{"id":76200,"date":"2023-06-05T13:11:55","date_gmt":"2023-06-05T17:11:55","guid":{"rendered":"https:\/\/jumpcloud.com\/?post_type=support&p=76200"},"modified":"2024-09-19T16:59:43","modified_gmt":"2024-09-19T20:59:43","slug":"jumpcloud-protect-for-admins","status":"publish","type":"support","link":"https:\/\/jumpcloud.com\/support\/jumpcloud-protect-for-admins","title":{"rendered":"Get Started: JumpCloud Protect"},"content":{"rendered":"\n
Your users can download the JumpCloud Protect\u00ae mobile app to secure their accounts using Multi-Factor Authentication (MFA). The app can be downloaded from the iOS App Store<\/a> or the Google Play Store<\/a>. Once your users have downloaded the app and successfully enrolled their devices, they can authenticate using Push MFA or Verification (TOTP) Code<\/a>.<\/p>\n\n\n\n <\/p><\/div> JumpCloud protects against fraudulent push attempts by blocking more than one notification per resource within a sixty-second timeout period. You can try again after the timeout or after you have approved or denied the initial request. <\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n JumpCloud Protect can be used to log in to the Admin Portal, User Portal, or devices (Windows, Mac, Linux). Before your users can use the JumpCloud Protect mobile app, you, as an administrator, must enable it. <\/p>\n\n\n\n <\/p><\/div> JumpCloud Protect is designed to operate on Android 8 and iOS 13 and higher. It may operate on older versions, but they are not supported by JumpCloud. <\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n <\/a>Considerations<\/strong><\/p>\n\n\n\n <\/p><\/div> Users can authenticate into their local account without internet access, and TOTP MFA will still be enforced in this situation.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n Push Bombing is a hacking method of triggering multiple 2FA attempts using push notifications until the user may accept the request accidentally. MFA Fatigue is the term for when, due to the multiple 2FA requests, a user accepts the fraudulent request out of frustration.<\/p>\n\n\n\n There are several ways to protect your organization against such an attack: <\/p>\n\n\n\n <\/p><\/div> JumpCloud protects against fraudulent push attempts by blocking more than one notification per resource within a sixty-second period, except for RADIUS and LDAP attempts. Admins can turn this off, or increase the limit for maximum concurrent attempts, within MFA Configurations<\/strong>. <\/p>\n\n\n\n Users can try again after the timeout or after the user has approved or denied the request. The blocked event will appear in Directory Insights under the event name push_mfa_attempt_failed<\/strong> with the error message \u2018too many concurrent push requests\u2019.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n <\/p>\n\n\n\n Before you enable JumpCloud Protect, you must first require your users to use MFA to log into their JumpCloud account. You can do this by creating a Conditional<\/a> Access Policy<\/a> and assigning to your users or user groups. <\/p>\n\n\n\n Alternatively, you can enable a setting in the Admin Portal to require individual users to use MFA when they log into their JumpCloud account. To do so:<\/p>\n\n\n\n To enable JumpCloud Protect for your users:<\/p>\n\n\n\n <\/p><\/div> If Required if Enabled on Device<\/strong> or Always Required<\/strong> is selected, the user will not be able to accept or deny from the lock screen of their device or their Apple Watch.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n After you have enabled JumpCloud Protect for your users, you can view details of the individual user\u2019s enrollment. To view these details:<\/p>\n\n\n\n In that pane, you can view the following information:<\/p>\n\n\n\n <\/p><\/div> <\/p><\/div> You can also view MFA status from the Users list. From the columns<\/strong> dropdown, select MFA: JumpCloud Protect<\/strong>. When you hover over the status on the users list, you can see Protect MFA details for the user.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n You can delete a user\u2019s device from the User Security Settings and Permissions <\/strong>screen. To do so:<\/p>\n\n\n\n If you no longer wish to use the JumpCloud Protect Mobile App, you can turn it off it. <\/p>\n\n\n\n <\/p><\/div> If you have resources configured to require MFA and JumpCloud Protect is your users’ only enrolled MFA factor, your user may lose access to those resources when JumpCloud Protect is disabled.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n To disable JumpCloud Protect Mobile Push<\/strong>:<\/p>\n\n\n\n\n
\n
\n
\n
\n
Security Practices to Reduce Push Bombing and MFA Fatigue Risks<\/strong><\/h2>\n\n\n\n
\n
\n
\n
\n
Before Enabling JumpCloud Protect<\/h2>\n\n\n\n
\n
Enabling JumpCloud Protect<\/h2>\n\n\n\n
\n
\n
\n
Viewing User Device Details and Enrollment Status<\/strong><\/h2>\n\n\n\n
\n
<\/li>\n<\/ol>\n\n\n\n\n
\n
\n
Deleting a User\u2019s Device<\/strong><\/h2>\n\n\n\n
\n
<\/a>Disabling JumpCloud Protect<\/strong><\/h2>\n\n\n\n