{"id":75872,"date":"2024-03-27T13:39:16","date_gmt":"2024-03-27T17:39:16","guid":{"rendered":"https:\/\/jumpcloud.com\/?post_type=support&#038;p=75872"},"modified":"2024-06-06T18:00:54","modified_gmt":"2024-06-06T22:00:54","slug":"set-admin-sudo-permissions","status":"publish","type":"support","link":"https:\/\/jumpcloud.com\/support\/set-admin-sudo-permissions","title":{"rendered":"Set Admin\/Sudo Permissions"},"content":{"rendered":"\n<p>The JumpCloud agent lets you set user access controls to elevate the standard permissions on a user to Admin\/Sudo or Passwordless Sudo. Specific, privileged permissions on devices ensure that your company&#8217;s devices are secure and&nbsp;protected.&nbsp;<\/p>\n\n\n\n<p>There are two ways to manage access levels of users:<\/p>\n\n\n\n<ul>\n<li><a href=\"#user-groups\">User Groups<\/a>\n<ul>\n<li>Setting Permissions on a User Group per Device Group Bind<\/li>\n\n\n\n<li>Setting Permissions on a User Group for All Associated Device Groups<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"#users\">Users<\/a>\n<ul>\n<li>Setting Permissions on a User per Device Bind&nbsp;<\/li>\n\n\n\n<li>Setting Temporary Permissions on a User per Device Bind<\/li>\n\n\n\n<li>Setting Permissions on a User for All Associated Devices<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card important\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Important:<\/strong> \n<p>Windows users need to log out and log back in for permissions changes to take effect. <\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>User Groups<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Setting Permissions on a User Group per Device Group Bind<\/strong><\/h3>\n\n\n\n<p>Setting permissions at the user group level centralizes management of elevated device permissions in a single place. Permissions set at the user group level will be applied to associated device groups. Group members will inherit permissions to devices that are associated with those device groups. <\/p>\n\n\n\n<p><strong>Considerations<\/strong>:<\/p>\n\n\n\n<ul>\n<li>Permissions that are granted directly on a user supersede permissions granted at a user group level.<\/li>\n\n\n\n<li>Permissions set at the user group level supersede any permissions previously set on the user group\u2019s bind to a device group.<\/li>\n\n\n\n<li>It\u2019s possible to have permissions added on both the direct user association to the device and the indirect group association to the device. This is visible on the association of a user and a device. However, if there is an indirect group association to the device, you won&#8217;t be able to apply elevated permissions directly between a user and device. To be able to apply elevated permissions directly between the user and device, the user or device needs to be removed from the user group.<\/li>\n\n\n\n<li>It&#8217;s possible to remove duplicate permission assignments on a user to device association via removing the elevated permission on the associated device by selecting No Elevated Permissions or by removing the user from the group.<\/li>\n\n\n\n<li>If group permissions are inherited globally on a user group, the permissions can show up as inherited group permissions.<\/li>\n<\/ul>\n\n\n\n<p>There are two ways to provide Admin\/Sudo access through user groups:<\/p>\n\n\n\n<ul>\n<li>Via the Device Groups tab, so that all users in a user group have access to a specific device group(s) associated to that user group.<\/li>\n\n\n\n<li>Via the Details tab, so that all users in a user group have access to all device groups that are bound to that user group.<\/li>\n<\/ul>\n\n\n\n<p><strong>To give users within a user group Admin\/Sudo access to devices via the Device Groups tab<\/strong>:<\/p>\n\n\n\n<ol>\n<li>Log in to the <a href=\"https:\/\/console.jumpcloud.com\/login\">JumpCloud Admin&nbsp;Portal<\/a>.&nbsp;<\/li>\n\n\n\n<li>Go to&nbsp;<strong>USER MANAGEMENT<\/strong>&nbsp;&gt;&nbsp;<strong>User Groups.<\/strong><\/li>\n\n\n\n<li>Select the applicable group by clicking on the <strong>User Group<\/strong> name under the <strong>Group<\/strong> column.&nbsp;<\/li>\n\n\n\n<li>Click the&nbsp;<strong>Device Groups<\/strong>&nbsp;tab and then select the applicable device group under the <strong>Group<\/strong> column.<\/li>\n\n\n\n<li>Click the dropdown arrow under the <strong>Permissions<\/strong> column, select the desired permission, and click <strong>save<\/strong>. The sudo permission is&nbsp;now set for users in that user group for every device associated with the device group.&nbsp;<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"492\" src=\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/05\/UserGroups_DeviceAdminSudoPerm-1024x492.png\" alt=\"\" class=\"wp-image-83670\" srcset=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/05\/UserGroups_DeviceAdminSudoPerm-1024x492.png 1024w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/05\/UserGroups_DeviceAdminSudoPerm-300x144.png 300w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/05\/UserGroups_DeviceAdminSudoPerm-768x369.png 768w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/05\/UserGroups_DeviceAdminSudoPerm-1536x739.png 1536w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/05\/UserGroups_DeviceAdminSudoPerm-2048x985.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card note\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Note:<\/strong> \n<ul>\n<li>When unchecked, permissions can be managed from the Device Groups tab or on an individual user\/device basis.<\/li>\n\n\n\n<li>Passwordless Sudo is applicable to Linux and Mac devices and only recommended for service accounts.<\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Setting Permissions on a User Group for&nbsp;All Associated Device Groups<\/strong><\/h3>\n\n\n\n<p><strong>To give users within a user group Global Admin\/Sudo access via the Details tab<\/strong>:<\/p>\n\n\n\n<ol>\n<li>Log in to the <a href=\"https:\/\/console.jumpcloud.com\/login\">JumpCloud Admin Portal<\/a>.&nbsp;<\/li>\n\n\n\n<li>Go to&nbsp;<strong>USER MANAGEMENT<\/strong>&nbsp;&gt;&nbsp;<strong>User Groups<\/strong>.<\/li>\n\n\n\n<li>Select a User Group from the list. The administrator will see the <strong>Details<\/strong> tab for that user group by default.<\/li>\n\n\n\n<li>Click the&nbsp;<strong>Enable users as Global Administrator\/Sudo on all devices associated through device groups<\/strong>&nbsp;checkbox and click&nbsp;<strong>save<\/strong>. All users in that user group will be given global admin permissions on all devices bound to any device group associated with the user group.\n<ul>\n<li>Passwordless Sudo is applicable to Linux and Mac devices and only recommended for service accounts<\/li>\n\n\n\n<li>You can also go to the <strong>Device Groups<\/strong> tab to control this setting on a group to group basis<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>A Permission Settings Update email notification is sent.<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"421\" src=\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/05\/UserGroup_Details_AdminSudoPerm-1024x421.png\" alt=\"\" class=\"wp-image-83676\" srcset=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/05\/UserGroup_Details_AdminSudoPerm-1024x421.png 1024w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/05\/UserGroup_Details_AdminSudoPerm-300x123.png 300w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/05\/UserGroup_Details_AdminSudoPerm-768x315.png 768w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/05\/UserGroup_Details_AdminSudoPerm-1536x631.png 1536w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/05\/UserGroup_Details_AdminSudoPerm-2048x841.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Users<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Setting Permissions on a User per Device Bind<\/strong><\/h3>\n\n\n\n<p>Users that aren&#8217;t admins on all of their devices can be given elevated permissions on a per-device basis. <\/p>\n\n\n\n<p><strong>Considerations<\/strong>:<\/p>\n\n\n\n<ul>\n<li>Elevated rights are only granted on the devices you explicitly choose. By default, users don\u2019t have administrator permissions.\n<ul>\n<li>The only exception to this are Apple Device Enrollment (AD) enrolled users, who do have admin permissions.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>If the user is bound to the device via group membership, an indirect device binding is created. To remove access to the device, remove the user from the group.<\/li>\n\n\n\n<li>If you still wish to assign elevated permissions on a per device basis, make sure the device is not part of an existing user group. See\u00a0<a href=\"https:\/\/support.jumpcloud.com\/support\/s\/article\/setting-sudoadministrator-permissions2\" target=\"_blank\" rel=\"noreferrer noopener\">B<\/a><a href=\"https:\/\/jumpcloud.com\/blog\/best-practices-for-migration-of-device-permissions-from-a-user-to-a-group\" target=\"_blank\" rel=\"noreferrer noopener\">est Practices for Migration of Device Permissions from a User to a Group<\/a>\u00a0for more information.<\/li>\n\n\n\n<li>Suspended or revoked users won\u2019t have access to the device. See <a href=\"https:\/\/jumpcloud.com\/support\/suspend-and-reactivate-users\">Suspend and Reactivate User Accounts<\/a> to learn more.&nbsp;<\/li>\n\n\n\n<li>You can also manage device level permission from\u00a0<strong>DEVICE MANAGEMENT<\/strong> &gt; <strong>Devices\u00a0<\/strong>&gt;\u00a0<strong>Users<\/strong>.<\/li>\n<\/ul>\n\n\n\n<p><strong>To set a user as an Admin\/Sudo on a connected device<\/strong>:&nbsp;<\/p>\n\n\n\n<ol>\n<li>Log in to the <a href=\"https:\/\/console.jumpcloud.com\/login\">JumpCloud Admin&nbsp;Portal<\/a>.&nbsp;<\/li>\n\n\n\n<li>Go to&nbsp;<strong>USER MANAGEMENT<\/strong>&nbsp;&gt;&nbsp;<strong>Users<\/strong>.<\/li>\n\n\n\n<li>Select a user and click the <strong>Devices<\/strong> tab to view the devices connected to this user.<\/li>\n\n\n\n<li>(Optional) To display both bound and unbound devices, clear the <strong>show bound device <\/strong>check box.&nbsp;<\/li>\n\n\n\n<li>On the desired device, go to the <strong>Permissions<\/strong> column and click the pencil to <strong>Edit<\/strong> permissions.<\/li>\n\n\n\n<li>In the Permissions Change window, select <strong>Administrator\/Sudo Access<\/strong> and set the Duration to <strong>Permanently Until Removed<\/strong>.<\/li>\n\n\n\n<li>Click <strong>Apply<\/strong>.<\/li>\n\n\n\n<li>Click&nbsp;<strong>save user<\/strong>.<br><img decoding=\"async\" width=\"1389\" height=\"937\" class=\"wp-image-107649\" style=\"width: 1000px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/Users_Devices_AdminSudoPerm_new.jpg\" alt=\"\" srcset=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/Users_Devices_AdminSudoPerm_new.jpg 1389w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/Users_Devices_AdminSudoPerm_new-300x202.jpg 300w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/Users_Devices_AdminSudoPerm_new-1024x691.jpg 1024w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/Users_Devices_AdminSudoPerm_new-768x518.jpg 768w\" sizes=\"(max-width: 1389px) 100vw, 1389px\" \/><\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Setting Temporary Permissions on a User per Device Bind<\/h3>\n\n\n\n<p>You can also assign a user that&#8217;s not admin on all of their devices <strong>temporary elevated privileges<\/strong>. A user can perform needed administrative actions on their device for a fixed period of time, and then their permissions are automatically revoked.\u00a0<\/p>\n\n\n\n<p><strong>Considerations<\/strong>:<\/p>\n\n\n\n<ul>\n<li>You can only grant temporary elevated permissions on a direct user to device association. Group associations aren\u2019t supported.<\/li>\n\n\n\n<li>You can&#8217;t assign temporary elevated permissions to a user that&#8217;s set as a Global Admin\/Sudo on all devices.  See the following section <a href=\"#setting-permissions-on-a-user-for-all-associated-devices\">Setting Permissions on a User for all Associated Devices<\/a> to learn more. <\/li>\n\n\n\n<li>Permission changes can take up to 10 minutes to expire on the device.<\/li>\n\n\n\n<li>A network connection is required to make permissions changes. If a device\u2019s network connection is interrupted when the temporary permissions are scheduled to expire, the temporarily assigned permissions may persist until the device reconnects and receives new instructions to revoke the elevated permissions.<\/li>\n\n\n\n<li>Due to limitations in the Windows OS, admin functions will persist for a user on a Windows device until the user logs out.<\/li>\n<\/ul>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card tip\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Tip:<\/strong> \n<p>Here&#8217;s a guided simulation:&nbsp;<a href=\"https:\/\/university.jumpcloud.com\/courses\/simulation-temporary-user-permissions-per-device\">Temporary User Permissions per Device<\/a>.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<p><strong>To assign temporary Admin\/Sudo access to a user\u2019s device<\/strong>:&nbsp;<\/p>\n\n\n\n<ol>\n<li>Log in to the <a href=\"https:\/\/console.jumpcloud.com\/login\">JumpCloud Admin Portal<\/a>.&nbsp;<\/li>\n\n\n\n<li>Go to <strong>USER MANAGEMENT<\/strong> &gt; <strong>Users<\/strong>.<\/li>\n\n\n\n<li>Select a user. The user Highlights tab displays.&nbsp;<\/li>\n\n\n\n<li>Click the <strong>Devices<\/strong> tab to view the devices connected to this user. The user\u2019s bound devices display by default.<\/li>\n\n\n\n<li>(Optional) To display both bound and unbound devices, clear the <strong>show bound device <\/strong>check box.&nbsp;<\/li>\n\n\n\n<li>On the desired device, go to the <strong>Permissions<\/strong> column and click the pencil to <strong>Edit<\/strong> permissions.&nbsp;<\/li>\n\n\n\n<li>In the Permissions Change window, select <strong>Administrator\/Sudo Access<\/strong> and select the appropriate <strong>Duration <\/strong>from the dropdown.\n<ul>\n<li>For example, if the user needs to install software on their device, select a short time period such as 1 hour. After the designated time, the user\u2019s permission returns to <strong>No Elevated Permissions<\/strong><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Click <strong>Apply<\/strong>.<\/li>\n\n\n\n<li>Click <strong>save user<\/strong>.<br><img decoding=\"async\" width=\"1415\" height=\"764\" class=\"wp-image-107250\" style=\"width: 1000px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/Users_Devices_TempAdminSudoPermissions.jpg\" alt=\"\" srcset=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/Users_Devices_TempAdminSudoPermissions.jpg 1415w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/Users_Devices_TempAdminSudoPermissions-300x162.jpg 300w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/Users_Devices_TempAdminSudoPermissions-1024x553.jpg 1024w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/Users_Devices_TempAdminSudoPermissions-768x415.jpg 768w\" sizes=\"(max-width: 1415px) 100vw, 1415px\" \/><\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\">Revoking an Existing Temporary Permissions Change<\/h4>\n\n\n\n<p>You can remove a user\u2019s temporary elevated privileges ahead of the expiration time set in the previous step.<\/p>\n\n\n\n<p><strong>To modify existing temporary Admin\/Sudo permissions<\/strong>:<\/p>\n\n\n\n<ol>\n<li>Log in to the <a href=\"https:\/\/console.jumpcloud.com\/login\">JumpCloud Admin Portal<\/a>.&nbsp;<\/li>\n\n\n\n<li>Go to <strong>USER MANAGEMENT<\/strong> &gt; <strong>Users.<\/strong><\/li>\n\n\n\n<li>Select the user in the list. The user Highlights displays.&nbsp;<\/li>\n\n\n\n<li>Click the <strong>Devices<\/strong> tab and locate the device with remaining time on Administrator\/Sudo Access. <\/li>\n\n\n\n<li>In the Permissions column, click the pencil to <strong>Edit<\/strong> the elevated permissions.<\/li>\n\n\n\n<li>In the Permissions Change window, select <strong>No Elevated Permissions<\/strong> to change the user\u2019s permission level for this device.<\/li>\n\n\n\n<li>Click <strong>Apply<\/strong>.<\/li>\n\n\n\n<li>Click <strong>save<\/strong> <strong>user<\/strong>.<br><img decoding=\"async\" width=\"1426\" height=\"789\" class=\"wp-image-107261\" style=\"width: 1000px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/Users_Devices_TempAdminSudoPermissions_Duration2.jpg\" alt=\"\" srcset=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/Users_Devices_TempAdminSudoPermissions_Duration2.jpg 1426w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/Users_Devices_TempAdminSudoPermissions_Duration2-300x166.jpg 300w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/Users_Devices_TempAdminSudoPermissions_Duration2-1024x567.jpg 1024w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/Users_Devices_TempAdminSudoPermissions_Duration2-768x425.jpg 768w\" sizes=\"(max-width: 1426px) 100vw, 1426px\" \/><\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Setting Permissions on a User for all Associated Devices<\/strong><\/h3>\n\n\n\n<p>Admins can assign global Admin\/Sudo permissions on a user to apply to all devices associated with that user.<\/p>\n\n\n\n<p><strong>Considerations<\/strong>:<\/p>\n\n\n\n<ul>\n<li>The enabled user is given global Admin\/Sudo privileges on all devices to which they are bound.<\/li>\n\n\n\n<li>When the\u00a0<strong>Enable as Global Administrator\/Sudo on all device associations<\/strong>\u00a0option is cleared, you can manage global Admin\/Sudo privileges on a per-device basis from the Devices tab.<\/li>\n\n\n\n<li>Passwordless Sudo can also be assigned to Device Admins for Mac and Linux. You need to configure Windows device UAC settings to require an admin password.<\/li>\n\n\n\n<li>Global settings can&#8217;t be modified on a per-device basis.<\/li>\n\n\n\n<li>You can also manage a user&#8217;s permission level from\u00a0<strong>DEVICE MANAGEMENT<\/strong>\u00a0&gt;\u00a0<strong>Devices\u00a0<\/strong>&gt;\u00a0<strong>Users<\/strong>.<\/li>\n<\/ul>\n\n\n\n<p><strong>To set a user as a global Admin\/Sudo on all associated devices<\/strong>:<\/p>\n\n\n\n<ol>\n<li>Log in to the <a href=\"https:\/\/console.jumpcloud.com\/login\">JumpCloud Admin Portal<\/a>.&nbsp;<\/li>\n\n\n\n<li>Go to&nbsp;<strong>USER MANAGEMENT<\/strong>&nbsp;&gt;&nbsp;<strong>Users<\/strong>.<\/li>\n\n\n\n<li>Select a user and click the <strong>Details<\/strong> tab.<\/li>\n\n\n\n<li>Expand the&nbsp;<strong>User Security Settings and Permissions<\/strong>&nbsp;section.<\/li>\n\n\n\n<li>Click the&nbsp;<strong>Enable as Global Administrator\/Sudo on all device associations<\/strong>&nbsp;checkbox to select it and click&nbsp;<strong>save<\/strong>. You&#8217;ll receive an email from JumpCloud confirming that the user now has global Admin\/Sudo permissions on all associated devices.<\/li>\n\n\n\n<li>To remove global Admin\/Sudo permissions for all of a user&#8217;s devices, uncheck the&nbsp;<strong>Enable as Global Administrator\/Sudo on all device associations<\/strong>&nbsp;checkbox and click <strong>save<\/strong>.<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"875\" src=\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/05\/Users_Details_AdminSudoPerm-1024x875.png\" alt=\"\" class=\"wp-image-83682\" srcset=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/05\/Users_Details_AdminSudoPerm-1024x875.png 1024w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/05\/Users_Details_AdminSudoPerm-300x256.png 300w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/05\/Users_Details_AdminSudoPerm-768x656.png 768w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/05\/Users_Details_AdminSudoPerm-1536x1313.png 1536w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/05\/Users_Details_AdminSudoPerm.png 1650w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Setting Permissions with Self-Service Account Provisioning<\/h3>\n\n\n\n<p>If you\u2019ve enabled Self-Service Account Provisioning, you can set Admin\/Sudo permissions for newly joined accounts from the Device Settings menu.&nbsp;See <a href=\"https:\/\/jumpcloud.com\/support\/get-started-self-service-account-provisioning\" target=\"_blank\" rel=\"noreferrer noopener\">Provision New Users on Device Login<\/a>.<\/p>\n\n\n\n<p>A user\u2019s permission level can be adjusted after provisioning by <a href=\"#setting-permissions-on-a-user-per-device-bind\">Setting Permissions on a User per Device Bind<\/a>.<br><img decoding=\"async\" width=\"2050\" height=\"2155\" class=\"wp-image-106925\" style=\"width: 1000px\" src=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/ssap_admin_portal_device_settings.jpg\" alt=\"\" srcset=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/ssap_admin_portal_device_settings.jpg 2050w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/ssap_admin_portal_device_settings-285x300.jpg 285w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/ssap_admin_portal_device_settings-974x1024.jpg 974w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/ssap_admin_portal_device_settings-768x807.jpg 768w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/ssap_admin_portal_device_settings-1461x1536.jpg 1461w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/ssap_admin_portal_device_settings-1948x2048.jpg 1948w\" sizes=\"(max-width: 2050px) 100vw, 2050px\" \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The JumpCloud agent lets you set user access controls to elevate the standard permissions on a user to Admin\/Sudo or [&hellip;]<\/p>\n","protected":false},"author":207,"featured_media":0,"template":"","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","inline_featured_image":false,"footnotes":""},"support_category":[3003,2850],"support_tag":[],"coauthors":[2843,3011],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v22.9 (Yoast SEO v22.9) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Set Admin\/Sudo Permissions - JumpCloud<\/title>\n<meta name=\"description\" content=\"Learn how to set user access controls to elevate the standard permissions on a user to Admin\/Sudo or Passwordless Sudo.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jumpcloud.com\/support\/set-admin-sudo-permissions\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Set Admin\/Sudo Permissions\" \/>\n<meta property=\"og:description\" content=\"Learn how to set user access controls to elevate the standard permissions on a user to Admin\/Sudo or Passwordless Sudo.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jumpcloud.com\/support\/set-admin-sudo-permissions\" \/>\n<meta property=\"og:site_name\" content=\"JumpCloud\" \/>\n<meta property=\"article:modified_time\" content=\"2024-06-06T22:00:54+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/05\/UserGroups_DeviceAdminSudoPerm-1024x492.png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"9 minutes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data2\" content=\"sashaharrington, nickconrad\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/jumpcloud.com\/support\/set-admin-sudo-permissions\",\"url\":\"https:\/\/jumpcloud.com\/support\/set-admin-sudo-permissions\",\"name\":\"Set Admin\/Sudo Permissions - JumpCloud\",\"isPartOf\":{\"@id\":\"https:\/\/jumpcloud.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/jumpcloud.com\/support\/set-admin-sudo-permissions#primaryimage\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/support\/set-admin-sudo-permissions#primaryimage\"},\"thumbnailUrl\":\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/05\/UserGroups_DeviceAdminSudoPerm-1024x492.png\",\"datePublished\":\"2024-03-27T17:39:16+00:00\",\"dateModified\":\"2024-06-06T22:00:54+00:00\",\"description\":\"Learn how to set user access controls to elevate the standard permissions on a user to Admin\/Sudo or Passwordless Sudo.\",\"breadcrumb\":{\"@id\":\"https:\/\/jumpcloud.com\/support\/set-admin-sudo-permissions#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/jumpcloud.com\/support\/set-admin-sudo-permissions\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/support\/set-admin-sudo-permissions#primaryimage\",\"url\":\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/05\/UserGroups_DeviceAdminSudoPerm-1024x492.png\",\"contentUrl\":\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/05\/UserGroups_DeviceAdminSudoPerm-1024x492.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/jumpcloud.com\/support\/set-admin-sudo-permissions#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/jumpcloud.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Support\",\"item\":\"https:\/\/jumpcloud.com\/support\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Set Admin\/Sudo Permissions\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/jumpcloud.com\/#website\",\"url\":\"https:\/\/jumpcloud.com\/\",\"name\":\"JumpCloud\",\"description\":\"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.\",\"publisher\":{\"@id\":\"https:\/\/jumpcloud.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/jumpcloud.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/jumpcloud.com\/#organization\",\"name\":\"JumpCloud\",\"url\":\"https:\/\/jumpcloud.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"contentUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"width\":598,\"height\":101,\"caption\":\"JumpCloud\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Set Admin\/Sudo Permissions - JumpCloud","description":"Learn how to set user access controls to elevate the standard permissions on a user to Admin\/Sudo or Passwordless Sudo.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jumpcloud.com\/support\/set-admin-sudo-permissions","og_locale":"en_US","og_type":"article","og_title":"Set Admin\/Sudo Permissions","og_description":"Learn how to set user access controls to elevate the standard permissions on a user to Admin\/Sudo or Passwordless Sudo.","og_url":"https:\/\/jumpcloud.com\/support\/set-admin-sudo-permissions","og_site_name":"JumpCloud","article_modified_time":"2024-06-06T22:00:54+00:00","og_image":[{"url":"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/05\/UserGroups_DeviceAdminSudoPerm-1024x492.png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"9 minutes","Written by":"sashaharrington, nickconrad"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/jumpcloud.com\/support\/set-admin-sudo-permissions","url":"https:\/\/jumpcloud.com\/support\/set-admin-sudo-permissions","name":"Set Admin\/Sudo Permissions - JumpCloud","isPartOf":{"@id":"https:\/\/jumpcloud.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/jumpcloud.com\/support\/set-admin-sudo-permissions#primaryimage"},"image":{"@id":"https:\/\/jumpcloud.com\/support\/set-admin-sudo-permissions#primaryimage"},"thumbnailUrl":"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/05\/UserGroups_DeviceAdminSudoPerm-1024x492.png","datePublished":"2024-03-27T17:39:16+00:00","dateModified":"2024-06-06T22:00:54+00:00","description":"Learn how to set user access controls to elevate the standard permissions on a user to Admin\/Sudo or Passwordless Sudo.","breadcrumb":{"@id":"https:\/\/jumpcloud.com\/support\/set-admin-sudo-permissions#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jumpcloud.com\/support\/set-admin-sudo-permissions"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/support\/set-admin-sudo-permissions#primaryimage","url":"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/05\/UserGroups_DeviceAdminSudoPerm-1024x492.png","contentUrl":"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/05\/UserGroups_DeviceAdminSudoPerm-1024x492.png"},{"@type":"BreadcrumbList","@id":"https:\/\/jumpcloud.com\/support\/set-admin-sudo-permissions#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/jumpcloud.com\/"},{"@type":"ListItem","position":2,"name":"Support","item":"https:\/\/jumpcloud.com\/support"},{"@type":"ListItem","position":3,"name":"Set Admin\/Sudo Permissions"}]},{"@type":"WebSite","@id":"https:\/\/jumpcloud.com\/#website","url":"https:\/\/jumpcloud.com\/","name":"JumpCloud","description":"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.","publisher":{"@id":"https:\/\/jumpcloud.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jumpcloud.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/jumpcloud.com\/#organization","name":"JumpCloud","url":"https:\/\/jumpcloud.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/","url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","contentUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","width":598,"height":101,"caption":"JumpCloud"},"image":{"@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/75872"}],"collection":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support"}],"about":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/types\/support"}],"author":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/users\/207"}],"version-history":[{"count":2,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/75872\/revisions"}],"predecessor-version":[{"id":111319,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/75872\/revisions\/111319"}],"wp:attachment":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/media?parent=75872"}],"wp:term":[{"taxonomy":"support_category","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support_category?post=75872"},{"taxonomy":"support_tag","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support_tag?post=75872"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/coauthors?post=75872"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}