CrowdStrike Integration

CrowdStrike provides cloud security and threat detection software. Falcon Agent installation supports Windows and macOS devices from the JumpCloud Admin Portal. On macOS, you must apply a JumpCloud policy that creates a Mobile Device Management (MDM) profile and sets the permissions the CrowdStrike Falcon Agent requires. If the Mac uses an Intel processor and runs the CrowdStrike firmware analysis tool with a kernel extension, you must apply a second policy.

JumpCloud integrates with CrowdStrike Falcon in the following places:

• Deploying the CrowdStrike Falcon Agent to Windows and macOS devices.
• Using CrowdStrike endpoint posture data as a condition in Conditional Access Policies (CAPs).
• Syncing CrowdStrike license data into AI & SaaS Management through a Connector.

Prerequisites

• Administrative access to the CrowdStrike Portal.
• Access to the JumpCloud Admin Portal with a role that can create policies, commands, and Connectors.
• Your CrowdStrike Customer ID (CCID) checksum, available on the Falcon Sensor download page. Required by both macOS CrowdStrike policies.
• Target devices must be registered with JumpCloud Go, and Users must be logged in to JumpCloud Go, to run the full set of CrowdStrike device health checks used by CAPs. If JumpCloud Go is not available, Users can use Google Chrome when Device Trust (DTC) is configured. See Configure Google Chrome Enterprise Device Trust with JumpCloud to learn more.

Considerations

• For macOS devices, create and apply the CrowdStrike policy before you deploy the CrowdStrike app.
• The CrowdStrike EDR (Endpoint Detection and Response) conditions in a CAP require managed devices with JumpCloud Go. CrowdStrike EDR checks are not available on unmanaged devices or through Chrome DTC.
• Based on the size of your organization, the initial CrowdStrike Connector data collection may take up to an hour.
• If your data is stored outside of the US, check which login URL to use for your region. If your organization uses LDAP, RADIUS, or requires firewall allow list configuration, the Fully Qualified Domain Names (FQDNs) will also be region specific. See JumpCloud Data Centers for the URLs, FQDNs, and IP addresses.

Installing the CrowdStrike Falcon Agent

macOS

1. Log in to your CrowdStrike Portal.
2. Create a new CrowdStrike API Client with Sensor Download - Read Scope by performing these steps:
   • Click the hamburger menu.
     image
   • Select Support and Resources. 
   • Under Resources and Tools, click API clients and keys.
   • Click Add new API Client.
   • Enter the Client Name and Description.
   • Navigate to Sensor Download, select Read scope, and click Add.
     image
3. Save the Client ID, Secret, and Base URL Information for future use.
4. Log in to the JumpCloud Admin Portal.
5. Go to Device Management > Commands.
6. Select the Commands tab, then click (+) and choose Command from Template. 
7. Select MacOS and locate the the Mac - Install CrowdStrike Falcon Agent template. See Get Started: Commands for more information.
8. Click Configure.
9. (Optional) You can edit the default name for this command or type a new name.
10. Click Run As, then choose root.
11. Under Type, click Mac.
12. Edit the script to update the CSBaseAddress, CSClientID, CSClientSecret, and (if applicable) CSInstallToken with the information collected in Step 3. 
    • Only set the CSInstallToken variable if you have Require Token enabled in your CrowdStrike org under Host setup and management > Deploy > Installation tokens.
      image 3

13. If you want to schedule when the command runs or trigger the command, click Event and choose another option. The default is Run Manually.
14. Under Options, increase the timeout if you want. The CrowdStrike default is 600 seconds.
    • The command may throw a 124 error if the command times out. This is more likely to occur on slower networks. 
15. Under TTL Settings, verify that Use Smart Defaults is selected.
16. Assign the Falcon agent to your devices:
    • If you are assigning the Falcon Agent to individual devices, select the Devices tab and select the checkbox next to each device where you want to install the agent.
    • If you are assigning the Falcon Agent to groups of devices, select the Device Groups tab and select the checkbox next to each device group where you want to install the agent.
17. Click save, then click save again.
18. Run the command by selecting the checkbox next to the command on the Commands page and clicking run now. If the command doesn’t run, verify that you have root permissions. 

19. ​​​​​​After the command finishes, select the Results tab on the Command page. An exit code of 0 indicates that the command ran successfully. If multiple commands are processed at runtime, only the last exit code is reported. For a list of all exit codes, see Understand Command Results.

Windows

To install the CrowdStrike Falcon Agent on a Windows device:

1. Log into your CrowdStrike Portal.
2. Create a new CrowdStrike API Client with Sensor Download - Read Scope by performing the following:
   1. Click the hamburger menu.
      
   2. Select Support and Resources. 
   3. Under Resources and Tools, click API clients and keys.
   4. Click Add new API Client.
   5. Enter the Client Name and Description.
   6. Navigate to Sensor Download and select Read scope. 
      
      
   7. Click Add.
3. Save the Client ID, Secret, and Base URL Information for future use.
4. Log in to the JumpCloud Admin Portal.
5. Go to Device Management > Commands.
6. Select the Commands tab, then click (+) and choose Command from Template. 
7. Select Windows and locate the the Windows - Install CrowdStrike Falcon Agent template. See Get Started: Commands for more information.
8. Click configure.
9. (Optional) You can edit the default name for this command or type a new name.
10. Under Type, click Windows.
11. Edit the script to update the CSBaseAddress, CSClientID, CSClientSecret, and (if applicable) CSInstallToken with the information collected in Step 3. 
    • Only set the CSInstallToken variable if you have Require Token enabled in your CrowdStrike org under Host setup and management > Deploy > Installation tokens.
      

12. Click Launch Event, then choose Run as Repeating to run the command at the top of every hour.
13. Under Options, ensure that the interval is set to 3600 seconds (1 hour).
    • The command may throw a 124 error if the command times out. This is more likely to occur on slower networks. 
14. Assign the Falcon agent to your devices:
    • If you are assigning the Falcon Agent to individual devices, select the Devices tab and select the checkbox next to each device where you want to install the agent.
    • If you are assigning the Falcon Agent to groups of devices, select the Device Groups tab and select the checkbox next to each device group where you want to install the agent.
15. Click save, then click save again. 
16. Run the command by selecting the checkbox next to the command on the Commands page and clicking run now. If the command doesn’t run, verify that you have root permissions.
17. After the command finishes, select the Results tab on the Commands page. An exit code of 0 indicates that the command ran successfully. If multiple commands are processed at runtime, only the last exit code is reported. For a list of exit codes, see Understand Command Results. 
18. Click view to see more information about the results.

Troubleshooting

Creating a macOS CrowdStrike Policy

Every macOS device requires the CrowdStrike Falcon MDM Settings (No kernel extension) policy. If you have a Mac with an Intel processor that includes a kernel extension policy to run CrowdStrike’s firmware analysis tool, apply the CrowdStrike Falcon Firmware Analysis Settings Policy (Intel only) as well.

• CrowdStrike Falcon MDM Settings (No kernel extension) Policy: use this general policy to configure all Mac computers. It installs Full Disk Access, Notifications, System Extensions, and Web Content Filter permissions, and creates an MDM licensing profile.
• CrowdStrike Falcon Firmware Analysis Settings Policy (Intel only): use this policy for Mac computers with Intel processors that include a kernel extension to run CrowdStrike’s firmware analysis tool. It installs the permissions the Falcon Firmware Analysis tool needs. Apply this policy alongside the CrowdStrike Falcon MDM Settings policy on every Mac with an Intel processor that runs the firmware analysis tool.

Have your CrowdStrike Customer ID (CCID) checksum handy because both CrowdStrike policies will use it to create the MDM profile.

To create a macOS CrowdStrike Policy:

1. Log in to the JumpCloud Admin Portal.

2. Go to Device Management > Policy Management.
3. Select the All tab, then click (+) and select the Mac tab.
4. To create a policy for a silicon macOS device or a macOS device that uses an Intel processor, locate the CrowdStrike Falcon MDM Settings (No kernel extension) policy, then click configure.
   1. (Optional) Under Policy Name, enter a new, unique name for the policy or keep the default. 
   2. Under CCID, enter your CCID. Locate your CCID on the Falcon Sensor download page. Including the CCID in this policy automatically licenses Falcon on your macOS devices so you don’t need to run an activation command.
      
      
      
   3. (Optional) Select the Device Groups tab, then select one or more device groups where you'll apply this policy.
   4. (Optional) Select the Devices tab, then select one or more devices where you'll apply this policy.
   5. Click save, then click save again.
5. To create a policy for a macOS device that uses an Intel processor to run CrowdStrike’s firmware analysis tool, locate the CrowdStrike Falcon Firmware Analysis Settings Policy (Intel only), then click configure.
   1. (Optional) On the New Policy panel, enter a new, unique name for the policy or keep the default.
      
   2. (Optional) Select the Device Groups tab, then select one or more device groups where you'll apply this policy.
   3. (Optional) Select the Devices tab, then select one or more devices where you'll apply this policy.
   4. Click save, then click save again.
6. Run the command you created in To install the CrowdStrike Falcon Agent on a macOS device below by selecting the checkbox next to the command on the Commands page and clicking run now. 

7. After the command finishes, select the Results tab on the Commands page. An exit code of 0 indicates that the command ran successfully. If multiple commands are processed at runtime, only the last exit code is reported. For a list of all exit codes, see Understand Command Results. 
8. Verify that your CrowdStrike policy was applied on the macOS device (From the Apple menu, System Settings > Privacy & Security > Profiles):

To further verify the policy, run this command:

The CrowdStrike policy does not appear in Apple’s System Settings > Privacy & Security > Full Disk Access location. That location contains policies that the user approves or has approved, rather than Admin-approved policies like the Application Privacy Preferences Policy.

Configuring Conditional Access Policies With CrowdStrike

Conditional Access Policy (CAP) configurations support conditions based on device health posture. These conditions let you deny or allow access based on CrowdStrike device signals, and give you device-level enforcement to support Zero Trust, compliance, and evolving security needs.

The CrowdStrike CAP conditions apply on managed devices that use JumpCloud Go. They are not available on unmanaged devices or through Chrome DTC.

The EDR CrowdStrike conditions block access automatically when the EDR agent is missing, stopped, or unhealthy. If the ZTA score is missing, see Troubleshoot: ZTA Score Data File Missing or Empty to learn more.

EDR Agent CrowdStrike (Status)

Use this condition to apply policies based on whether the CrowdStrike Falcon agent is active.

EDR Agent CrowdStrike (Version)

Use this condition to restrict access based on the specific version of the installed CrowdStrike agent.

Format

This condition supports version formats until 2 decimal points only.

Example

The Admin wants to apply a CAP to devices having the OS version as 10.2.7:

• If the Admin selects the Equals operator, they need to enter the EDR agent version as 10.2.7 (the same exact version). 
• If the Admin selects the Greater Than operator, they can enter the agent version as 10.1, 10.2.8, etc. 
• If the Admin selects the Less Than operator, they can enter the agent version as 10.3, 10.2.8 etc. 

EDR Agent Crowdstrike (ZTA score)

Use this condition to apply policies based on the Zero Trust Assessment (ZTA) score generated by CrowdStrike.

Format

This condition supports whole number format.

Example

The Admin wants to apply a CAP to devices having the EDR agent ZTA score of 50:

• The Admin can select the Equals operator and enter the ZTA score as 50.

The EDR based conditions will ensure the user access is automatically blocked if the EDR agent is missing, stopped, or unhealthy. If the ZTA score is missing, see Troubleshoot: ZTA Score Data File Missing or Empty to learn more.

Format

This condition supports version formats until 2 decimal points only.

Example

See the above example (under EDR Agent Crowdstrike Version) to know how this condition works.

Configuring the CrowdStrike Connector for AI & SaaS Management

JumpCloud AI & SaaS Management gives you visibility and control over shadow IT, including AI and SaaS app usage in your org. Connectors detect shadow IT without asking Users to install a browser extension, and expand your usage and security insights.

The CrowdStrike Connector retrieves the license list from the CrowdStrike API. It polls at a regular interval to capture new Users and keep the data current.

Prerequisites

• You must have administrative access to CrowdStrike.

Considerations

• Based on your organization’s size, the initial collection of data may take some time, up to an hour. 

Configuring CrowdStrike

1. Log in to CrowdStrike.
2. In the top left, open the navigator and click Support and resources.
3. Click API clients and keys.
4. Click Create API Client.
5. Enter a name and description.
6. In the scopes list, enable Identity Management | Read.
7. Click Create.

Configuring JumpCloud

1. Log in to the JumpCloud Admin Portal.

2. Go to Access > AI & SaaS Management > Settings.
3. Under AI & SaaS Management Settings, click the Connectors tab, then click + Add Connector.

4. Select CrowdStrike and click Connect. 
5. Enter a name and click Connect.
6. Enter the client id copied in the previous section to the CrowdStrike Client ID field.
7. Enter the client secret copied in the previous section to the CrowdStrike Client Secret field.
8. Select your CrowdStrike region.
9. Click Save Connector.
10. You will now see CrowdStrike in your list of Connectors.

Required Permissions

• Permission Scope
  • Read to fetch users from the API.

Uninstall/Remove

• On the Connector’s detail page, click on Delete Connector and follow the prompts.
• To revoke the permissions granted to JumpCloud, delete the API client in CrowdStrike.