- \n
- Administrator<\/strong>: 探花大神 administrators configure and manage 探花大神 for their organization.<\/li>\n\n\n\n
- User<\/strong>: 探花大神 users access their company resources through 探花大神.<\/li>\n\n\n\n
- Device<\/strong>: Computers or Servers that run Mac, Windows, and Linux devices can be managed through 探花大神. Admins can provision users to devices, deploy policies to devices, and execute commands on devices through 探花大神.<\/li>\n\n\n\n
- Groups<\/strong>: 探花大神 connects company resources to groups of resources. For example, connect a group of users to Single Sign On (SSO) applications, RADIUS servers, and directories like Google Workspace and Microsoft 365. You can also connect groups of users to groups of devices.<\/li>\n\n\n\n
- Directory<\/strong>: A directory service organizes information about a network’s users and resources. 探花大神 integrates with a variety of popular directory services like Google Workspace and Microsoft 365 to sync user accounts. These integrations let 探花大神 act as an authoritative directory with a single set of credentials that can be used across all directory services.<\/li>\n\n\n\n
- Applications<\/strong>: SSO SAML 2.0 applications that you can connect with 探花大神. Applications like Slack, Salesforce, AWS, CakeHR, and so many more.<\/li>\n<\/ul>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\")
<\/p><\/div>Tip:<\/strong> \nSee our glossary<\/a> for more terms.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Best Practices Before You Start<\/h2>\n\n\n\n
探花大神 University Admin Training and Certification<\/h3>\n\n\n\n
探花大神 University is a reflection of how much we value education as part of our solution. This learning platform is designed to give you the flexibility to take applicable courses and skip courses that you don\u2019t need. We believe in freeform learning so you can take any course, watch any video, and practice any task without being locked into a certain series.
We believe learning is most effective when the learner gets to choose what they need, when they need it, and how they need it \u2014 and then move on with their day. Structure is there if you want it, but you can easily have freedom to get in, get the information you need, and get out.
Before starting your initial implementation of 探花大神, we recommend taking the initial courses within our catalogue. 探花大神 is a large platform and is capable of managing a myriad of technical resources. 探花大神 University\u2019s courses train IT admins on best practices for utilizing 探花大神 to the fullest extent.
It\u2019s best practice for newer customers to have an IT team member become 探花大神 Core Certified before rolling out the platform within the technical environment. By obtaining the 探花大神 Core Certificate, this verifies the holder\u2019s core knowledge, best practices, and implementation steps using 探花大神\u2019s platform.
To get started with your training and certification today, check out 探花大神 University<\/a>.<\/p>\n\n\n\nGuided Simulations<\/h3>\n\n\n\n
Learn by doing! Explore 探花大神\u2019s features from multiple perspectives without impacting your live environment or jumping through hoops for test accounts. 探花大神\u2019s Guided Simulations page<\/a> contains examples for both admins and users alike. These simulations cover some of our most popular modules such as agent installation, password reset, Conditional Access Policies, and configuring MDM.
These simulations are a great way to help train end users within the organization on how to leverage 探花大神 to do important tasks like managing their passwords, activating their account, and installing the agent.<\/p>\n\n\n\nSupport and Troubleshooting<\/h3>\n\n\n\n
- \n
- Bookmark our Support page<\/a>, where you can search our\u00a0Help Center articles.<\/li>\n\n\n\n
- Familiarize yourself with our\u00a0Support Policies<\/a>.<\/li>\n\n\n\n
- Subscribe to the\u00a0探花大神 Status Page<\/a>\u00a0for status updates, incident alerts, and maintenance windows.<\/li>\n\n\n\n
- If you do get stuck, reach out to 探花大神 Support<\/a>. Include the following information in your request:\n
- \n
- A detailed description of your issue<\/li>\n\n\n\n
- Any troubleshooting steps or actions that you\u2019ve taken<\/li>\n\n\n\n
- Relevant 探花大神 Agent Logs (for device related issues)<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Familiarize yourself with our\u00a0Support Request Guidelines<\/a>.<\/li>\n<\/ul>\n\n\n\n
Tips for Set Up and Management<\/h3>\n\n\n\n
- \n
- Avoid surprises<\/strong> – Avoid unexpected and unintended consequences; sign up for a free testing account<\/a>.<\/li>\n\n\n\n
- Test and explore<\/strong> – Have a plan. Set up a staging environment, install the 探花大神 Agent, and test any changes in a staging environment that mirrors your production devices as closely as possible. This will be helpful for initial implementation, ongoing maintenance, and updates.<\/li>\n\n\n\n
- Be consistent<\/strong> – The foundation for efficient, fast scaling is consistency. Successful scaling starts with a good understanding of 探花大神 Groups<\/a>.<\/li>\n\n\n\n
- Add Administrator Team Members<\/strong> – We always suggest adding your IT team members as 探花大神 Administrators to your organization. You can set each admin with their own role with scoped permissions based on their job duties or needs. Learn more about how to Add Administrators to 探花大神<\/a> and grant their Admin Account Role<\/a>. <\/li>\n\n\n\n
- Notify employees<\/strong> – To ensure a consistent line of communication between you and your employees and end-users, email them in preparation with upcoming steps, needs, and actions. 探花大神 has supplied some generic email templates to assist with notifying your organization on the different steps throughout your implementation. Check out these 探花大神 End-User Email Templates<\/a> to use when notifying your employees.\u200b<\/li>\n<\/ul>\n\n\n\n
Set up your Admin Portal<\/h2>\n\n\n\n
Settings<\/h3>\n\n\n\n
Before you can really start to build out your 探花大神 directory, we recommend creating and modifying various global settings like password aging, complexity, lockouts, and more. These configurations are enacted on all resources within the 探花大神 platform.<\/p>\n\n\n\n
End User Impact<\/strong>: None<\/strong>\/Low<\/strong><\/p>\n\n\n\n
- \n
- Settings in the 探花大神 Admin Portal<\/a><\/li>\n\n\n\n
- Adding Admins to your 探花大神 Organization<\/a><\/li>\n\n\n\n
- Customizing Welcome Emails sent to Users from 探花大神<\/a> <\/li>\n\n\n\n
- Conditional Access: Global Policy for MFA<\/a> (if applicable)<\/li>\n\n\n\n
- Enabling System Insights<\/a> (if applicable)<\/li>\n\n\n\n
- Enabling Directory Insights<\/a> (if applicable)<\/li>\n<\/ul>\n\n\n\n
Building Users in 探花大神<\/h3>\n\n\n\n
This step involves building the user directory. You’ll connect users with devices in the Going Live<\/a> steps.<\/p>\n\n\n\n
End User Impact<\/strong>: None<\/strong>\/Low<\/strong><\/p>\n\n\n\n
User Import Types and Privileges required<\/strong>:<\/p>\n\n\n\n
- \n
- CSV Import<\/strong>: 探花大神 Admin Portal privileges<\/li>\n\n\n\n
- Google Workspace Directory Import<\/strong>: Super Administrator credentials are required<\/li>\n\n\n\n
- Microsoft 365 Directory Import<\/strong>: Global Administrator credentials are required<\/li>\n\n\n\n
- Okta Real-Time User and Password Import<\/strong>: Administrator credentials are required<\/li>\n\n\n\n
- Active Directory Integration<\/strong>: Domain Administrator credentials are required<\/li>\n\n\n\n
- API Import<\/strong>: 探花大神 Admin Portal privileges and an API key<\/li>\n<\/ul>\n\n\n\n
Considerations<\/strong>:<\/p>\n\n\n\n
- \n
- CSV imported users without an initial password will not receive any welcome email. If you would like to send an activation email to these users, select them in bulk from the Users page. Click “more actions” and then “Resend Email”<\/li>\n\n\n\n
- Adding\/Importing users into 探花大神 will have no effect on existing accounts until the user is associated with a resource (Device, Google Workspace\/Microsoft 365 Directory).<\/li>\n\n\n\n
- If you would like 探花大神 to take-over existing user accounts, the 探花大神 username must EXACTLY MATCH the local device username. If there is not an exact match, 探花大神 will assume the username is new and create a new user profile when a user is bound to the device. See 探花大神 User Naming Convention<\/a>.<\/li>\n\n\n\n
- Usernames for users imported from Google Workspace or Microsoft 365 will be their email address prefix. Please consider whether this matches your local device usernames, or if you intend to create new local user accounts. Be aware that you can only rename usernames of user accounts that aren’t yet bound to a resource.\n
- \n
- Example: testuser123@domain.com will have a username of testuser123.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
\u200bStep-by-step Implementation links<\/strong>:<\/p>\n\n\n\n
CSV Import<\/strong><\/p>\n\n\n\n
- \n
- Importing 探花大神 Users via CSV<\/a><\/li>\n<\/ul>\n\n\n\n
Google Workspace Directory Import<\/strong><\/p>\n\n\n\n
- \n
- Google Workspace User Import, Provisioning, and Sync<\/a><\/li>\n<\/ul>\n\n\n\n
Don’t connect users to the Google Workspace Directory until you’re ready to Go Live.<\/p>\n\n\n\n
Microsoft 365 Directory Import<\/strong><\/p>\n\n\n\n
- \n
- Microsoft 365 User Import, Provisioning, and Sync<\/a><\/li>\n<\/ul>\n\n\n\n
Don’t connect users to the Microsoft 365 Directory until you’re ready to Go Live.<\/p>\n\n\n\n
Okta Real Time User Import<\/strong><\/p>\n\n\n\n
- \n
- Configure Okta Real-time User and Password Import<\/a>: This integration with Okta allows Okta to be the authority over 探花大神 Users, their passwords, and User Attributes. In this configuration it is always recommended to have users change their passwords in Okta. Okta will then immediately send the new password to their 探花大神 account and associated resources. Please note that if Users are on macOS devices, there are certain workflows that need to be followed. These macOS workflows are addressed within the KB above. <\/li>\n<\/ul>\n\n\n\n
Active Directory Integration<\/strong><\/p>\n\n\n\n
- \n
- Integrating AD with 探花大神<\/a>: This is used when you\u2019re wanting to bridge a bisynchronous connection between your Active Directory domain and your 探花大神 tenant. You can leverage this integration to ensure that password changes within either directory are synced to the other. Not generally recommended if you\u2019re migrating away from or decommissioning Active Directory, as we recommend another solution such as the M365 or GWS Directory Sync to import your users. <\/li>\n\n\n\n
- Migrating Users from Active Directory to 探花大神<\/a>: This is used when you\u2019re wanting to export the Active Directory users into 探花大神. The methods mentioned in this KB are via CSV, but you may also alternatively use the M365 or GWS import feature instead. If your users are using domain-bound devices, you will need to migrate these devices from AD-bound to a local workgroup and local user profile using the 探花大神 Active Directory Migration Utility<\/a>. This helps convert the devices and profiles to a local workgroup and profile while also installing the 探花大神 Agent on your behalf. <\/li>\n<\/ul>\n\n\n\n
Deploying Agents to Devices<\/h3>\n\n\n\n
You should deploy the 探花大神 agent on any devices that you want 探花大神 to manage. You can install the 探花大神 agent on devices that are connected to a domain, however the agent is limited to just Commands and System Insights.<\/p>\n\n\n\n
End User Impact<\/strong>: Low<\/strong><\/p>\n\n\n\n
Required Privileges<\/strong>:<\/p>\n\n\n\n
- \n
- Manual and Remote Installs require remote root \/ administrator access to the device. To commit remote installs, you may need an RMM, MDM, or remote tooling to install the 探花大神 Agent. Otherwise you may manually install by being physically present to install or via a remote screen share software with your users. <\/li>\n\n\n\n
- End-User Installs require the User to have local root \/ administrator privileges to the device.<\/li>\n<\/ul>\n\n\n\n
探花大神 Agent Requirements<\/strong>:<\/p>\n\n\n\n
- \n
- 探花大神 Agent Compatibility, Device Requirements, and Impacts<\/a><\/li>\n\n\n\n
- Internet connectivity and time synchronization – 探花大神 Agent Networking Requirements<\/a><\/li>\n<\/ul>\n\n\n\n
Considerations<\/strong>: <\/p>\n\n\n\n
- \n
- Command line vs. manual install depending on current environment size and expected future growth and desired deployment practices.<\/li>\n\n\n\n
- Establish a consistent naming convention for your user accounts. Verify your 探花大神 naming convention for usernames exactly matches the usernames on existing devices to ensure proper account take over. <\/li>\n\n\n\n
- Consider establishing a consistent naming convention for device names. <\/li>\n\n\n\n
- Ensure that the network is configured to allow communication with 探花大神’s servers.<\/li>\n<\/ul>\n\n\n\n
Installation Methods<\/strong>:<\/p>\n\n\n\n
Windows<\/strong><\/p>\n\n\n\n
- \n
- Manual install via 探花大神 Admin Portal, Remote Install via RMM\/MDM, or manual distribution of 探花大神Installer.exe. <\/li>\n\n\n\n
- End User Installs from User Portal<\/a><\/li>\n\n\n\n
- Command line: Agent Deployment via Command Line<\/a><\/li>\n<\/ul>\n\n\n\n
Linux<\/strong><\/p>\n\n\n\n
- \n
- Manual Installation via 探花大神 Admin Portal or manual distribution of command-line install.<\/li>\n\n\n\n
- End User Installs from User Portal<\/a><\/li>\n\n\n\n
- Command line: curl –silent –show-error –header ‘x-connect-key: YOUR_CONNECT_KEY’ https:\/\/kickstart.jumpcloud.com\/Kickstart | sudo bash<\/li>\n\n\n\n
- Automation via Configuration Management Tools:\n
- \n
- Reducing Agent Install Time on Linux<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
macOS<\/strong><\/p>\n\n\n\n
Before deploying agents to your macOS devices, 探花大神 recommends configuring 探花大神 MDM with your ABM account. Check out how you can get started with <\/a>探花大神<\/a> MDM<\/a>. <\/p>\n\n\n\n
If you\u2019re using a third-party MDM (like JAMF, Kandji, Mosyle, etc), you may disregard the latter statement and continue installing the 探花大神 Agent. <\/p>\n\n\n\n
Note<\/strong>: Users must approve Full Disk Access to the 探花大神 Agent during install for macOS 12.0+ Monterey. See how to grant full disk access to the 探花大神 Agent<\/a>. <\/p>\n\n\n\n
- \n
- \u200bManual install via 探花大神 Admin Portal or manual distribution of jumpcloud-agent.pkg.<\/li>\n\n\n\n
- End User Installs from User Portal<\/a><\/li>\n<\/ul>\n\n\n\n
Configuring 探花大神 Groups<\/h3>\n\n\n\n
At 探花大神\u2019s core, it’s all about managing Users, their access, passwords, and identities across your environment. We recommend creating User Groups and Device Groups first as this will help you organize your user and device objects when you begin to import and add resources. As 探花大神 is GBAC-based (group-based access control), before Users can be given access to resources such as SSO Apps, they must be bound to a User Group that\u2019s been granted App access.<\/p>\n\n\n\n
Creating User Groups<\/h4>\n\n\n\n
Groups are the best way to control users’ access to resources. If the groups will be used to control access to a resource, connect the group to the resource.<\/p>\n\n\n\n
End User Impact<\/strong>: Low<\/strong><\/p>\n\n\n\n
Considerations<\/strong>:<\/p>\n\n\n\n
- \n
- Create groups as needed for a given resource, and add user groups to the resources.<\/li>\n\n\n\n
- Establish a naming convention for user groups that aligns across your organization.<\/li>\n\n\n\n
- Determine a consistent, scalable structure for groups.<\/li>\n\n\n\n
- User groups should be used to control access to devices, SSO applications, RADIUS networks, and directories like Google Workspace, Microsoft 365, and LDAP.<\/li>\n\n\n\n
- Learn More: Getting Started: User Groups<\/a><\/li>\n<\/ul>\n\n\n\n
Implementation Steps<\/strong>:<\/p>\n\n\n\n
- \n
- Log in to the 探花大神 Administrator Portal: https:\/\/console.jumpcloud.com<\/a>.<\/li>\n\n\n\n
- Go to USER MANAGEMENT<\/strong> > User Groups<\/strong>.<\/li>\n\n\n\n
- Click the ‘+<\/strong>‘ button to create a new user group. <\/li>\n\n\n\n
- Create a name for the group and add any additional attributes. <\/li>\n\n\n\n
- Go to USER MANAGEMENT<\/strong> > Users<\/strong> to bind users to the new user group. <\/li>\n\n\n\n
- Click Save<\/strong>.<\/li>\n<\/ol>\n\n\n\n
Creating Device Groups<\/h4>\n\n\n\n
Device groups can be used to control user or user group access to devices.<\/p>\n\n\n\n
End User Impact<\/strong>: Low<\/strong><\/p>\n\n\n\n
Considerations<\/strong>: <\/p>\n\n\n\n
- \n
- Policies and Policy Groups should be applied to Device Groups.<\/li>\n\n\n\n
- Device Groups can contain a mix of operating systems.<\/li>\n\n\n\n
- Create Device Groups as needed for your devices.<\/li>\n\n\n\n
- Connect devices to Device Groups.<\/li>\n\n\n\n
- Determine a scalable Device Group structure.<\/li>\n<\/ul>\n\n\n\n
See Getting Started: Device Groups<\/a> to learn how to create Device Groups.<\/p>\n\n\n\n
Going Live <\/h3>\n\n\n\n
Educate Your Employees<\/strong><\/p>\n\n\n\n
When installing any new software or environment-wide application, it\u2019s always best practice to educate and notify your end users before implementing. Send the following links to your organization employees so they can be aware of any changes, steps, and items during the implementation project. <\/p>\n\n\n\n
- \n
- New User FAQ<\/a><\/li>\n\n\n\n
- Getting Started with Your 探花大神 User Account<\/a><\/li>\n<\/ul>\n\n\n\n
Note<\/strong>: See Email Templates and Recommendations for Educating Users<\/a> for example user communications before implementing certain features throughout your project plan.<\/p>\n\n\n\n
End User Impact<\/strong>: High<\/strong><\/p>\n\n\n\n
Ensure end users understand 探花大神 will be managing their identity \u2014 their access to devices, applications, and other resources is managed by 探花大神.<\/p>\n\n\n\n
- \n
- You can connect the user to any of the resources connected to 探花大神 from a device to applications, networks, etc. However, if the user is created in a Staged user state, they will not gain access to their assigned resources until they are activated. See Managing User States<\/a> for specific information about when a user is provisioned.<\/li>\n\n\n\n
- Users update their passwords from the User Portal or from their 探花大神 Tray App on their device. See Changing My 探花大神 User Account Password?<\/a><\/li>\n\n\n\n
- If Mac users update their passwords in the 探花大神 User Portal instead of changing it in the 探花大神 Mac Tray App, they’ll have to log out and log back in to update their Keychain and FileVault password. <\/li>\n\n\n\n
- Google Workspace and Microsoft 365 users change their passwords in the 探花大神 User Portal. If users change their passwords within either of these directories instead of 探花大神, there may be a password discrepancy between the two.<\/li>\n<\/ul>\n\n\n\n
Considerations<\/strong>:<\/p>\n\n\n\n
- \n
- User Activation<\/strong> – setting a temporary password vs. sending the user activation email.<\/li>\n\n\n\n
- Notify applicable users that they will be receiving a Welcome email from 探花大神.<\/li>\n\n\n\n
- Educate All Users<\/strong> \u2014 including Google Workspace and Microsoft 365 users \u2014 that they change their password in their 探花大神 User Portal or in their 探花大神 managed device\u2019s 探花大神 Tray App. <\/li>\n<\/ul>\n\n\n\n
Implementation Steps<\/strong>:<\/p>\n\n\n\n
- \n
- Customize organization information in the 探花大神 Admin Portal under Settings<\/strong>.<\/li>\n\n\n\n
- Communicate workflow changes to users.<\/li>\n<\/ol>\n\n\n\n
Google Workspace Directory Sync<\/h3>\n\n\n\n
To use 探花大神’s Google Workspace Directory integration, one of the following Google licenses are required:<\/p>\n\n\n\n
- \n
- Google Workspace for Business<\/li>\n\n\n\n
- Google Workspace for Education<\/li>\n\n\n\n
- Google Workspace Basic (requires valid payment input for user additions)<\/li>\n\n\n\n
- You must have an active Google Workspace domain to proceed<\/li>\n\n\n\n
- A Google Workspace Domain Admin (Super Administrator)<\/li>\n<\/ul>\n\n\n\n
End User Impact<\/strong>: Medium<\/strong> – User workflow impacted<\/p>\n\n\n\n
Prerequisites<\/strong>:<\/p>\n\n\n\n
- Communicate workflow changes to users.<\/li>\n<\/ol>\n\n\n\n
- Users update their passwords from the User Portal or from their 探花大神 Tray App on their device. See Changing My 探花大神 User Account Password?<\/a><\/li>\n\n\n\n
- Getting Started with Your 探花大神 User Account<\/a><\/li>\n<\/ul>\n\n\n\n
- New User FAQ<\/a><\/li>\n\n\n\n
- Go to USER MANAGEMENT<\/strong> > User Groups<\/strong>.<\/li>\n\n\n\n
- Log in to the 探花大神 Administrator Portal: https:\/\/console.jumpcloud.com<\/a>.<\/li>\n\n\n\n
- Command line: Agent Deployment via Command Line<\/a><\/li>\n<\/ul>\n\n\n\n
- Internet connectivity and time synchronization – 探花大神 Agent Networking Requirements<\/a><\/li>\n<\/ul>\n\n\n\n
- 探花大神 Agent Compatibility, Device Requirements, and Impacts<\/a><\/li>\n\n\n\n
- Migrating Users from Active Directory to 探花大神<\/a>: This is used when you\u2019re wanting to export the Active Directory users into 探花大神. The methods mentioned in this KB are via CSV, but you may also alternatively use the M365 or GWS import feature instead. If your users are using domain-bound devices, you will need to migrate these devices from AD-bound to a local workgroup and local user profile using the 探花大神 Active Directory Migration Utility<\/a>. This helps convert the devices and profiles to a local workgroup and profile while also installing the 探花大神 Agent on your behalf. <\/li>\n<\/ul>\n\n\n\n
- Integrating AD with 探花大神<\/a>: This is used when you\u2019re wanting to bridge a bisynchronous connection between your Active Directory domain and your 探花大神 tenant. You can leverage this integration to ensure that password changes within either directory are synced to the other. Not generally recommended if you\u2019re migrating away from or decommissioning Active Directory, as we recommend another solution such as the M365 or GWS Directory Sync to import your users. <\/li>\n\n\n\n
- Configure Okta Real-time User and Password Import<\/a>: This integration with Okta allows Okta to be the authority over 探花大神 Users, their passwords, and User Attributes. In this configuration it is always recommended to have users change their passwords in Okta. Okta will then immediately send the new password to their 探花大神 account and associated resources. Please note that if Users are on macOS devices, there are certain workflows that need to be followed. These macOS workflows are addressed within the KB above. <\/li>\n<\/ul>\n\n\n\n
- Microsoft 365 User Import, Provisioning, and Sync<\/a><\/li>\n<\/ul>\n\n\n\n
- Google Workspace User Import, Provisioning, and Sync<\/a><\/li>\n<\/ul>\n\n\n\n
- Importing 探花大神 Users via CSV<\/a><\/li>\n<\/ul>\n\n\n\n
- Usernames for users imported from Google Workspace or Microsoft 365 will be their email address prefix. Please consider whether this matches your local device usernames, or if you intend to create new local user accounts. Be aware that you can only rename usernames of user accounts that aren’t yet bound to a resource.\n
- Google Workspace Directory Import<\/strong>: Super Administrator credentials are required<\/li>\n\n\n\n
- Adding Admins to your 探花大神 Organization<\/a><\/li>\n\n\n\n
- Test and explore<\/strong> – Have a plan. Set up a staging environment, install the 探花大神 Agent, and test any changes in a staging environment that mirrors your production devices as closely as possible. This will be helpful for initial implementation, ongoing maintenance, and updates.<\/li>\n\n\n\n
- Avoid surprises<\/strong> – Avoid unexpected and unintended consequences; sign up for a free testing account<\/a>.<\/li>\n\n\n\n
- Familiarize yourself with our\u00a0Support Policies<\/a>.<\/li>\n\n\n\n
- User<\/strong>: 探花大神 users access their company resources through 探花大神.<\/li>\n\n\n\n