Create a Policy

You can create policies in JumpCloud’s Admin Portal, and deploy them to a single device or groups of devices. You can also add multiple policies to a new policy group and assign the policy group to a device group. A policy group can save you time by letting you implement security or compliance-related issues on a large number of managed devices.

After a policy takes effect, you can view a policy's status or review the log file to determine if the policy requires additional changes. A policy lets you customize your managed devices and keep the devices secure.

If a policy's status is green, the policy was applied successfully but it might not be in effect yet. You must complete all of the Policy Activation steps on the local device before the policy takes effect.

Prerequisites:

• See Get Started: Policies before you get started with policies.
• To assign a policy to a device, you must have an active device running on a supported OS.
• To assign a policy to a device group, you must have defined device groups. See Get Started: Groups

Considerations:

• If the JumpCloud Agent for a device is out-of-date, JumpCloud may be prevented from enforcing all policies on that device.
• For Windows devices, only English (United States) has been qualified. Additional language packs are not currently supported.
• Windows Home is not supported.
• There are no guardrails preventing the creation of multiple policies with conflicting policy behaviors. Use caution when applying similar policies to devices to avoid unintended device behavior.

Creating a Policy

You can set up policies to enforce specific behavior on the devices you manage. All JumpCloud policies can be renamed if you have specific conventions or want to include a category for the devices.

Some policies require you to take an additional step after creating the policy and applying it before the policy is active on a device. This action is listed in Policy Activation and should be the final step in the procedure.

To create a policy:

1. Log in to the JumpCloud Admin Portal.
2. Go to DEVICE MANAGEMENT > Policy Management.
3. In the All tab, click (+).
4. On the New Policy panel, select a tab for the desired OS.
5. Select a policy from the list, then click configure.
   
6. Review the customized information on the left side about the policy and which OS versions are required to run the policy:
   • Minimum Supported Version - This policy must be run on a device with this minimum supported OS version. 
   • Deprecated Versions - This policy cannot run on a device with this OS version or later. 
   • Supported Enrollment Types -
     • User-Enrolled Devices - These iOS or iPadOS devices are owned by the user and enrolled by the user.
     • Device-Enrolled Devices - These iOS or iPad devices are owned by the corporation and enrolled by the IT Admin or the user.
     • Auto-Enrolled Devices - These devices are owned and enrolled by the corporation through Apple’s Automatic Device Enrollment. This option is not currently supported.
   • If there is no Minimum Supported Version or Deprecated Versions, these fields are not visible. If there is no Enrollment Type visible, then all enrollment types are supported for this policy.
     
7. (Optional) In the Policy Name field, enter a new name for the policy or keep the default. Policy names must be unique.
8. (Optional) In the Policy Notes field, enter information you want to retain such as testing notes, config details, admin responsible for configuring, historical information, and intended use. 
9. If needed, use these instructions to configure the appropriate items in the Settings section (not all policies have configurable fields in the Settings section:
   • Configure Settings for iOS and iPadOS Policies
   • Configure Settings for MacOS Policies
   • Configure Settings for Windows Policies
   • Configure Settings for Android Policies
10. (Optional) Select the Device Groups tab. Select one or more device groups where you'll apply this policy. For device groups with multiple OS member types, the policy is applied only to the supported OS.
11. (Optional) Select the Devices tab. Select one or more devices where you'll apply this policy.
12. If applicable, select the Details tab and read the Policy Activation section to determine if there are any additional steps you need to take after saving the policy before it takes effect.
13. Click save.
14. If prompted, click save again to see the policy appear in the Policy List.
15. ​(Optional) Complete any additional steps listed in Policy Activation. 
16. After you save, the policy takes effect on active devices in the selected groups in near real-time, but could take up to a few minutes in some instances. The policy is enforced on any inactive devices the next time they next become active. After the policy is created, you can apply it to additional groups and devices in the following ways:
    • Select the policy and select Device Groups.
    • Select the device group and select Policies.
    • Select the policy and select Devices.
    • Select the device and select Policies.

After a policy is created and saved, it may take a few minutes for the policy to be enforced on the device. When the policy is running, you can view its status to determine if the policy was successfully applied or if it requires additional steps.

To view policy status:

1. Log in to the JumpCloud Admin Portal.
2. Go to DEVICE MANAGEMENT > Policy Management.
3. Select the policy
4. Select the Status tab.
   
5. To see the last Result Log for a device where this policy is applied, click view.

Considerations:

• When applying multiple policies at the same time, they can take several hours to fully apply.
• Since our policies are group policy based, issue a gpupdate /force command, then a reboot or log out/log in to speed up the policy application process.

Removing a Policy

You can manage a device’s behavior after creating a policy in the following ways:

• Remove a specific device from the policy without removing the policy itself.
• Remove groups of devices from the policy without removing the entire policy.
• Reconfigure the settings in the policy to disable some features.
• Remove the policy completely.

These steps show how to remove a specific device or device group from a policy, and how to completely remove the policy. 

To remove devices or device groups from the policy:

1. Log in to the JumpCloud Admin Portal.
2. Go to DEVICE MANAGEMENT > Policy Management.
3. To remove devices from the policy, select the policy.
4. Select the Devices tab and select the checkbox next to the device to remove it from this policy.
5. To remove a group of devices from the policy, select the policy.
6. Select the Device Groups tab and select the checkbox next to a device group to remove it from this policy.
7. Click save, then click save again.
8. If the activation step requires it, restart all devices you removed from the policy.

To remove a policy:

1. Log in to the JumpCloud Admin Portal.
2. Go to DEVICE MANAGEMENT > Policy Management.
3. Select the checkbox next to the policy that you want to remove.
4. Click delete.
5. On the Delete Policy dialog, click continue.
6. If the activation step requires it, restart all devices where you applied the policy that was just deleted. 

After the removal procedure has been completed, a gpupdate /force command may need to be issued on the machine before the reboot or log out/log in action.

Creating a Policy Group

You can save time by creating a policy group, adding multiple policies to it, and applying the group to device group(s). For example, you can create a policy group for macOS devices that uses JumpCloud’s Lock Screen policy to automatically turn on the screen saver if a device is inactive for a specific amount of time. The policy group could also contain a policy to control Apple App Store purchases to allow only updates to existing apps. 

Policies must be created and configured before you can add them to a policy group.

To create a policy group:

1. Verify that policies have been created.
2. Log in to the JumpCloud Admin Portal.
3. Go to DEVICE MANAGEMENT > Policy Groups.
4. Click (+), then select Policy Group.

5. On the Details tab, enter a name for the policy group. 
6. In Description, describe the purpose of this policy group.
7. Click the Policies tab, then select the policies you want to include in this group.
8. Select Device Groups to assign this policy group to an existing device group.
9. Click save. The new group appears in the Policy Groups List.

After you create a policy group, you can choose to assign the policy group to a device group later.

To assign a policy group to a device group:

1. On the Device Groups page, select a device group.
2. Select the Policy Groups tab.
3. Select one or more policy groups to apply to this device group.
   
4. Click Save.

To delete a policy group:

1. In the Policy Groups page, select the checkbox next to the policy group you want to remove.
2. Click delete.
3. Enter the number of policy groups you want to remove and click delete.