Jamf Pro
Outline
About this document
This document provides step-by-step instructions to configure the Jamf Pro integration in SAFE and pull managed Mac and Mobile devices, installed software, and misconfigurations into SAFE.
Introduction
Jamf Pro is an Apple device management (MDM) platform used to enrol, configure and secure macOS, iOS and iPadOS devices. The SAFE integration with Jamf Pro ingests managed device inventory (device name, serial number, model, OS, IP and MAC addresses, owner, Jamf agent version), the applications installed on each device, and the result of a set of security checks (FileVault, Gatekeeper, firewall, passcode and others) for each device. SAFE admins can configure this integration from the "Jamf Pro" card available on the SAFE Platform Integrations page.
What SAFE pulls from Jamf Pro
| Assets Fetched | Jamf Pro managed computers (macOS) and mobile devices (iOS and iPadOS). |
| Types of Data Fetched | Device name, serial number, UDID, device type, model, manufacturer, OS name, version and build, IP address, public IP, MAC address, CPU, memory, architecture, owner, site, Jamf agent version, managed / supervised status, first seen, last contact and last inventory dates, installed applications (name, version, install path), and optionally Jamf extension attributes. |
| Findings Fetched | Configuration findings from 10 baseline security checks (7 macOS, 3 iOS / iPadOS). Each failed check becomes a finding on the device. Jamf Pro provides no vulnerability (CVE) data. |
| Asset Matching Criteria | macAddress, assetName |
| Sync Mode | Full sync on every run. No delta / incremental sync. |
Prerequisites and Permissions
A Jamf Pro instance (Jamf Cloud, for example
https://company.jamfcloud.com, or a self-hosted Jamf Pro server reachable from the internet over HTTPS).A Jamf Pro administrator account, to create an API role and an API client.
A Jamf Pro API role with the following privileges:
Read Computers: required for Mac devices, their software and security status.
Read Mobile Devices: required for iPhone and iPad devices, their apps and security status.SAFE Admin access.
Outbound HTTPS connectivity from SAFE to your Jamf Pro URL.
Generate connection details
To integrate SAFE with Jamf Pro, you need 3 details:
Jamf Pro Server URL
Client ID
Client Secret
To generate these details, an API role and an API client are created in Jamf Pro. SAFE authenticates using the OAuth2 client_credentials grant, so no user login is involved, and the API client only has read access.
Create an API role
Log in to Jamf Pro as an administrator.
Go to Settings > System > API Roles and Clients.
Open the API Roles tab and click + New.
Enter a Display Name of your choice (for example,
SAFE Read-Only).Under Privileges, add: Read Computer, and Read Mobile Devices
Click Save.
Create an API client
In API Roles and Clients, open the API Clients tab and click + New.
Enter a Display Name of your choice (for example,
SAFE CTEM Integration).Under API Roles, select the role created in section 3.1.
Access Token Lifetime: optional. The Jamf default is 60 seconds; SAFE works with it, but a longer lifetime (for example, 1800 seconds) reduces the number of token requests during a sync.
Select Enable API Client.
Click Save.
Generate the Client Secret
Open the API client and click Generate Client Secret, then confirm.
Copy the Client ID and the Client Secret. Store the secret securely; Jamf Pro will not display it again.
Note your Jamf Pro Server URL, for example
https://company.jamfcloud.com.
If the client secret is regenerated or the API client is disabled in Jamf Pro, update the SAFE integration as well, otherwise syncs will start failing with authentication errors.
Configure the Jamf Pro integration in SAFE
After completing the prerequisites, follow these steps to configure the Jamf Pro connector in the SAFE Platform.
Log in to SAFE as an admin and navigate to Integrations.
Click the + icon on the top right corner of the page and search for Jamf Pro.
Click the Jamf Pro Card to configure it.
Enter the integration name.
Enter the connection details (Jamf Pro Server URL, Client ID and Client Secret).
Enter the Asset last seen days filter. Devices that have not contacted Jamf Pro within this many days are skipped. Must be a positive integer.
Enter the Auto Sync (in Days).
[Optional] If needed, enbale the Ingest Installed Software option. When enabled, the applications installed on each device are included in the sync.
[Optional] If needed, enbale the Ingest Extension Attributes option. When enabled, Jamf Pro extension attributes are added to each device as tags.
Click Test Connection once you have entered the credentials.
Once verified, click Save.
Once the integration is saved, click Sync Now to trigger an on-demand sync.
| Check | Device type | Passes when | Criticality |
|---|---|---|---|
| FileVault disk encryption should be enabled | macOS | FileVault reports all or boot volume encrypted | High |
| Gatekeeper should be enabled | macOS | Gatekeeper allows App Store, or App Store and identified developers | Medium |
| System Integrity Protection should be enabled | macOS | SIP is enabled | High |
| macOS firewall should be enabled | macOS | The firewall is enabled | Medium |
| Secure Boot should be set to Full Security | macOS | Secure Boot level is Full Security | Medium |
| Automatic login should be disabled | macOS | Automatic login is disabled | Medium |
| Remote Desktop should be disabled | macOS | Remote Desktop is disabled | Low |
| A compliant passcode should be set | iOS / iPadOS | A passcode is set and compliant | High |
| Data protection should be enabled | iOS / iPadOS | Data protection is enabled | High |
| Device should not be jailbroken | iOS / iPadOS | No jailbreak is detected | Critical |
The criticality of each check is defined by SAFE, based on common industry security practice. It is the base severity of the finding; the severity shown in SAFE can differ between devices because SAFE adjusts it for each asset's context.
API Details
The Jamf Pro connector uses the Jamf Pro API. Authentication is OAuth2 client_credentials; all data calls send the resulting token as Authorization: Bearer <access_token>.
| API | Method | Endpoint | Purpose |
|---|---|---|---|
| Authentication | POST |
/api/v1/oauth/token |
Exchange the client ID and secret for a Bearer token (grant_type=client_credentials). The token is refreshed automatically before it expires. |
| Connection Test | GET |
/api/v4/computers-inventory?page-size=1 |
Confirm the URL and credentials are valid and the API client can read computers. |
| Computers | GET |
/api/v4/computers-inventory |
Fetch Mac inventory with the GENERAL, HARDWARE, OPERATING_SYSTEM, USER_AND_LOCATION and SECURITY sections, plus APPLICATIONS and EXTENSION_ATTRIBUTES when enabled. Page size 100, page-number pagination, sorted by ID. |
| Mobile Devices | GET |
/api/v2/mobile-devices/detail |
Fetch iPhone and iPad inventory with the GENERAL, HARDWARE, USER_AND_LOCATION and SECURITY sections, plus APPLICATIONS and EXTENSION_ATTRIBUTES when enabled. Page size 100, page-number pagination. |
Installed applications, security status and extension attributes are returned inside each device record, so no per-device calls are made.
View Result
To view the assets, their software and their findings:
From the SAFE Integrations page, click on the Jamf Pro card.
A page with "Finding View" and "Asset View" tabs will open up.
Asset View will list all the devices pulled or updated from Jamf Pro, along with their OS, serial number, model and MAC address. Jamf Pro devices are listed with the asset type End-User Compute.
Open a device to see its installed applications on the Software tab, its Jamf tags (for example
Jamf-Device-Type,Jamf-Managed,Jamf-Supervised) and the integration on the Sources tab.Finding View will list the failed security checks from section 5.
API Details
The Jamf Pro connector uses the Jamf Pro API. Authentication is OAuth2 client_credentials; all data calls send the resulting token as Authorization: Bearer <access_token>.
| API | Method | Endpoint | Purpose |
|---|---|---|---|
| Authentication | POST |
/api/v1/oauth/token |
Exchange the client ID and secret for a Bearer token (grant_type=client_credentials). The token is refreshed automatically before it expires. |
| Connection Test | GET |
/api/v4/computers-inventory?page-size=1 |
Confirm the URL and credentials are valid and the API client can read computers. |
| Computers | GET |
/api/v4/computers-inventory |
Fetch Mac inventory with the GENERAL, HARDWARE, OPERATING_SYSTEM, USER_AND_LOCATION and SECURITY sections, plus APPLICATIONS and EXTENSION_ATTRIBUTES when enabled. Page size 100, page-number pagination, sorted by ID. |
| Mobile Devices | GET |
/api/v2/mobile-devices/detail |
Fetch iPhone and iPad inventory with the GENERAL, HARDWARE, USER_AND_LOCATION and SECURITY sections, plus APPLICATIONS and EXTENSION_ATTRIBUTES when enabled. Page size 100, page-number pagination. |
Installed applications, security status and extension attributes are returned inside each device record, so no per-device calls are made.
FAQs
Q: How frequently does SAFE sync data from Jamf Pro?
A: Sync frequency depends on the Auto Sync configuration. Default is every day. You can also trigger an on-demand sync at any time using Sync Now.
Q: Does the integration support incremental / delta sync?
A: No. Every run is a full sync of all devices. Use the Asset last seen days filter, or turn off Installed Software, to reduce the volume.
Q: Test Connection fails.
A: Check that the Jamf Pro Server URL starts with https:// and is your Jamf Pro address, that the API client is enabled, and that the client secret has not been regenerated since it was entered in SAFE. The API client's role must include Read Computers.
Q: Macs are synced but no iPhones or iPads appear.
A: Check that the API role includes Read Mobile Devices. Without it Jamf Pro refuses the mobile device request; SAFE still syncs the Macs and completes the sync.
Q: Fewer devices appear in SAFE than in Jamf Pro.
A: Devices that have not contacted Jamf Pro within the Asset last seen days filter (default 30 days) are skipped. Increase the value to include them.
Q: Devices synced but no software appeared.
A: Check that Installed Software is enabled on the integration.
Q: Where do I see Jamf extension attributes?
A: Enable Extension Attributes on the integration and sync again. Each attribute appears on the device as a tag, Jamf-<attribute name>: <value>.
Q: Why don't I see vulnerabilities from Jamf Pro?
A: Jamf Pro does not provide vulnerability (CVE) data. The integration contributes the installed software and OS version, which SAFE can use to identify vulnerabilities, and the security check findings in section 5.
Q: A device has no finding for a check.
A: Either the check passed, or Jamf Pro could not collect the value for that device (for example NOT_COLLECTED), in which case the check is skipped rather than failed.
Q: Why does the same check have different severities on different devices? A: The criticality in section 5 is the base severity. SAFE adjusts the final severity for each device based on its context, such as asset impact and compensating controls.
Q: Can historical data be re-ingested?
A: Yes. Since every sync is a full fetch, triggering a new sync re-ingests all devices that pass the last seen filter.