- \n
- Setting Permissions on a User Group per Device Group Bind<\/li>\n\n\n\n
- Setting Permissions on a User Group for All Associated Device Groups<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Users<\/a>\n
- \n
- Setting Permissions on a User per Device Bind <\/li>\n\n\n\n
- Setting Temporary Permissions on a User per Device Bind<\/li>\n\n\n\n
- Setting Permissions on a User for All Associated Devices<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\")
<\/p><\/div>Important:<\/strong> \nWindows users need to log out and log back in for permissions changes to take effect. <\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
User Groups<\/strong><\/h2>\n\n\n\n
Setting Permissions on a User Group per Device Group Bind<\/strong><\/h3>\n\n\n\n
Setting permissions at the user group level centralizes management of elevated device permissions in a single place. Permissions set at the user group level will be applied to associated device groups. Group members will inherit permissions to devices that are associated with those device groups. <\/p>\n\n\n\n
Considerations<\/strong>:<\/p>\n\n\n\n
- \n
- Permissions that are granted directly on a user supersede permissions granted at a user group level.<\/li>\n\n\n\n
- Permissions set at the user group level supersede any permissions previously set on the user group\u2019s bind to a device group.<\/li>\n\n\n\n
- It\u2019s possible to have permissions added on both the direct user association to the device and the indirect group association to the device. This is visible on the association of a user and a device. However, if there is an indirect group association to the device, you won’t be able to apply elevated permissions directly between a user and device. To be able to apply elevated permissions directly between the user and device, the user or device needs to be removed from the user group.<\/li>\n\n\n\n
- It’s possible to remove duplicate permission assignments on a user to device association via removing the elevated permission on the associated device by selecting No Elevated Permissions or by removing the user from the group.<\/li>\n\n\n\n
- If group permissions are inherited globally on a user group, the permissions can show up as inherited group permissions.<\/li>\n<\/ul>\n\n\n\n
There are two ways to provide Admin\/Sudo access through user groups:<\/p>\n\n\n\n
- \n
- Via the Device Groups tab, so that all users in a user group have access to a specific device group(s) associated to that user group.<\/li>\n\n\n\n
- Via the Details tab, so that all users in a user group have access to all device groups that are bound to that user group.<\/li>\n<\/ul>\n\n\n\n
To give users within a user group Admin\/Sudo access to devices via the Device Groups tab<\/strong>:<\/p>\n\n\n\n
- \n
- Log in to the JumpCloud Admin Portal<\/a>. <\/li>\n\n\n\n
- Go to USER MANAGEMENT<\/strong> > User Groups.<\/strong><\/li>\n\n\n\n
- Select the applicable group by clicking on the User Group<\/strong> name under the Group<\/strong> column. <\/li>\n\n\n\n
- Click the Device Groups<\/strong> tab and then select the applicable device group under the Group<\/strong> column.<\/li>\n\n\n\n
- Click the dropdown arrow under the Permissions<\/strong> column, select the desired permission, and click save<\/strong>. The sudo permission is now set for users in that user group for every device associated with the device group. <\/li>\n<\/ol>\n\n\n\n
![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/05\/UserGroups_DeviceAdminSudoPerm-1024x492.png\")
<\/figure>\n\n\n\n![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\")
<\/p><\/div>Note:<\/strong> \n- \n
- When unchecked, permissions can be managed from the Device Groups tab or on an individual user\/device basis.<\/li>\n\n\n\n
- Passwordless Sudo is applicable to Linux and Mac devices and only recommended for service accounts.<\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Setting Permissions on a User Group for All Associated Device Groups<\/strong><\/h3>\n\n\n\n
To give users within a user group Global Admin\/Sudo access via the Details tab<\/strong>:<\/p>\n\n\n\n
- \n
- Log in to the JumpCloud Admin Portal<\/a>. <\/li>\n\n\n\n
- Go to USER MANAGEMENT<\/strong> > User Groups<\/strong>.<\/li>\n\n\n\n
- Select a User Group from the list. The administrator will see the Details<\/strong> tab for that user group by default.<\/li>\n\n\n\n
- Click the Enable users as Global Administrator\/Sudo on all devices associated through device groups<\/strong> checkbox and click save<\/strong>. All users in that user group will be given global admin permissions on all devices bound to any device group associated with the user group.\n
- \n
- Passwordless Sudo is applicable to Linux and Mac devices and only recommended for service accounts<\/li>\n\n\n\n
- You can also go to the Device Groups<\/strong> tab to control this setting on a group to group basis<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- A Permission Settings Update email notification is sent.<\/li>\n<\/ol>\n\n\n\n
![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/05\/UserGroup_Details_AdminSudoPerm-1024x421.png\")
<\/figure>\n\n\n\nUsers<\/strong><\/h2>\n\n\n\n
Setting Permissions on a User per Device Bind<\/strong><\/h3>\n\n\n\n
Users that aren’t admins on all of their devices can be given elevated permissions on a per-device basis. <\/p>\n\n\n\n
Considerations<\/strong>:<\/p>\n\n\n\n
- \n
- Elevated rights are only granted on the devices you explicitly choose. By default, users don\u2019t have administrator permissions.\n
- \n
- The only exception to this are Apple Device Enrollment (AD) enrolled users, who do have admin permissions.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- If the user is bound to the device via group membership, an indirect device binding is created. To remove access to the device, remove the user from the group.<\/li>\n\n\n\n
- If you still wish to assign elevated permissions on a per device basis, make sure the device is not part of an existing user group. See\u00a0B<\/a>est Practices for Migration of Device Permissions from a User to a Group<\/a>\u00a0for more information.<\/li>\n\n\n\n
- Suspended or revoked users won\u2019t have access to the device. See Suspend and Reactivate User Accounts<\/a> to learn more. <\/li>\n\n\n\n
- You can also manage device level permission from\u00a0DEVICE MANAGEMENT<\/strong> > Devices\u00a0<\/strong>>\u00a0Users<\/strong>.<\/li>\n<\/ul>\n\n\n\n
To set a user as an Admin\/Sudo on a connected device<\/strong>: <\/p>\n\n\n\n
- \n
- Log in to the JumpCloud Admin Portal<\/a>. <\/li>\n\n\n\n
- Go to USER MANAGEMENT<\/strong> > Users<\/strong>.<\/li>\n\n\n\n
- Select a user and click the Devices<\/strong> tab to view the devices connected to this user.<\/li>\n\n\n\n
- (Optional) To display both bound and unbound devices, clear the show bound device <\/strong>check box. <\/li>\n\n\n\n
- On the desired device, go to the Permissions<\/strong> column and click the pencil to Edit<\/strong> permissions.<\/li>\n\n\n\n
- In the Permissions Change window, select Administrator\/Sudo Access<\/strong> and set the Duration to Permanently Until Removed<\/strong>.<\/li>\n\n\n\n
- Click Apply<\/strong>.<\/li>\n\n\n\n
- Click save user<\/strong>.
![\"\"](\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/Users_Devices_AdminSudoPerm_new.jpg\")
<\/li>\n<\/ol>\n\n\n\nSetting Temporary Permissions on a User per Device Bind<\/h3>\n\n\n\n
You can also assign a user that’s not admin on all of their devices temporary elevated privileges<\/strong>. A user can perform needed administrative actions on their device for a fixed period of time, and then their permissions are automatically revoked.\u00a0<\/p>\n\n\n\n
Considerations<\/strong>:<\/p>\n\n\n\n
- \n
- You can only grant temporary elevated permissions on a direct user to device association. Group associations aren\u2019t supported.<\/li>\n\n\n\n
- You can’t assign temporary elevated permissions to a user that’s set as a Global Admin\/Sudo on all devices. See the following section Setting Permissions on a User for all Associated Devices<\/a> to learn more. <\/li>\n\n\n\n
- Permission changes can take up to 10 minutes to expire on the device.<\/li>\n\n\n\n
- A network connection is required to make permissions changes. If a device\u2019s network connection is interrupted when the temporary permissions are scheduled to expire, the temporarily assigned permissions may persist until the device reconnects and receives new instructions to revoke the elevated permissions.<\/li>\n\n\n\n
- Due to limitations in the Windows OS, admin functions will persist for a user on a Windows device until the user logs out.<\/li>\n<\/ul>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\")
<\/p><\/div>Tip:<\/strong> \nHere’s a guided simulation: Temporary User Permissions per Device<\/a>.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
To assign temporary Admin\/Sudo access to a user\u2019s device<\/strong>: <\/p>\n\n\n\n
- \n
- Log in to the JumpCloud Admin Portal<\/a>. <\/li>\n\n\n\n
- Go to USER MANAGEMENT<\/strong> > Users<\/strong>.<\/li>\n\n\n\n
- Select a user. The user Highlights tab displays. <\/li>\n\n\n\n
- Click the Devices<\/strong> tab to view the devices connected to this user. The user\u2019s bound devices display by default.<\/li>\n\n\n\n
- (Optional) To display both bound and unbound devices, clear the show bound device <\/strong>check box. <\/li>\n\n\n\n
- On the desired device, go to the Permissions<\/strong> column and click the pencil to Edit<\/strong> permissions. <\/li>\n\n\n\n
- In the Permissions Change window, select Administrator\/Sudo Access<\/strong> and select the appropriate Duration <\/strong>from the dropdown.\n
- \n
- For example, if the user needs to install software on their device, select a short time period such as 1 hour. After the designated time, the user\u2019s permission returns to No Elevated Permissions<\/strong><\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Click Apply<\/strong>.<\/li>\n\n\n\n
- Click save user<\/strong>.
![\"\"](\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/Users_Devices_TempAdminSudoPermissions.jpg\")
<\/li>\n<\/ol>\n\n\n\nRevoking an Existing Temporary Permissions Change<\/h4>\n\n\n\n
You can remove a user\u2019s temporary elevated privileges ahead of the expiration time set in the previous step.<\/p>\n\n\n\n
To modify existing temporary Admin\/Sudo permissions<\/strong>:<\/p>\n\n\n\n
- \n
- Log in to the JumpCloud Admin Portal<\/a>. <\/li>\n\n\n\n
- Go to USER MANAGEMENT<\/strong> > Users.<\/strong><\/li>\n\n\n\n
- Select the user in the list. The user Highlights displays. <\/li>\n\n\n\n
- Click the Devices<\/strong> tab and locate the device with remaining time on Administrator\/Sudo Access. <\/li>\n\n\n\n
- In the Permissions column, click the pencil to Edit<\/strong> the elevated permissions.<\/li>\n\n\n\n
- In the Permissions Change window, select No Elevated Permissions<\/strong> to change the user\u2019s permission level for this device.<\/li>\n\n\n\n
- Click Apply<\/strong>.<\/li>\n\n\n\n
- Click save<\/strong> user<\/strong>.
![\"\"](\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/Users_Devices_TempAdminSudoPermissions_Duration2.jpg\")
<\/li>\n<\/ol>\n\n\n\nSetting Permissions on a User for all Associated Devices<\/strong><\/h3>\n\n\n\n
Admins can assign global Admin\/Sudo permissions on a user to apply to all devices associated with that user.<\/p>\n\n\n\n
Considerations<\/strong>:<\/p>\n\n\n\n
- \n
- The enabled user is given global Admin\/Sudo privileges on all devices to which they are bound.<\/li>\n\n\n\n
- When the\u00a0Enable as Global Administrator\/Sudo on all device associations<\/strong>\u00a0option is cleared, you can manage global Admin\/Sudo privileges on a per-device basis from the Devices tab.<\/li>\n\n\n\n
- Passwordless Sudo can also be assigned to Device Admins for Mac and Linux. You need to configure Windows device UAC settings to require an admin password.<\/li>\n\n\n\n
- Global settings can’t be modified on a per-device basis.<\/li>\n\n\n\n
- You can also manage a user’s permission level from\u00a0DEVICE MANAGEMENT<\/strong>\u00a0>\u00a0Devices\u00a0<\/strong>>\u00a0Users<\/strong>.<\/li>\n<\/ul>\n\n\n\n
To set a user as a global Admin\/Sudo on all associated devices<\/strong>:<\/p>\n\n\n\n
- \n
- Log in to the JumpCloud Admin Portal<\/a>. <\/li>\n\n\n\n
- Go to USER MANAGEMENT<\/strong> > Users<\/strong>.<\/li>\n\n\n\n
- Select a user and click the Details<\/strong> tab.<\/li>\n\n\n\n
- Expand the User Security Settings and Permissions<\/strong> section.<\/li>\n\n\n\n
- Click the Enable as Global Administrator\/Sudo on all device associations<\/strong> checkbox to select it and click save<\/strong>. You’ll receive an email from JumpCloud confirming that the user now has global Admin\/Sudo permissions on all associated devices.<\/li>\n\n\n\n
- To remove global Admin\/Sudo permissions for all of a user’s devices, uncheck the Enable as Global Administrator\/Sudo on all device associations<\/strong> checkbox and click save<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/05\/Users_Details_AdminSudoPerm-1024x875.png\")
<\/figure>\n\n\n\nSetting Permissions with Self-Service Account Provisioning<\/h3>\n\n\n\n
If you\u2019ve enabled Self-Service Account Provisioning, you can set Admin\/Sudo permissions for newly joined accounts from the Device Settings menu. See Provision New Users on Device Login<\/a>.<\/p>\n\n\n\n
A user\u2019s permission level can be adjusted after provisioning by Setting Permissions on a User per Device Bind<\/a>.
![\"\"](\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/ssap_admin_portal_device_settings.jpg\")
<\/p>\n","protected":false},"excerpt":{"rendered":"
- Elevated rights are only granted on the devices you explicitly choose. By default, users don\u2019t have administrator permissions.\n