- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
JumpCloud Multi-Factor Authentication (MFA)
One phished password opens the VPN, the laptop and every app. A password is still the only lock — JumpCloud MFA asks for the same push, code or passkey at SaaS apps, laptop logins, the VPN and LDAP systems, through its free Protect app, and adds passwordless JumpCloud Go and device-aware rules for teams ready to move past SMS — each priced in plain per-user steps.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The JumpCloud platform family
This page covers JumpCloud Multi-Factor Authentication (MFA) — with JumpCloud Go, Conditional Access and Access Risk Detection folded in. The rest:
Quick facts
30-second orientation- Product
- Workforce MFA with the JumpCloud Protect app, plus JumpCloud Go, Conditional Access and Access Risk Detection folded in
- Maker
- JumpCloud Inc., Louisville, Colorado; founded 2012; CISO and VP Security Roland Palmer since March 2026
- Factors
- Primary: TOTP, push, WebAuthn and passkeys, or Duo Security; SMS only as a backup, via your own Twilio Verify
- Reach
- Apps behind JumpCloud SSO, Windows, macOS and Linux logins, LDAP binds and RADIUS for VPN and Wi-Fi
- Price
- $3 per user per month on a yearly plan or $4 paid monthly; bundled in SSO, Device Identity and Platform packages
- Passwordless
- JumpCloud Go: hardware-protected, phishing-resistant login from managed devices; $5 / $6, or in Platform tiers
- Context
- Conditional Access ($3 / $4): trusted device, network and location rules; in packages only with Platform Prime
- Risk
- Access Risk Detection, GA 26 August 2026: impossible travel, unfamiliar devices, dormant accounts, MFA to resolve
- India
- Organisations created since April 2026 can choose Mumbai; stored data rests in India, logs and telemetry may not
- In India via
- TechBag — factor plan, enrolment rollout, package choice, quote in INR with GST
Understand multi-factor authentication before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is multi-factor authentication?
MFA means a stolen password is not enough: the user must also prove they hold a phone, key or device.
Passwords alone vs JumpCloud MFA — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | Passwords alone | JumpCloud Multi-Factor Authentication (MFA) |
|---|---|---|
| VPN and Wi-Fi | A password is all it takes | RADIUS logins that demand a factor |
| Laptop login | Local password, no second step | MFA at the Windows, Mac or Linux login |
| Factor of choice | SMS codes for everyone | Push, TOTP or passkeys; SMS as backup |
| Enrolment | An email asking people to set it up | Required factor with a grace period |
| Risky sign-ins | Found in logs after the fact | Impossible travel and new devices flagged |
| What it is NOT | — | A free tier, or device rules in the $3 price |
The cheapest test is the 30-day trial on IT and finance: require one factor with a grace period, protect the VPN over RADIUS, and count the help calls.
The four pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Protect app
JumpCloud’s free authenticator app answers push prompts and generates TOTP codes; admins can instead accept Duo, or WebAuthn keys and passkeys, as primary factors.
Enrolment
Admins require one primary factor and set a grace period; users may defer enrolment until it ends, after which no resource opens without a factor.
Enforcement points
The same factor is demanded at the User Portal and SSO apps, at Windows, macOS and Linux logins, and on LDAP binds and RADIUS for VPNs and Wi-Fi.
Policy engine
Conditional Access weighs device trust, network and location; Access Risk Detection flags impossible travel, unfamiliar devices and dormant accounts.
A factor enrolled once in the Protect app, a key or Duo is demanded at the portal, apps, laptops, LDAP and RADIUS, while policy decides when to ask or block.
Nine capabilities. Verify, go passwordless, read context.
JumpCloud MFA makes a stolen password useless — at the app, the laptop and the VPN alike.
One-tap approval
The free JumpCloud Protect app sends a push prompt to approve a sign-in, or shows a TOTP code when the phone is offline.
Bring your own factor
Organisations already on Duo can keep it: Duo Security is one of the four eligible primary factors, alongside TOTP, push and WebAuthn.
SMS as a backup only
SMS codes arrive through your own Twilio Verify account and can only be a backup factor; admins must accept a SIM-swap warning.
Keys and passkeys
Hardware security keys and passkeys register as primary factors, and JumpCloud recommends WebAuthn or TOTP over SMS for every user.
JumpCloud Go
Passwordless sign-in to web resources from a managed device, protected by the device’s hardware; $5 a user a month on annual terms.
MFA on VPN and LDAP
RADIUS logins for VPNs and Wi-Fi and LDAP binds can demand a factor too, with a dedicated MFA LDAP host listed in each region.
Trusted-device rules
Conditional Access can limit sign-in to devices JumpCloud trusts, including company-owned and BYOD phones under Mobile Device Trust.
Chrome Enterprise trust
An integration with Chrome Enterprise brings browser-based device trust into sign-in decisions for web apps opened in Chrome.
Access Risk Detection
Generally available since 26 August 2026, it flags impossible travel, unfamiliar devices and dormant accounts, and can resolve with MFA.
Watch JumpCloud demo passwordless and device trust
Three videos from JumpCloud’s official channel, from 2024 and 2025: a JumpCloud Go release demo, a Chrome Enterprise device-trust Deep Dive, and a device trust policy tutorial.
Product Release Demo: JumpCloud Go™
An 8:16 release demo from February 2024 showing JumpCloud Go passwordless sign-in from a managed device.
The Deep Dive | Elevating Security: Device Trust with Chrome Enterprise and JumpCloud 10.17.2025
A 43:09 Deep Dive session from October 2025 on device trust through the Chrome Enterprise integration.
Device Trust Policy | JumpCloud University Tutorial (2024)
A 3:39 JumpCloud University tutorial from 2024 on building a device trust policy for conditional access.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Most MFA stops at the web app. JumpCloud MFA also guards the laptop and the VPN.
Here’s what genuinely sets it apart — and exactly where it stops.
One factor for apps, laptops and the VPN
Many MFA rollouts stop at web apps. JumpCloud asks for the same factor at the User Portal, at Windows, macOS and Linux logins, on LDAP binds and on RADIUS for VPNs and Wi-Fi, so a stolen password does not open the laptop or the office network either.
Phishing-resistant without new hardware
WebAuthn passkeys and hardware keys are primary factors, and JumpCloud Go turns a managed laptop into a hardware-protected, passwordless credential for web resources. JumpCloud recommends TOTP or WebAuthn over SMS, which can only be a backup and needs your own Twilio account.
Enrolment that does not lock people out
Admins require one primary factor with a grace period, users see a countdown until it ends, and a backup factor can be made mandatory once SMS is switched on. Bought inside the $11 SSO or $13 Device Identity package, MFA adds nothing to the per-user price.
Where it stops
Risk-based checks are young: Access Risk Detection reached general availability in August 2026. Device-aware rules need Conditional Access, bundled only in Platform Prime, and JumpCloud Go costs $5 more outside Platform tiers. SMS needs your own Twilio. The India region is for new tenants only.
The numbers behind the platform
What your JumpCloud MFA rollout looks like
Pick factors per group
Decide who gets push, TOTP, passkeys or JumpCloud Go, and who without a smartphone needs a hardware key instead.
Set enrolment rules
Require one primary factor with a grace period, choose whether a backup is mandatory, and connect Twilio only if SMS is needed.
Enrol a pilot team
Turn MFA on for IT and finance at the portal, laptop logins and the VPN over RADIUS, and log every help call they raise.
Extend and harden
Roll out to all staff, move admins to passkeys or Go, and switch on Access Risk Detection alerts for impossible travel.
Decide on add-ons
Price Conditional Access and JumpCloud Go against Platform Prime, then fix the INR quote with GST for the full term.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Push on the Protect app now guards the VPN, the laptops and our SaaS apps; one factor everywhere was the whole reason we chose it.”
“The grace period let 400 staff enrol over two weeks without one lockout call; the countdown banner did most of the reminding.”
“Our finance team moved to passkeys and JumpCloud Go on managed laptops; phishing tests stopped landing on that group.”
“We wanted SMS for factory supervisors without smartphones, then learnt it needs our own Twilio account and works only as a backup.”
“Keeping Duo as the primary factor meant no re-enrolment when we moved the directory to JumpCloud; users barely noticed.”
“Device-trust rules were the part we wanted most, and they came only with the Conditional Access add-on; price it on day one.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the workforce MFA and passwordless market — tap any vendor to see why it sits where it does.
TechBag Workforce MFA Grid
Execution strength vs product vision — the classic market map, minus the paywall.
$3 a user a month annual; in the $11 SSO package.
Coverage Breadth × Policy Intelligence
The grid nobody publishes — how many places each product can demand a factor (apps, laptops, VPN, LDAP) vs how cleverly it decides when to ask.
Apps, laptops, LDAP and RADIUS; passkeys and Go; risk detection new.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
JumpCloud MFA vs the workforce MFA field
Against Cisco Duo, Okta Adaptive MFA, miniOrange MFA, WatchGuard AuthPoint and InstaSafe MFA — on factors, phishing resistance, reach, risk, device trust, price and India data.
| Dimension | JumpCloud Multi-Factor Authentication (MFA) | Cisco Duo | Okta Adaptive MFA | miniOrange MFA | WatchGuard AuthPoint | InstaSafe MFA |
|---|---|---|---|---|---|---|
| What it is | MFA + Protect app | Push MFA pioneer | Risk-based MFA | Broad-factor MFA | MSP-friendly MFA | MFA for zero trust |
| Deployment | Cloud only | Cloud plus proxy | SaaS | Cloud or on-prem | Cloud plus gateway | SaaS |
| Factor range | Push, TOTP, keys, Duo | Push to passkeys | Verify, WebAuthn, OTP | 15+ methods | Push, QR, OTP, keys | Email, SMS, TOTP |
| Phishing-resistant | WebAuthn, JumpCloud Go | FIDO2 documented | FIDO2 and passkeys | Passkeys, FIDO2 | Passkeys since 2026 | Not established |
| Where MFA reaches | Apps, PCs, LDAP, RADIUS | VPN, RDP, apps | Apps and RADIUS | Desktop, VPN, RDP, ADFS | Logon, RDP, VPN, apps | Apps and RADIUS |
| Risk-based step-up | New: GA August 2026 | Full adaptive policy | Risk-scored sign-in | Adaptive, simpler | Basic | Strongest with ZTNA |
| Device trust | Conditional Access, +$3 | Device health gate | Higher suites, on quote | Device in the score | Ask WatchGuard | Via InstaSafe ZTNA |
| Free tier or trial | 30-day trial | Duo Free, 10 users | 30-day trial | Ask for a trial | Ask the partner | Scoped PoC |
| Integrations | Inside JumpCloud | Any IdP, any app | Okta Integration Network | Apps, VPN, ADFS | Entra External MFA | InstaSafe stack |
| Pricing model | Per user, or bundled | Per-user tiers | Inside a suite | Per user, INR | Per user per year | Per user, INR quote |
| Published entry price | $3/user/month | Free; then $3 | $14 Core Essentials | ₹180 a user | ~$28.50/user/yr, US | Quote only |
| India data region | Mumbai, new tenants | India DC since 2022 | India tenants | India-built, on-prem | No Indian region | India-hosted |
| Lock-in and exit | Re-enrol everyone | Easy to swap | Tied to the suite | Self-host control | Gateway to rebuild | Tied to its ZTNA |
| Best fit | JumpCloud estates | VPN and RDP first | Okta SSO estates | Cost-sensitive rollouts | WatchGuard partners | InstaSafe ZTNA buyers |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose JumpCloud Multi-Factor Authentication (MFA) if…
- ✓You want one factor on SaaS apps, laptop logins, the VPN, Wi-Fi and LDAP systems
- ✓Passkeys and JumpCloud Go on managed laptops are your route off SMS codes
- ✓JumpCloud already runs your directory or devices, so MFA comes in a package you have
Compare alternatives if…
- ✓You need MFA in front of another IdP — Duo is built for that, and free to 10 users
- ✓Mature risk scoring matters most — Okta Adaptive MFA has the longer record
- ✓Factor data must stay on your own servers — miniOrange offers an on-premises install
Do not expect…
- ✓SMS as a primary factor, or SMS without your own Twilio Verify account
- ✓Device-trust rules inside the $3 MFA price — Conditional Access is extra
- ✓A long track record for risk detection — it reached GA in August 2026
JumpCloud Multi-Factor Authentication (MFA) is one of 30 iam, sso & mfa products TechBag carries. The IAM, SSO & MFA guide narrows them to a shortlist and shows the reasoning. →
What do password resets and lockouts cost you?
Drag the sliders (staff to enrol; IT-hour cost). Estimates model the IT time spent on password resets, account-lockout calls and clean-up after phished credentials, at an assumed 1.5 hours per user a year, with 70% of it removed by enforced MFA and passwordless sign-in. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Published. MFA is $3.00 per user a month on annual billing or $4.00 billed monthly (USD), and it is included in the SSO package ($11 / $13), Device Identity Management ($13 / $15) and every Platform package. JumpCloud Go passwordless is $5 / $6 and Conditional Access $3 / $4 when bought outside the packages that bundle them. The Protect app is free; SMS needs your own Twilio account. New accounts get a 30-day trial. TechBag quotes in INR with GST.
JumpCloud MFA
Best for one factor across apps, laptops and VPN
- $3 per user a month annual, $4 monthly
- Protect push and TOTP, WebAuthn, or Duo
- Included in the $11 SSO package
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
+ Go and Conditional Access
Best for passwordless and device-aware sign-in
- JumpCloud Go $5 / $6 per user
- Conditional Access $3 / $4 per user
- Both bundled in Platform Prime
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Which users have no smartphone, and will they use TOTP tokens, hardware keys or an SMS backup through Twilio?
If SMS is needed, who owns the Twilio Verify account and pays per message, and is SMS only ever the backup?
Will MFA be enforced at laptop login, on the VPN over RADIUS and on LDAP binds, or at the User Portal alone?
Is JumpCloud Go in our package, or a $5 add-on, and are the laptops that will use it managed by JumpCloud?
Do we need trusted-device or location checks? Conditional Access is a $3 add-on unless we buy Platform Prime.
Which package includes Access Risk Detection, and how are its impossible-travel alerts routed to our SOC?
Is the tenant in Mumbai, which MFA logs leave India, and do retained events meet CERT-In’s 180-day rule?
Is MFA cheaper alone at $3 or inside the $11 SSO package? Ask TechBag for both, in INR with GST.
Questions buyers ask
Ready to evaluate JumpCloud MFA?
Tell TechBag who signs in where, or let an advisor plan factors for every group, price MFA alone against the SSO package and Platform Prime, and get the quote in INR with GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.