpCloud Protect app (v2.2.2+) to user devices:
  • For Apple devices, see Manage Software with Apple’s VPP to learn more.
  • For Android devices, Software Management is enabled automatically after configuring Android EMM. See Software Management: Android to learn more. 

Device Trust

• Conditional Access Policies (CAPs) are configured for each resource that you want to protect using the Device Management condition.
  • Optionally, use Operating System conditions for granular control of device types. See Configure a Conditional Access Policy to learn more.

Android MDT Requirements

Before you enroll in Android Mobile Device Trust (MDT), ensure your device meets the minimum version requirements for both the Android OS and JumpCloud Protect application to effectively enhance your security posture with MDT.

Minimum Version Requirements

• Android OS: version 12 or higher

• JumpCloud Protect application:  version 2.2.10 or higher

Considerations

• Persistent background notifications
  • In the work profile on the managed Android device, there will be a persistent background notification running for JumpCloud Go in the Android message drawer.
  • These background notifications are required to enable the continuous operation and total transparency of JumpCloud’s background activities on your device.
• Android MDT vs. Android EMM
  • Android Mobile Device Trust (MDT) focuses on establishing your device’s security posture and granting access. To maintain security standards, enrolling in Android MDT requires Android OS versions 12 or higher. 
  • Android Enterprise Mobility Management (EMM) focuses on mobility management, including mobile device management (MDM). Android EMM can be used with Android OS versions 5.1 and higher.

Enforcing Device Trust  

When you configure CAPs to enforce Mobile Device Trust, users can’t access protected resources on untrusted devices. When users first access a protected resource on a trusted device, they’re redirected to the JumpCloud Protect app to register their device with JumpCloud Go. After entering their credentials (and MFA challenge if enabled by the admin), their device is registered with JumpCloud Go, establishing their device as trusted.

When users access protected resources, they verify their identity using JumpCloud Go via the JumpCloud Protect app with device biometrics, granting access. The hardware-backed JumpCloud Go token is valid for 1 year. 

For a mobile device to be considered trusted:

• The device is enrolled in Device Management: Apple MDM and/or Android EMM.
• JumpCloud Protect is deployed to the device using Apple VPP and/or Software Management.
• The device passes integrity and jailbreak detection checks.

Accessing the JumpCloud User Portal 

If your users access their company resources from the JumpCloud User Portal, you can create a CAP that restricts access on unmanaged devices. Because users require access to the User Portal to register their devices with JumpCloud Go, rather than explicitly block access, the highest level of MFA is used for authentication.

Protecting Individual SSO Apps 

You can create CAPs for specific SSO apps available to your users. For example, Slack may contain privileged information that you want users to only access from trusted devices. To do so, create a CAP for the Slack SSO app and restrict access on untrusted devices using the Managed Device condition. 

Admin Configuration Workflow

After enabling the prerequisite features, configure your mobile devices to start using JumpCloud Go for Mobile and Device Trust:

• Enroll your devices in Device Management. Depending on the device and configuration type, devices can be company enrolled or personally enrolled.
  • For company enrolled devices:
    • Apple: See Add Company-Owned Apple Devices to MDM with Device Enrollment to learn more.
    • Android: See Add and Manage Android Devices to learn more.
  • For personal devices, user can enroll their device via the User Portal:
    • Apple: See Add Personal Apple Devices to MDM with User Enrollment to learn more.
      • Note: Managed Apple IDs (MAIDs) are required to enroll personal devices in MDM. To perform this action in bulk, see Run the MAID Import Script.
    • Android: See Add and Manage Android Devices to learn more. 
• Deploy the JumpCloud Protect app (v2.2.2+ƒ) to devices using Apple VPP and/or Android Software Management. See Get Started: Software Management.
  • Apple: See Manage Software with Apple’s VPP to learn more.
  • Android: See Software Management: Android to learn more.

• Create CAPs in JumpCloud that limit access to the User Portal, SSO apps, or both using the Managed Device condition. Optionally, use the Operating System condition to target specific device types. See Configure a Conditional Access Policy to learn more. 

FAQ