Skip to content

Security best practices

A checklist of settings that limit who can reach your team's computers and how, for team administrators. Use it when you set up a team and each time you review it. Some items depend on your plan; see plans and pricing.

Small team without SSO? Start by requiring 2-factor authentication (Teams Pro and Enterprise): on the team's Security page, click Require 2-Factor Authentication. Members turn it on for their own accounts.

Computers

  • Assign a Connect Configuration to every computer (Teams Enterprise). To find computers without one, show the Connect Settings column in Computers.
  • Assign a Connect Configuration to every installer (Teams Enterprise). A new team's first installer uses Default Configuration. See Add and manage computers.
  • Keep Connect up to date. Leave Automatic Updates on (the default) and check the Connect Version column in Computers.
  • Have each person sign in to remote computers with their own OS account. Avoid shared accounts.

Connect Configuration settings

Set these in Connect Configurations (Teams Enterprise).

Setting Default Recommendation
Local Configuration Changes Off Keep off so local users can't change Connect settings.
Add Remote Access Users Off Keep off so local users can't grant access to others.
Passwordless Login Not allowed Keep Not allowed unless you need passwordless logins.
Screen Sharing On Turn off if users shouldn't share the screen through a sharing link.
Privacy Mode Client Controlled Consider Always Enabled to block local viewing and input during sessions. See Privacy mode.
Watermark Off Turn on to show that a session is in progress. See Add a watermark to sessions.
Idle Timeout Off Set a timeout that suits your workflow.
RDP Enabled, VNC Enabled Off Keep off unless you need these protocols.
Manual Fluid Connections Off Keep off unless you use Cloudless Fluid.
Direct Connections Only, Relay Connections Only Off Consider one to require a direct path (such as a VPN) or to send all traffic through relays. See Choose a connectivity option.
Allow Cloud Connections On Consider turning off only if the computer should accept manual IP connections alone, such as Cloudless Fluid. Access Groups and other team access controls don't apply to Cloudless Fluid.
Automatic Updates On Keep on.
Cloud Connection History On Keep on so connections appear in Connection Logs.

Users and sign-in

  • Give everyone their own Jump account. Don't share accounts. If you manage several teams, group billing avoids paying twice for the same user.
  • Have at least two admins. Use Admin (Read-Only) for view-only staff, and turn off remote access for admins who don't connect. See Team roles and remote access.
  • Grant least access with Access Groups.
  • Use single sign-on, with domain verification and SCIM to provision and remove users.
  • Without SSO, also disable social sign-in on the team's Security page.
  • Limit sign-in duration (Teams Enterprise) so users sign in again regularly. The duration is set in minutes: for example, 43,200 minutes is 30 days.
  • Review users regularly. In Users, check the Last Active and 2FA columns and remove users who no longer need access. Open a user to see where they're signed in (Teams Enterprise). See Add and manage users.
  • Review your own account. On your dashboard's Security page, check Where you're signed in and API Tokens, and remove anything you don't recognize. See Manage your Jump account.

Logs

  • Review Activity Logs for team changes and Connection Logs for connections.
  • Export connection logs before removing a computer, which deletes its connection history. Export from Connection Logs as CSV or JSON, or archive with the API.
  • Send logs to your SIEM with the Jump Desktop API.

Connectivity