Provision New Users on Device Login

Self-Service Account Provisioning lets users bind their account to a JumpCloud-managed macOS or Windows device directly from the login window. This streamlines the onboarding experience for users and enables light-touch device configuration for admins.  

When enabled, users see Sign in with JumpCloud at the device login window and enter their existing JumpCloud user credentials to begin the user-led provisioning process.

Understanding the Benefits:

• Manage wireless connectivity from the improved macOS device login window. 
• Save time and IT resources spent manually associating users to devices with a light-touch device onboarding process for admins.
• Simplify the onboarding experience and let users start working quickly from their JumpCloud-managed account on their JumpCloud-managed device.
• Enable login of federated user identities to JumpCloud-managed devices. See Get Started: Federated Authentication.

Prerequisites:

• macOS and Windows devices that meet JumpCloud’s Agent Compatibility and System Requirements.
  • Windows Home editions aren’t supported.
  • Windows Server editions aren’t supported.
  • Windows ARM editions are not supported. Sign in with JumpCloud won’t appear on the login window of these devices.
  • Active Directory (AD) and Entra ID joined devices are not supported. 
• The JumpCloud agent has to be installed and running on macOS and Windows devices. See Install the Mac Agent and Install the Windows Agent. 
• The device cannot have an existing JumpCloud-bound user account.

Considerations

• Self-Service Account Provisioning can only add an existing JumpCloud user to a device that doesn’t have any JumpCloud user associations.
  • Takeover of an existing local account on a device isn’t supported. Device association will fail if the user signing in has a JumpCloud username that matches an existing local account. 
• This feature doesn’t support creating a new JumpCloud user at the device login window. The JumpCloud user must exist within the org and have credentials assigned.

Enabling Self-Service Account Provisioning (Admin)

To enable Self-Service Account Provisioning for your org: 

1. Log in to the JumpCloud Admin Portal.
2. Go to DEVICE MANAGEMENT > Devices > Device Settings.
3. Under Self-Service Account Provisioning:
   1. Click to toggle macOS to On to enable Self-Service Account Provisioning on macOS devices.
   2. Click to toggle Windows to On to enable Self-Service Account Provisioning on Windows devices.
4. Under User Permission-level, choose the permissions assigned to a user when they’re provisioned on the device:
   1. Choose Administrator to assign administrator/sudo privileges to the user.   
   2. Choose Standard to assign non-administrative or non-sudo privileges to the user. 

Exploring the macOS Login Window

Enabling Self-Service Account Provisioning deploys the updated login window to macOS devices. There are several benefits over the standard macOS login window:

1. Manage WiFi connectivity from the login window by clicking Wireless. 
2. Refresh the login window to update any user association changes made by admins. 
3. View internet connectivity status at a glance with the red or green indicator in the top right menu bar. 
4. Review device health and diagnostic details by clicking the (i) in the top right menu bar for System Information.

Using Self-Service Account Provisioning (User)

When your admin enables the feature, the Sign in with JumpCloud button appears on your macOS or Windows device login window. The login process will differ slightly depending on the OS of your device. 

Signing in on a macOS Device 

To use Sign In with JumpCloud on a macOS device:

1. In the macOS menu bar at the top right, ensure the device is connected to the internet and shows Online status before continuing.
2. On the macOS login window, click Sign in with JumpCloud.
   
3. In the User Login window, enter your email address and click Continue.
4. Enter your password and click Login.
   

5. After successful authentication, the account is created on the device and directs you back to the login screen.
6. Click the newly added icon for your account and then enter your password.
   
7. Follow the on-screen prompts to complete the macOS account configuration.
8. Once completed, you’ll be logged in.

Signing in on a Windows Device

To use Sign In with JumpCloud on a Windows device:

1. Ensure the device is connected to the internet before continuing.
2. On the Windows login window, click Sign In with JumpCloud at the bottom left.
3. Under JumpCloud, Click here to sign in.
   
4. In the User Login window, enter your email address and click Continue.
5. Enter your password and click Login.

6. You’ll be prompted to enter your password and set a PIN to complete the setup. The PIN can be used as an alternative to the JumpCloud account password.
   

7. The Windows account provisioning process will begin. Once completed, you’ll be logged in.

Disabling Self-Service Account Provisioning (Admin)

To disable Self-Service Account Provisioning for your org: 

1. Log in to the JumpCloud Admin Portal.
2. Go to DEVICE MANAGEMENT > Devices > Device Settings.
3. Under Self-Service Account Provisioning:
   1. Click to toggle macOS to Off to disable on macOS devices.
   2. Click to toggle Windows to Off to disable on Windows devices.

FAQ

Troubleshooting

See Troubleshoot: Provision New Users on Device Login.