Skip to content

Security best practices#

Team administrators can use this checklist of settings to restrict who can connect to the team's computers and how they connect. Use it when you configure a team and each time you review its configuration. Some items depend on your plan; see plans and pricing.

Small team without SSO? Start by requiring 2-factor authentication (Jump Desktop for Teams Pro and Enterprise): on the team's Security page, click Require 2-Factor Authentication. Members turn on 2-factor authentication for their own accounts.

Computers#

  • Assign a Connect Configuration to every computer (Jump Desktop for Teams Enterprise). To find computers without an assigned configuration, show the Connect Settings column in Computers.
  • Assign a Connect Configuration to every installer (Enterprise plan). A new team's first installer uses Default Configuration. See Add and manage computers.
  • Keep Connect up to date. Leave Automatic Updates on (the default), and review the Connect Version column in Computers.
  • Have each person sign in to hosts with an individual OS account. Do not use shared accounts.

Connect Configuration settings#

Configure these settings in Connect Configurations (Enterprise plan).

Setting Default Recommendation
Local Configuration Changes Off Keep off to prevent local users from changing Connect settings.
Add Remote Access Users Off Keep off to prevent local users from granting access to others.
Passwordless Login Not allowed Keep Not allowed unless you require passwordless logins.
Screen Sharing On Turn off if users should not share the screen through a sharing link.
Privacy Mode Client Controlled Consider Always Enabled to block local viewing and input during sessions. See Privacy mode.
Watermark Off Turn on to indicate that a session is in progress. See Add a watermark to sessions.
Local Authentication Restrictions Not Set Allow only the users and groups who need to sign in to hosts. See Restrict who can sign in to hosts.
Idle Timeout Off Set a timeout appropriate to your workflow.
Max Session Duration Not set Consider a limit if sessions should not run indefinitely. See Limit session length.
RDP Enabled, VNC Enabled Off Keep off unless you need these protocols.
Manual Fluid Connections Off Keep off unless you use Cloudless Fluid.
Direct Connections Only, Relay Connections Only Off Consider one of these settings to require a direct network path (such as a VPN) or to route all traffic through relays. See Choose a connectivity option.
Allow Cloud Connections On Consider turning off only if the computer should accept manual IP connections alone, such as Cloudless Fluid. Access Groups and other team access controls do not apply to Cloudless Fluid.
Automatic Updates On Keep on.
Cloud Connection History On Keep on so that connections appear in Connection Logs.

Users and sign-in#

  • Give everyone their own Jump account. Do not share accounts. If you manage several teams, group billing prevents paying twice for the same user.
  • Maintain at least two admins. Assign Admin (Read-Only) to staff who need view-only access, and turn off remote access for admins who do not connect. See Team roles and remote access.
  • Grant least-privilege access with Access Groups.
  • Use single sign-on, with domain verification and SCIM to provision and deprovision users.
  • Without SSO, also disable social sign-in on the team's Security page.
  • Limit sign-in duration (Enterprise plan) to require users to sign in again at regular intervals. The duration is specified in minutes; for example, 43,200 minutes is 30 days.
  • Review users regularly. In Users, check the Last Active and 2FA columns, and remove users who no longer need access. To see where a user is signed in (Enterprise plan), open the user. See Add and manage users.
  • Review your own account. On your dashboard's Security page, review Where you're signed in and API Tokens, and remove any entry you do not recognize. See Manage your Jump account.

Logs#

Connectivity#