Enable Lost Mode on Mobile Devices

If a company-owned device is lost or misplaced, you can enable Lost Mode from within the JumpCloud Admin Portal. When enabling Lost Mode from the Admin Portal, you can supply contact information that will appear on the device’s screen to prompt the holder of the device to return it to you. If the device is returned, you can then turn off Lost Mode and restore the device to full functionality.

Prerequisites:

• Apple:
  • Company-owned (supervised) device enrolled in MDM
    • iOS 9.3+
    • iPadOS 9.3+
• Android:
  • Company-owned device enrolled in EMM
    • Fully managed (Android 11+)
    • Dedicated device (Android 11+)
    • Company-owned device with work profile (Android 13+)

Considerations:

• Android:
  • If a user has recently reset their password within the last 12 hours, Lost Mode functions are restricted for security purposes. This is to prevent bad actors who may have gained access to password reset from exploiting Lost Mode.
  • After a user manually exits Lost Mode on their device, Lost Mode functions are restricted for 12 hours as a security measure to prevent rapid re-locking of the device.

Enabling Lost Mode from the Admin Portal

To enable Lost Mode:

1. Log in the JumpCloud Admin Portal.
2. Go to DEVICE MANAGEMENT > Devices and locate the device.
3. From the device details page, click Actions > Enable Lost Mode.
   
4. Configure the visible messaging on the device when in Lost Mode by selecting the Display message on lock screen option and filling in the corresponding Message field. These settings will depend on the device OS, and at least one field is required:
   1. For Apple:
      • Display message on lock screen - Include an informational message, such as “This Phone is Lost”
      • Display phone number on lock screen - Include a contact phone number
      • Display Footnote on lock screen - Include any additional messaging, such as instructions for the finder of the device.
        
   2. For Android:
      • Display message on lock screen - Include an informational message, such as “This Phone is Lost”
      • Display phone number on lock screen - Include a contact phone number
      • Display Email Address on lock screen - Include a contact email address
      • Display Street Address on lock screen - Include a contact address
      • Display Organization Name on lock screen - Include a company name 
        
5. Click Enable Lost Mode.
   • A Lost Mode Enabled badge appears on the device details page and in the Lost Mode column on the devices list.
   • The Enabled badge is also reflected in the Lost Mode column of the devices list. You can sort this column from the list view to quickly see all devices in your org that have Lost Mode enabled.
   • Device behavior varies based on OS. Jump to Understanding Device Behavior in Lost Mode.

Understanding Device Behavior in Lost Mode

Lost Mode behavior varies depending on the device OS.

Apple

For iOS/iPadOS, upon Lost Mode activation:

• The device is immediately locked, displaying the Lost Mode lock screen configured above. 
• The Home button is not unusable, rendering the device nonfunctional. The device is locked even if it did not previously have a passcode set. 
• The JumpCloud Admin Portal reflects the Lost Mode Enabled badge in device details. 
• JumpCloud initiates location tracking requests every 3 hours.

Android

For Android, Lost Mode is divided between alert and active phases.

Alert Phase

When an Android device is placed in Lost Mode, it enters an alert phase and emits a loud ring for 5 minutes. No location information is reported. The user is presented two options:

• This is my device: Allows the user to enter the device passcode to exit Lost Mode. If the passcode is entered successfully before the 5-minute timer expires, no location data is reported to JumpCloud.
• I found this device: Stops the device ringing and transitions the device to the active phase of Lost Mode.

In the alert phase, the JumpCloud Admin Portal reflects an Enabling Lost Mode badge in device details.

Active Phase

In the active phase, the lost device stops ringing and begins transmitting location updates each minute. Users are presented with up to three options:

• Unlock: Allows the user to enter the device passcode to exit Lost Mode.
• Call owner: Initiates a call to the provided phone number (if available). If no phone has been specified in the Lost Mode configuration above, this option is not displayed.
• Emergency: Gives the user access to the emergency dial pad.

In the active phase, the JumpCloud Admin Portal reflects the Lost Mode Enabled badge in device details. Location updates continue to be reported to JumpCloud until Lost Mode is disabled or the device loses connectivity.

To disable Lost Mode:

1. Log in the JumpCloud Admin Portal.
2. Go to DEVICE MANAGEMENT > Devices and locate the device.
3. From the device details page, click Actions > Disable Lost Mode.
4. From the confirmation modal, click Disable Lost Mode. A Directory Insights event is logged and the device exits Lost Mode. The user can continue to use their device as normal.
   

Understanding Lost Mode Events in Directory Insights

Several events are logged specifically for Lost Mode under INSIGHTS > Directory in the Admin Portal.

Apple

An mdm_command_result Event Type is logged for the following Request Types:

• EnableLostMode: Confirms successful Lost Mode activation.
• DisableLostMode: Confirms successful Lost Mode deactivation.
• DeviceLocation: Contains latitude, longitude, and timestamp of device location tracking updates.
  • Expand the mdm_command_result event and click JSON to view location details.

Android

• GOOGLE_EMM_LOST_MODE_ENABLED: Confirms successful Lost Mode activation.
• GOOGLE_EMM_LOST_MODE_DISABLED: Confirms successful Lost Mode deactivation.
• GOOGLE_EMM_RESET_PASSWORD_RECENTLY: Indicates a recent password reset, limiting Lost Mode functionality.
• GOOGLE_EMM_USER_EXIT_LOST_MODE_RECENTLY: Indicates recent user exit from Lost Mode, limiting subsequent actions.
• GOOGLE_EMM_ALREADY_IN_LOST_MODE: Indicates an attempt to enable Lost Mode on an already locked device.
• GOOGLE_EMM_NOT_IN_LOST_MODE: Indicates an attempt to disable Lost Mode on a device not in Lost Mode.