Skip to main content

Configure Island Browser Device Trust (Preview)

JumpCloud integrates with the Island Enterprise Browser so you can verify browser-level device trust in Conditional Access Policies (CAPs). After you connect Island, JumpCloud calls the Island Verified Device Access API during Admin Portal, User Portal, and single sign-on (SSO) application sign-in flows.

Supported endpoints include Windows, macOS, and Linux.

Prerequisites​

  • An Island Enterprise Browser deployment with access to the Island Management Console.
  • A fixed Device Trust API JSON Web Token (JWT) from Island. JumpCloud stores this token securely and uses it to verify the Island Verified Device Access API challenge.
  • Access to the JumpCloud Admin Portal with Administrator permissions.
  • A JumpCloud plan that supports conditional policies (for example, Platform Prime or Enterprise add-on).

Considerations​

  • Island uses a fixed, long-term JWT for API authentication. Plan your token rotation with Island before the token expires.
  • If your data is stored outside of the US, confirm you use the correct regional Admin Portal URL.

Configuration Steps​

Complete the Island-side configuration before configuring JumpCloud. Users cannot satisfy Island CAP conditions until both sides are configured.

Island Management Console​

Complete these Island-side steps before users can satisfy Island CAP conditions:

  1. Register the JumpCloud access URL as the network service (IdP) in the Island Management Console.
  2. Copy the JumpCloud access URL and register it in the Island Management Console.
  3. Generate a Device Trust API JWT.
  4. Confirm Island browser profiles and devices are enrolled in your corporate Island tenant.

JumpCloud Admin Portal​

  1. Log in to the JumpCloud Admin Portal.
Important

If your data is stored outside of the US, check which login URL you should be using depending on your region. If your organization uses LDAP, RADIUS, or requires firewall allow list configuration, the Fully Qualified Domain Names (FQDNs) will also be region specific. See JumpCloud Data Centers for the URLs, FQDNs, and IP addresses.

  1. Go to Security > Device Trust.
  2. Click the Browser Integrations tab, then go to the Island Device Trust section.
  3. Copy the JumpCloud access URL and register it in the Island Management Console.
  4. Click Add Credentials. The Add Island Credentials pop-up window is displayed.
  5. Paste the Device Trust API JWT generated from Island into the JumpCloud portal.
  6. Click Save.
note

Allow up to 5 minutes for the change to propagate before testing.

Conditional Access Policies in Action​

After Island Device Trust is active, add Island-specific conditions to CAPs that protect the Admin Portal, User Portal, or SSO applications.

Example: Enforcing Island Browser Access​

In a typical strict access scenario, administrators can create a CAP targeting the User Portal or SSO applications with the following rule:

  • Condition: When Browser Type is not Island Enterprise Browser.
  • Action: Denied (with a custom message: "Please sign in from Island browser to access this resource").
  • Result: If a user attempts to log in via a standard browser like Google Chrome, JumpCloud automatically denies access and displays the custom warning. If the user accesses the same portal via the Island Enterprise Browser, the conditional access policy evaluates successfully and grants the user access to the resource.

Available Island CAP Conditions​

ConditionUse When
Managed Island BrowserYou want to require access through the Island browser. Standard browsers cannot satisfy this condition.
Island enrollment domainYou want to match the Island device enrollment domain for fully managed devices.
Island profile domainYou want to match the Island profile enrollment domain for BYOD scenarios.

Troubleshooting and Status​

Use Directory Insights and the CAP Error ID on denial screens to investigate failed evaluations. If the API authentication fails (for example, returning a 401 Unauthorized error), generate a new JWT in the Island Management Console and update the JumpCloud Device Trust configuration.

Was this information helpful?