Skip to main content

Deploy JumpCloud Go Extension for SaaS Discovery with Third-Party MDM

Admins who manage macOS or Windows devices with a third-party Mobile Device Management (MDM) provider, and not JumpCloud, can still discover apps on those devices with AI & SaaS Management by deploying the JumpCloud Go extension through that MDM. Use the steps in this article to create and deploy a policy that installs the JumpCloud Go extension and gives it the Client ID and Client secret from AI & SaaS Management.

  • This lets discovery start after the extension is installed, without requiring the user to sign in to the User Portal or a JumpCloud SSO application first.
  • Discovery data is associated with a user after they sign in to the User Portal or a JumpCloud SSO application.
note

If JumpCloud manages the device, you do not need this policy. JumpCloud can deploy the extension for you.

Prerequisites:

  • AI & SaaS Management is enabled.
  • You can view the Client ID and Client secret under Access > AI & SaaS Management > Settings, in JumpCloud Go Extension for Third-Party MDM.
  • The devices are enrolled in a third-party MDM provider.

Considerations:

  • The macOS policy supports Arc, Brave, Chrome, Edge, and Firefox. The Windows policy supports Brave, Chrome, Edge, and Firefox.
  • You can remove a browser section from the policy if you do not want to deploy the extension to that browser.
  • Discovery data is associated with a user after they sign in to the User Portal or a JumpCloud SSO application.
  • To create a new Client ID and Client secret, disable and re-enable JumpCloud Go Extension for Third-Party MDM in Settings, then update and redistribute your MDM policy. Jump to Create a New Client ID and Client Secret.

Create a New Client ID and Client Secret​

Use these steps to create a new Client ID and Client secret under JumpCloud Go Extension for Third-Party MDM to use in your MDM policy.

  1. In the JumpCloud Admin Portal, go to Access > AI & SaaS Management > Settings.
  2. Under JumpCloud Go Extension for Third-Party MDM, disable the feature and save your changes. JumpCloud deletes the existing service account.
  3. Enable JumpCloud Go Extension for Third-Party MDM again and save. JumpCloud creates a new service account with a new Client ID and Client secret.
  4. Copy the new Client ID and Client secret.
  5. Update your macOS or Windows MDM policy with the new values, then redistribute the JumpCloud Go extension to devices. Jump to Preparing the macOS Policy or Preparing the Windows Policy.
note

In the event of a credential leak or reset, or whenever you need to replace the service account credentials:

  1. Disable JumpCloud Go Extension for Third-Party MDM to delete the existing service account.
  2. Enable JumpCloud Go Extension for Third-Party MDM to create a new service account with a new Client ID and Client secret.
  3. You must then update your MDM policy with the new values and redistribute the JumpCloud Go extension to devices.

Preparing the macOS Policy​

  1. In the JumpCloud Admin Portal, go to Access > AI & SaaS Management > Settings.
  2. On the Settings page, under JumpCloud Go Extension for Third-Party MDM, copy the Client ID.
  3. Download the macOS template, or copy the full policy from the code block below. Jump to macOS policy.
  4. On your computer, open a plain-text editor and open the downloaded template, or paste the policy into a new file.
  5. In that file, replace each YOUR_CLIENT_ID_HERE with the Client ID. It appears once in the Google Chrome, Microsoft Edge, Arc, Brave, and Firefox sections. Leave the <string> tags in place.
  6. Return to the Settings page in the JumpCloud Admin Portal and copy the Client secret.
  7. Return to the policy file and replace each YOUR_CLIENT_SECRET_HERE with the Client secret. Leave the <string> tags in place.
  8. (Optional) In that same file, delete a browser you do not want. Delete its comment and the <dict> blocks under that comment, through the final </dict> for that browser. Chrome, Edge, Arc, and Brave each have two <dict> blocks. Firefox has one. Leave <array>, </array>, and everything after </array> in place.
  9. In that same file, confirm it still begins with <?xml version="1.0" encoding="UTF-8"?> and ends with </plist>.
  10. In the text editor, save the file as JumpCloudGo.mobileconfig.

macOS policy​

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<!-- ================= GOOGLE CHROME ================= -->
<dict>
<key>ExtensionInstallForcelist</key>
<array>
<string>jdoahkhfkeipblhbhppmcbdgapeoaopa;https://clients2.google.com/service/update2/crx</string>
</array>
<key>PayloadDisplayName</key>
<string>Google Chrome - Extension Install</string>
<key>PayloadIdentifier</key>
<string>com.google.Chrome.jumpcloud.install</string>
<key>PayloadType</key>
<string>com.google.Chrome</string>
<key>PayloadUUID</key>
<string>6306ACCA-BA1C-4B07-B67B-3DE1C250E800</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
<dict>
<key>clientId</key>
<string>YOUR_CLIENT_ID_HERE</string>
<key>clientSecret</key>
<string>YOUR_CLIENT_SECRET_HERE</string>
<key>PayloadDisplayName</key>
<string>Google Chrome - JumpCloud Credentials</string>
<key>PayloadIdentifier</key>
<string>com.google.Chrome.extensions.jdoahkhfkeipblhbhppmcbdgapeoaopa</string>
<key>PayloadType</key>
<string>com.google.Chrome.extensions.jdoahkhfkeipblhbhppmcbdgapeoaopa</string>
<key>PayloadUUID</key>
<string>82928135-A1A7-448D-81CA-5B3F40207860</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
<!-- ================= MICROSOFT EDGE ================= -->
<dict>
<key>ExtensionInstallForcelist</key>
<array>
<string>jdoahkhfkeipblhbhppmcbdgapeoaopa;https://clients2.google.com/service/update2/crx</string>
</array>
<key>PayloadDisplayName</key>
<string>Microsoft Edge - Extension Install</string>
<key>PayloadIdentifier</key>
<string>com.microsoft.Edge.jumpcloud.install</string>
<key>PayloadType</key>
<string>com.microsoft.Edge</string>
<key>PayloadUUID</key>
<string>B1A1E1E0-7C00-4740-97A2-1F4F9C25A24F</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
<dict>
<key>clientId</key>
<string>YOUR_CLIENT_ID_HERE</string>
<key>clientSecret</key>
<string>YOUR_CLIENT_SECRET_HERE</string>
<key>PayloadDisplayName</key>
<string>Microsoft Edge - JumpCloud Credentials</string>
<key>PayloadIdentifier</key>
<string>com.microsoft.Edge.extensions.jdoahkhfkeipblhbhppmcbdgapeoaopa</string>
<key>PayloadType</key>
<string>com.microsoft.Edge.extensions.jdoahkhfkeipblhbhppmcbdgapeoaopa</string>
<key>PayloadUUID</key>
<string>D8A5B9C2-33E0-466D-B05F-5E1C387D39FA</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
<!-- ================= ARC BROWSER ================= -->
<dict>
<key>ExtensionInstallForcelist</key>
<array>
<string>jdoahkhfkeipblhbhppmcbdgapeoaopa;https://clients2.google.com/service/update2/crx</string>
</array>
<key>PayloadDisplayName</key>
<string>Arc - Extension Install</string>
<key>PayloadIdentifier</key>
<string>company.thebrowser.Browser.jumpcloud.install</string>
<key>PayloadType</key>
<string>company.thebrowser.Browser</string>
<key>PayloadUUID</key>
<string>A5B82190-82C3-4411-92D1-71B2837C902B</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
<dict>
<key>clientId</key>
<string>YOUR_CLIENT_ID_HERE</string>
<key>clientSecret</key>
<string>YOUR_CLIENT_SECRET_HERE</string>
<key>PayloadDisplayName</key>
<string>Arc - JumpCloud Credentials</string>
<key>PayloadIdentifier</key>
<string>company.thebrowser.Browser.extensions.jdoahkhfkeipblhbhppmcbdgapeoaopa</string>
<key>PayloadType</key>
<string>company.thebrowser.Browser.extensions.jdoahkhfkeipblhbhppmcbdgapeoaopa</string>
<key>PayloadUUID</key>
<string>C4F18231-19B4-4D2A-88EF-A92B10482B1C</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
<!-- ================= BRAVE BROWSER ================= -->
<dict>
<key>ExtensionInstallForcelist</key>
<array>
<string>jdoahkhfkeipblhbhppmcbdgapeoaopa;https://clients2.google.com/service/update2/crx</string>
</array>
<key>PayloadDisplayName</key>
<string>Brave - Extension Install</string>
<key>PayloadIdentifier</key>
<string>com.brave.Browser.jumpcloud.install</string>
<key>PayloadType</key>
<string>com.brave.Browser</string>
<key>PayloadUUID</key>
<string>D91238A4-4530-4921-A81B-83210C19028F</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
<dict>
<key>clientId</key>
<string>YOUR_CLIENT_ID_HERE</string>
<key>clientSecret</key>
<string>YOUR_CLIENT_SECRET_HERE</string>
<key>PayloadDisplayName</key>
<string>Brave - JumpCloud Credentials</string>
<key>PayloadIdentifier</key>
<string>com.brave.Browser.extensions.jdoahkhfkeipblhbhppmcbdgapeoaopa</string>
<key>PayloadType</key>
<string>com.brave.Browser.extensions.jdoahkhfkeipblhbhppmcbdgapeoaopa</string>
<key>PayloadUUID</key>
<string>E193C201-92A1-4200-9B21-032F8273901A</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
<!-- ================= MOZILLA FIREFOX ================= -->
<dict>
<key>EnterprisePoliciesEnabled</key>
<true/>
<key>ExtensionSettings</key>
<dict>
<key>go@jumpcloud.com</key>
<dict>
<key>installation_mode</key>
<string>force_installed</string>
<key>install_url</key>
<string>https://addons.mozilla.org/firefox/downloads/latest/jumpcloud-go/latest.xpi</string>
<key>updates_disabled</key>
<false/>
</dict>
</dict>
<key>3rdparty</key>
<dict>
<key>Extensions</key>
<dict>
<key>go@jumpcloud.com</key>
<dict>
<key>clientId</key>
<string>YOUR_CLIENT_ID_HERE</string>
<key>clientSecret</key>
<string>YOUR_CLIENT_SECRET_HERE</string>
</dict>
</dict>
</dict>
<key>PayloadDisplayName</key>
<string>Firefox - Extension &amp; Credentials</string>
<key>PayloadIdentifier</key>
<string>org.mozilla.firefox.jumpcloud.install</string>
<key>PayloadType</key>
<string>org.mozilla.firefox</string>
<key>PayloadUUID</key>
<string>E7C82D7B-9A82-411A-9321-0D4A009C75B1</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</array>
<key>PayloadDisplayName</key>
<string>JumpCloud Go - All Browsers Extension &amp; Credentials</string>
<key>PayloadIdentifier</key>
<string>com.jumpcloud.go.universalpolicy</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>98D437F9-C11A-480A-B23B-998C123D8A99</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>PayloadScope</key>
<string>System</string>
</dict>
</plist>

Preparing the Windows Policy​

  1. In the JumpCloud Admin Portal, go to Access > AI & SaaS Management > Settings.
  2. On the Settings page, under JumpCloud Go Extension for Third-Party MDM, copy the Client ID.
  3. Download the Windows template, or copy the full policy from the code block below. Jump to Windows policy.
  4. On your computer, open a plain-text editor and open the downloaded template, or paste the policy into a new file.
  5. In that file, on the first line, replace YOUR_CLIENT_ID_HERE with the Client ID. Leave the quotation marks in place.
  6. Return to the Settings page in the JumpCloud Admin Portal and copy the Client secret.
  7. Return to the policy file. On the second line, replace YOUR_CLIENT_SECRET_HERE with the Client secret. Leave the quotation marks in place.
  8. In the rest of that file, leave $clientId and $clientSecret as they are. Those lines use the two values from the first two lines.
  9. (Optional) In that same file, delete a browser you do not want. Delete its numbered comment and every line under it, through its last Set-ItemProperty line. Leave the first two lines of the file in place.
  10. In the text editor, save the file as JumpCloudGo.ps1.

Windows policy​

$clientId = "YOUR_CLIENT_ID_HERE"
$clientSecret = "YOUR_CLIENT_SECRET_HERE"
# 1. Google Chrome
$chromePath = "HKLM:\SOFTWARE\Policies\Google\Chrome"
if (!(Test-Path "$chromePath\ExtensionInstallForcelist")) { New-Item -Path "$chromePath\ExtensionInstallForcelist" -Force | Out-Null }
Set-ItemProperty -Path "$chromePath\ExtensionInstallForcelist" -Name "1" -Value "jdoahkhfkeipblhbhppmcbdgapeoaopa;https://clients2.google.com/service/update2/crx"
if (!(Test-Path "$chromePath\3rdparty\extensions\jdoahkhfkeipblhbhppmcbdgapeoaopa\policy")) { New-Item -Path "$chromePath\3rdparty\extensions\jdoahkhfkeipblhbhppmcbdgapeoaopa\policy" -Force | Out-Null }
Set-ItemProperty -Path "$chromePath\3rdparty\extensions\jdoahkhfkeipblhbhppmcbdgapeoaopa\policy" -Name "clientId" -Value $clientId
Set-ItemProperty -Path "$chromePath\3rdparty\extensions\jdoahkhfkeipblhbhppmcbdgapeoaopa\policy" -Name "clientSecret" -Value $clientSecret
# 2. Microsoft Edge
$edgePath = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"
if (!(Test-Path "$edgePath\ExtensionInstallForcelist")) { New-Item -Path "$edgePath\ExtensionInstallForcelist" -Force | Out-Null }
Set-ItemProperty -Path "$edgePath\ExtensionInstallForcelist" -Name "1" -Value "jdoahkhfkeipblhbhppmcbdgapeoaopa;https://clients2.google.com/service/update2/crx"
if (!(Test-Path "$edgePath\3rdparty\extensions\jdoahkhfkeipblhbhppmcbdgapeoaopa\policy")) { New-Item -Path "$edgePath\3rdparty\extensions\jdoahkhfkeipblhbhppmcbdgapeoaopa\policy" -Force | Out-Null }
Set-ItemProperty -Path "$edgePath\3rdparty\extensions\jdoahkhfkeipblhbhppmcbdgapeoaopa\policy" -Name "clientId" -Value $clientId
Set-ItemProperty -Path "$edgePath\3rdparty\extensions\jdoahkhfkeipblhbhppmcbdgapeoaopa\policy" -Name "clientSecret" -Value $clientSecret
# 3. Mozilla Firefox
$ffPath = "HKLM:\SOFTWARE\Policies\Mozilla\Firefox"
if (!(Test-Path "$ffPath\Extensions\Install")) { New-Item -Path "$ffPath\Extensions\Install" -Force | Out-Null }
Set-ItemProperty -Path "$ffPath\Extensions\Install" -Name "1" -Value "https://addons.mozilla.org/firefox/downloads/latest/jumpcloud-go/latest.xpi"
if (!(Test-Path "$ffPath\3rdparty\Extensions\go@jumpcloud.com")) { New-Item -Path "$ffPath\3rdparty\Extensions\go@jumpcloud.com" -Force | Out-Null }
Set-ItemProperty -Path "$ffPath\3rdparty\Extensions\go@jumpcloud.com" -Name "clientId" -Value $clientId
Set-ItemProperty -Path "$ffPath\3rdparty\Extensions\go@jumpcloud.com" -Name "clientSecret" -Value $clientSecret
# 4. Brave Browser
$bravePath = "HKLM:\SOFTWARE\Policies\BraveSoftware\Brave"
if (!(Test-Path "$bravePath\ExtensionInstallForcelist")) { New-Item -Path "$bravePath\ExtensionInstallForcelist" -Force | Out-Null }
Set-ItemProperty -Path "$bravePath\ExtensionInstallForcelist" -Name "1" -Value "jdoahkhfkeipblhbhppmcbdgapeoaopa;https://clients2.google.com/service/update2/crx"
if (!(Test-Path "$bravePath\3rdparty\extensions\jdoahkhfkeipblhbhppmcbdgapeoaopa\policy")) { New-Item -Path "$bravePath\3rdparty\extensions\jdoahkhfkeipblhbhppmcbdgapeoaopa\policy" -Force | Out-Null }
Set-ItemProperty -Path "$bravePath\3rdparty\extensions\jdoahkhfkeipblhbhppmcbdgapeoaopa\policy" -Name "clientId" -Value $clientId
Set-ItemProperty -Path "$bravePath\3rdparty\extensions\jdoahkhfkeipblhbhppmcbdgapeoaopa\policy" -Name "clientSecret" -Value $clientSecret

Deploying with Microsoft Intune​

macOS​

  1. Sign in to the Microsoft Intune admin center.
  2. Go to Devices > macOS > Configuration profiles.
  3. Click Create profile.
  4. Set Profile type to Templates, select Custom, and click Create.
  5. Name the profile. For example, macOS - JumpCloud Go All Browsers.
  6. Upload the .mobileconfig file.
  7. Assign the profile to the Mac device groups or user groups.
  8. Click Create.

Windows​

  1. In the Microsoft Intune admin center, go to Devices > Scripts.
  2. Click Add, then select Windows 10 and later.
  3. Name the script. For example, Windows - JumpCloud Go All Browsers.
  4. Upload the .ps1 file.
  5. Set Run this script using the logged on credentials to No. The script must run as SYSTEM so it can write to HKLM.
  6. Set Enforce script signature check to No.
  7. Set Run script in 64-bit PowerShell to Yes.
  8. Assign the script to the Windows device groups.
  9. Click Add.

Deploying with Jamf Now​

  1. Log in to Jamf Now and click Blueprints.
  2. Select the Blueprint assigned to the target devices.
  3. Select Custom Profiles.
  4. Click Add a Custom Profile.
  5. Upload the .mobileconfig file.
  6. Click Add Custom Profile.

Deploying with Kandji​

  1. Log in to Kandji and click Library.
  2. Click Add New.
  3. Select Custom Profile, then click Add & Configure.
  4. Name the profile. For example, JumpCloud Go - All Browsers Extension & Credentials.
  5. Select the Blueprints that should receive the profile.
  6. Set Device Family to Mac.
  7. Upload the .mobileconfig file.
  8. Click Save. Kandji pushes the profile at the next device check-in, usually within 15 minutes.

Learn More​

Was this information helpful?