Jamf Pro

Jamf Pro is an enterprise mobility management (EMM) tool that provides unified endpoint management for Apple devices.

Related Enforcement Actions

• Jamf Pro - Add or Remove Assets to/from Group
• Jamf Pro - Lock Device

Types of Assets Fetched

This adapter fetches the following types of assets:

• Devices
• Users
• Software
• Application Settings (To fetch this info you need to configure the User Name and Password fields. If 2FA is required for this application, the 2FA key must be provided.)
• SaaS Applications
• Accounts/Tenants

About Jamf Pro

Use cases the adapter solves

Jamf Pro is a powerful endpoint management solution that provides a robust inventory of our managed Apple devices in Axonius. Even more importantly, by combining Jamf Pro with network/infrastructure data coming from additional adapters, Axonius can identify unmanaged or even rogue devices on the network.

Data retrieved by Jamf Pro

Axonius collects common device information such as hostname, IPs, MAC address, and serial number. It also collects information unique to Jamf such as device policies, profiles, and groups. The adapter can be configured to collect additional information, such as user data and even mobile devices.

Enforcements

With the Jamf Pro adapter configured, Axonius can add devices to Jamf Pro computer groups directly in the Enforcement Center. Jamf Pro - Add Assets to Computer Group

Axonius SaaS Applications Adapter Configuration

If the adapter has already been setup and you want to configure it to fetch application settings from SaaS data, make sure to add the following connection parameters:

• Username
• Password
• 2FA Secret Key (if your organization configured 2FA for login authentication)

Also, ensure that the Jamf Pro user has read permissions to all items under Jamf Pro Server Settings and access to the Admin Portal (granted by default).

Parameters

1. Jamf Domain (required) - The hostname of the Jamf Pro server. This field format is 'https://[instance].jamfcloud.com'.
2. User Name and Password (Required to fetch SaaS Applications Settings) - The credentials for a user account that has the Required Permissions to fetch assets via the API.
3. Use Client Credentials (optional) - Toggle on to authenticate using client credentials.
   • Client ID and Client Secret (optional) - When the authentication method is via client credentials, specify the Client ID and Client Secret to be used to authenticate the request. For more information about obtaining a Client ID and Client Secret, see API Roles and Clients.

4. HTTP Proxy and HTTPS Proxy (optional) - A proxy to use when connecting to the value supplied in Jamf Domain.
5. Tenant Tag (optional) - Specify a tag name to tag all devices fetched from this adapter connection.
6. Bypass SSO (Only for accounts with Axonius SaaS Applications) (required, default: switched off) - Select it if the newly created user account is allowed to bypass SSO according to the Jamf instance settings.
7. 2FA Secret Key (Required to fetch SaaS Applications Settings) - If you access Jamf Pro through an SSO solution that requires 2-factor authentication, you will need to generate a secret key in that solution and paste it here. For example, see Set Up Google Authenticator for the Okta adapter.

To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.

Advanced Settings

1. Fetch Devices (Cybersecurity Assets Management only) - This adapter fetches devices by default. Clear this option to not fetch devices.
2. Fetch Users (default: true) (Cybersecurity Assets Management only) - Select this option to fetch users for both Classic and Pro API connections.
3. Fetch department of users - Select whether to fetch the names of buildings and departments of users for this adapter connection.
4. Fetch policies (required, default: true) - Select whether to fetch policies associated with devices for this adapter connection. This field is ignored when Use pro API is selected.
5. Fetch mobile devices (required, default: true) - Select whether to fetch mobile devices in addition to standard devices for this adapter connection.
6. Fetch Enrollment Devices - Select this option to fetch enrollment devices.
7. Use pro API - Select this option to use JAMF Pro API (selected by default). Clear this option to use the JAMF Classic API. On-prem Jamf servers require the Pro API.
8. Async chunks in parallel (required, default: 5) - The number of chunks to fetch in parallel when working with the Classic API.

9. Items to not fetch (optional) - Select one or more fields to exclude from the device fetch. This option only applies to devices fetched from the Pro API.
10. Enrich software with version info (Cybersecurity Asset Management only) - Select this option to enrich software with the following fields: 'Current version release date', 'Next version release date', 'Newer version count'.
11. List of Device IDs to filter - Enter a comma-separated list of device IDs for specific devices that you want to fetch.

APIs

Axonius supports the Jamf Classic API and Jamf Pro API.

Creating a User by Connecting to the Jamf Admin Panel

1. Log in to the Jamf Pro admin panel and navigate to the Settings panel. Click Jamf Pro User Accounts & Groups.
   

2. Click New to create a new user and select Create Standard Account > Next.
   

3. Fill in the details for this account. Make sure to select Custom from the Privilege Set dropdown, and select Full Access from the Access Level dropdown.
   

4. Navigate to the Privileges tab. Under Jamf Pro Server Objects, select the Read option for each object displayed.
   

5. Click Save.
   
   

Required Permissions

The value supplied in Username and Password must have the following access to devices.