{"id":84787,"date":"2023-06-05T13:11:25","date_gmt":"2023-06-05T17:11:25","guid":{"rendered":"https:\/\/jumpcloud.com\/?post_type=support&#038;p=84787"},"modified":"2024-08-08T14:31:34","modified_gmt":"2024-08-08T18:31:34","slug":"manage-conditional-access-policy-certificates","status":"publish","type":"support","link":"https:\/\/jumpcloud.com\/support\/manage-conditional-access-policy-certificates","title":{"rendered":"Manage Conditional Access Policy Certificates for Desktop"},"content":{"rendered":"\n<p>Conditional Access Policies let you relax, restrict, or deny user access to resources based on conditions that you set. Unmanaged or managed devices are conditions you can use to determine how users access the User Portal and SSO applications.&nbsp;<\/p>\n\n\n\n<p>To use a policy with a device condition, you need to distribute device certificates to your desktop devices. Device certificates for desktops allow authentication mechanisms to recognize if login requests are coming from JumpCloud managed devices.<\/p>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card tip\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Tip:<\/strong> \n<p>Looking to enforce device trust on mobile devices? See <a href=\"https:\/\/jumpcloud.com\/support\/get-started-mobile-device-trust\" target=\"_blank\" rel=\"noreferrer noopener\">Get Started: Mobile Device Trust<\/a> to learn more.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<p>For information such as supported browsers for each supported OS, see&nbsp;<a href=\"https:\/\/jumpcloud.com\/support\/get-started-conditional-access-policies\" target=\"_blank\" rel=\"noreferrer noopener\">Get Started: Conditional Access Policies<\/a>.&nbsp;<\/p>\n\n\n\n<p><strong>Prerequisites:<\/strong><\/p>\n\n\n\n<ul>\n<li>You need the Platform Plus plan to create a policy with a device condition. See <a href=\"https:\/\/jumpcloud.com\/pricing\" target=\"_blank\" rel=\"noreferrer noopener\">Pricing Packages<\/a> to learn more.&nbsp;&nbsp;<\/li>\n\n\n\n<li>The JumpCloud Agent needs to be installed on your devices. Get started with&nbsp;<a href=\"https:\/\/jumpcloud.com\/support\/agent-compatibility-system-requirements-and-impacts\" target=\"_blank\" rel=\"noreferrer noopener\">Agent Compatibility, System Requirements and Impacts<\/a>.&nbsp;<\/li>\n<\/ul>\n\n\n\n<p><strong>Considerations:<\/strong><\/p>\n\n\n\n<ul>\n<li>Conditional access policies introduced the jumpcloud-user-agent, which is installed alongside the JumpCloud Agent to distribute device certificates. The jumpcloud-user-agent is installed&nbsp;regardless of whetherConditional Access Policies are&nbsp;enabled or&nbsp;not.&nbsp;<\/li>\n\n\n\n<li>When you enable\u00a0<strong>Global Certificate Distribution<\/strong>, certificates are distributed to every device and every JumpCloud managed user on a device.<\/li>\n\n\n\n<li>For the agent to install certificates, JumpCloud managed users need to be logged in to their device.&nbsp;<\/li>\n\n\n\n<li>When a user accesses a resource, they need to be the same user who is logged in to the device. If a user accesses a resource and they\u2019re not the same user who is logged in to the device, they\u2019re treated as unmanaged.&nbsp;<\/li>\n\n\n\n<li>Distribution can take a few minutes.&nbsp;<\/li>\n\n\n\n<li>Some browsers may prompt users to select the certificate on their next visit to the JumpCloud User Portal. Users need to confirm certificate selection or restart their browser for the certificate to take effect.&nbsp; We recommend that you notify your users about this before you turn on certificate distribution.<\/li>\n\n\n\n<li>Certificates are only used with Device Trust policies.<\/li>\n\n\n\n<li>When you disable&nbsp;<strong>Global Certificate Distribution<\/strong>, certificates are removed from every device and every user on a device.&nbsp;<\/li>\n\n\n\n<li>For a certificate to be removed from a user on a device, the user needs to be logged in to the device.&nbsp;<\/li>\n\n\n\n<li>After&nbsp;<strong>Global Certificate Distribution<\/strong>&nbsp;is disabled, any existing managed device policies treat users as unmanaged, and this takes effect immediately.&nbsp;<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-storage-location-of-global-device-certificates\">Storage Location of Global Device Certificates<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-linux\">Linux<\/h3>\n\n\n\n<ul>\n<li>Certificates are stored in the user\u2019s NSS database (<strong>~\/.pki\/nssdb\/cert9.db<\/strong>, <strong>~\/.pki\/nssdb\/key4.db<\/strong>).<\/li>\n\n\n\n<li>If the database&nbsp;does not exist, the agent will create a new one<\/li>\n\n\n\n<li>Certificate auto-select filters are found in <strong>\/etc\/opt\/chrome\/policies\/managed\/JumpCloudCertificateAutoselect.json<\/strong>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-mac\">Mac<\/h3>\n\n\n\n<ul>\n<li>Certificates&nbsp;are stored in a new <strong>jumpcloud-device-trust-keychain<\/strong> in the user\u2019s <strong>Library\/Keychains<\/strong> folder.<\/li>\n\n\n\n<li>The generated password for the new keychain is stored in the user\u2019s login keychain, in a generic password item named <strong>JumpCloud Device Trust Keychain Password<\/strong>. This allows the user agent to unlock the Device Trust keychain when it needs access to install or renew certificates.<\/li>\n\n\n\n<li>The Device Trust keychain password is rotated every time a certificate&nbsp;is installed or renewed.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-windows\">Windows<\/h3>\n\n\n\n<ul>\n<li>The agent installs the root (CA) certificate in the system cert store.<\/li>\n\n\n\n<li>The user-agent installs the intermediate certificate in the user\u2019s Intermediate Certification Authorities store, and the Device Trust certificate in the user\u2019s Personal store.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-distributing-global-device-certificates-nbsp\">Distributing Global Device Certificates&nbsp;<\/h2>\n\n\n\n<p>Distribute device certificates from the Conditional Policies Settings page or when you create your first policy that uses a device condition. See&nbsp;<a href=\"https:\/\/jumpcloud.com\/support\/configure-a-conditional-access-policy\" target=\"_blank\" rel=\"noreferrer noopener\">Configure a Conditional Access Policy<\/a>&nbsp;to learn how to distribute certificates when you create your first device-based policy.&nbsp;<\/p>\n\n\n\n<p><strong>To distribute a device certificate from the Conditional Policies Settings page<\/strong>:&nbsp;<\/p>\n\n\n\n<ol>\n<li>Log in to the Admin Portal:&nbsp;<a target=\"_blank\" href=\"https:\/\/console.jumpcloud.com\/login\" rel=\"noreferrer noopener\">https:\/\/console.jumpcloud.com\/login<\/a>&nbsp;<\/li>\n\n\n\n<li>Go to&nbsp;<strong>SECURITY MANAGEMENT&nbsp;<\/strong>&gt;<strong>&nbsp;Conditional Policies<\/strong>.&nbsp;<\/li>\n\n\n\n<li>Click on the&nbsp;<strong>Settings<\/strong>&nbsp;icon that\u2019s in the top right.&nbsp;<\/li>\n\n\n\n<li>In&nbsp;<strong>Device Certificates<\/strong>, set&nbsp;<strong>Global Certificate Distribution<\/strong>&nbsp;to&nbsp;<strong>ON<\/strong>.&nbsp;<\/li>\n\n\n\n<li>Click&nbsp;<strong>save<\/strong>.&nbsp;<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-removing-global-device-certificates\">Removing Global Device Certificates<\/h2>\n\n\n\n<p>You can remove global device certificates after you\u2019ve distributed them. When you disable Global Device Certificates, existing policies aren\u2019t updated, and any custom&nbsp;<a href=\"https:\/\/jumpcloud.com\/support\/understand-mac-keychain-access\" target=\"_blank\" rel=\"noreferrer noopener\">MacOS Keychain Application Access<\/a>&nbsp;configurations are removed. To make sure users have uninterrupted access to their resources, disable policies with a device condition before you remove global device certificates. Learn how to disable a policy in&nbsp;<a href=\"https:\/\/jumpcloud.com\/support\/configure-a-conditional-access-policy\" target=\"_blank\" rel=\"noreferrer noopener\">Configure a Conditional Access Policy<\/a>.&nbsp;<\/p>\n\n\n\n<p><strong>To remove global device certificates<\/strong>:<\/p>\n\n\n\n<ol>\n<li>Log in to the Admin Portal:&nbsp;<a target=\"_blank\" href=\"https:\/\/console.jumpcloud.com\/login\" rel=\"noreferrer noopener\">https:\/\/console.jumpcloud.com\/login<\/a>&nbsp;<\/li>\n\n\n\n<li>Go to&nbsp;<strong>SECURITY MANAGEMENT&nbsp;<\/strong>&gt;<strong>&nbsp;Conditional Policies<\/strong>.&nbsp;<\/li>\n\n\n\n<li>Click on the&nbsp;<strong>Settings<\/strong>&nbsp;icon that\u2019s in the top right.&nbsp;<\/li>\n\n\n\n<li>In&nbsp;<strong>Device Certificates<\/strong>, set&nbsp;<strong>Global Certificate Distribution<\/strong>&nbsp;to&nbsp;<strong>OFF<\/strong>.&nbsp;&nbsp;<\/li>\n\n\n\n<li>Click&nbsp;<strong>disable<\/strong>.&nbsp;<br><img decoding=\"async\" width=\"601\" height=\"344\" class=\"wp-image-84789\" style=\"width: 500px\" src=\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/05\/disable-device-cert-distribution.png\" alt=\"\" srcset=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/05\/disable-device-cert-distribution.png 601w, https:\/\/jumpcloud.com\/wp-content\/uploads\/2023\/05\/disable-device-cert-distribution-300x172.png 300w\" sizes=\"(max-width: 601px) 100vw, 601px\" \/><\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-lease-and-renewal-timeframes-of-global-device-certificates\">Lease and Renewal Timeframes of Global Device Certificates<\/h2>\n\n\n\n<p>Global Device Certificates have a time-to-live of 30 days, but are renewed every 2 weeks by the user agent.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Conditional Access Policies let you relax, restrict, or deny user access to resources based on conditions that you set. Unmanaged [&hellip;]<\/p>\n","protected":false},"author":206,"featured_media":0,"template":"","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","inline_featured_image":false,"footnotes":""},"support_category":[2911,2854],"support_tag":[],"coauthors":[2842],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v22.9 (Yoast SEO v22.9) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Manage Conditional Access Policy Certificates for Desktop - JumpCloud<\/title>\n<meta name=\"description\" content=\"Learn how to manage device certificates in order to use conditional access policies with devices.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jumpcloud.com\/support\/manage-conditional-access-policy-certificates\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Manage Conditional Access Policy Certificates for Desktop\" \/>\n<meta property=\"og:description\" content=\"Learn how to manage device certificates in order to use conditional access policies with devices.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jumpcloud.com\/support\/manage-conditional-access-policy-certificates\" \/>\n<meta property=\"og:site_name\" content=\"JumpCloud\" \/>\n<meta property=\"article:modified_time\" content=\"2024-08-08T18:31:34+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/05\/disable-device-cert-distribution.png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"4 minutes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data2\" content=\"pamkellman\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/jumpcloud.com\/support\/manage-conditional-access-policy-certificates\",\"url\":\"https:\/\/jumpcloud.com\/support\/manage-conditional-access-policy-certificates\",\"name\":\"Manage Conditional Access Policy Certificates for Desktop - JumpCloud\",\"isPartOf\":{\"@id\":\"https:\/\/jumpcloud.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/jumpcloud.com\/support\/manage-conditional-access-policy-certificates#primaryimage\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/support\/manage-conditional-access-policy-certificates#primaryimage\"},\"thumbnailUrl\":\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/05\/disable-device-cert-distribution.png\",\"datePublished\":\"2023-06-05T17:11:25+00:00\",\"dateModified\":\"2024-08-08T18:31:34+00:00\",\"description\":\"Learn how to manage device certificates in order to use conditional access policies with devices.\",\"breadcrumb\":{\"@id\":\"https:\/\/jumpcloud.com\/support\/manage-conditional-access-policy-certificates#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/jumpcloud.com\/support\/manage-conditional-access-policy-certificates\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/support\/manage-conditional-access-policy-certificates#primaryimage\",\"url\":\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/05\/disable-device-cert-distribution.png\",\"contentUrl\":\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/05\/disable-device-cert-distribution.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/jumpcloud.com\/support\/manage-conditional-access-policy-certificates#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/jumpcloud.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Support\",\"item\":\"https:\/\/jumpcloud.com\/support\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Manage Conditional Access Policy Certificates for Desktop\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/jumpcloud.com\/#website\",\"url\":\"https:\/\/jumpcloud.com\/\",\"name\":\"JumpCloud\",\"description\":\"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.\",\"publisher\":{\"@id\":\"https:\/\/jumpcloud.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/jumpcloud.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/jumpcloud.com\/#organization\",\"name\":\"JumpCloud\",\"url\":\"https:\/\/jumpcloud.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"contentUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"width\":598,\"height\":101,\"caption\":\"JumpCloud\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Manage Conditional Access Policy Certificates for Desktop - JumpCloud","description":"Learn how to manage device certificates in order to use conditional access policies with devices.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jumpcloud.com\/support\/manage-conditional-access-policy-certificates","og_locale":"en_US","og_type":"article","og_title":"Manage Conditional Access Policy Certificates for Desktop","og_description":"Learn how to manage device certificates in order to use conditional access policies with devices.","og_url":"https:\/\/jumpcloud.com\/support\/manage-conditional-access-policy-certificates","og_site_name":"JumpCloud","article_modified_time":"2024-08-08T18:31:34+00:00","og_image":[{"url":"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/05\/disable-device-cert-distribution.png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"4 minutes","Written by":"pamkellman"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/jumpcloud.com\/support\/manage-conditional-access-policy-certificates","url":"https:\/\/jumpcloud.com\/support\/manage-conditional-access-policy-certificates","name":"Manage Conditional Access Policy Certificates for Desktop - JumpCloud","isPartOf":{"@id":"https:\/\/jumpcloud.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/jumpcloud.com\/support\/manage-conditional-access-policy-certificates#primaryimage"},"image":{"@id":"https:\/\/jumpcloud.com\/support\/manage-conditional-access-policy-certificates#primaryimage"},"thumbnailUrl":"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/05\/disable-device-cert-distribution.png","datePublished":"2023-06-05T17:11:25+00:00","dateModified":"2024-08-08T18:31:34+00:00","description":"Learn how to manage device certificates in order to use conditional access policies with devices.","breadcrumb":{"@id":"https:\/\/jumpcloud.com\/support\/manage-conditional-access-policy-certificates#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jumpcloud.com\/support\/manage-conditional-access-policy-certificates"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/support\/manage-conditional-access-policy-certificates#primaryimage","url":"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/05\/disable-device-cert-distribution.png","contentUrl":"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/05\/disable-device-cert-distribution.png"},{"@type":"BreadcrumbList","@id":"https:\/\/jumpcloud.com\/support\/manage-conditional-access-policy-certificates#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/jumpcloud.com\/"},{"@type":"ListItem","position":2,"name":"Support","item":"https:\/\/jumpcloud.com\/support"},{"@type":"ListItem","position":3,"name":"Manage Conditional Access Policy Certificates for Desktop"}]},{"@type":"WebSite","@id":"https:\/\/jumpcloud.com\/#website","url":"https:\/\/jumpcloud.com\/","name":"JumpCloud","description":"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.","publisher":{"@id":"https:\/\/jumpcloud.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jumpcloud.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/jumpcloud.com\/#organization","name":"JumpCloud","url":"https:\/\/jumpcloud.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/","url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","contentUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","width":598,"height":101,"caption":"JumpCloud"},"image":{"@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/84787"}],"collection":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support"}],"about":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/types\/support"}],"author":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/users\/206"}],"version-history":[{"count":2,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/84787\/revisions"}],"predecessor-version":[{"id":113768,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/84787\/revisions\/113768"}],"wp:attachment":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/media?parent=84787"}],"wp:term":[{"taxonomy":"support_category","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support_category?post=84787"},{"taxonomy":"support_tag","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support_tag?post=84787"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/coauthors?post=84787"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}