Repository navigation
Home
A native macOS (SwiftUI) app that connects to your MDM platform's API and generates polished, branded, exportable audit reports — for Jamf Pro, Microsoft Intune, and Iru — from a single guided workflow.
Rather than clicking through each MDM console to piece together a configuration snapshot, you pick a platform, authenticate, choose your sections, and the tool pulls everything over the API and renders it into a self-contained interactive HTML report — optionally with a PDF or DOCX alongside.
| Three MDM platforms | Jamf Pro (65 sections), Microsoft Intune via Graph (23 sections), Iru (15 sections) |
| Branded HTML reports | Interactive, filterable, collapsible, light/dark, printable — one self-contained file |
| Export formats | HTML, HTML + PDF, HTML + DOCX |
| Guidance document |
Coming soon. A companion .docx with Findings / Impact / Details / Recommendations per section |
| Security compliance | Fleet-wide FileVault, Gatekeeper, SIP, firewall and other security settings, plus XProtect definitions compared with Apple's latest releases, and login banner / password hint checks |
| Security audit | Jamf Compliance Benchmarks checked against the mSCP baselines the instance actually uses |
| App version check | Installed app versions across the fleet compared with the latest on Homebrew, optionally limited to Macs with recent inventory |
| Scheduled agents | Run reports unattended and deliver by email, webhook, or HTTP upload |
| Report diffing | Compare two saved HTML reports and see exactly what changed |
| Credential safety | Everything sensitive lives in the macOS Keychain, including agent webhook URLs and upload auth headers, with saved server profiles for Jamf Pro, Intune and Iru |
| Secrets kept out of reports | Passwords, shared secrets, SCEP challenges and certificate identities in profiles, and likely credentials in scripts, are shown as [REDACTED]
|
| Honest about gaps | If something couldn't be fetched, the report, the completion screen and any webhook say so. A partial result is never shown as an all-clear |
| Read-only and local | Never writes to your MDM; no vendor backend, no telemetry. See the Security FAQ |
| Permission preflight | Verifies all 19 required Jamf read privileges before a run starts |
-
Secret redaction in profile XML,
.mobileconfigdownloads and script bodies across all three platforms. See Report Sections. - Incomplete-data warnings at the top of the report, on the completion screen and in webhook summaries. See The HTML Report.
- Microsoft Teams Workflows webhooks (Power Automate) are supported, as well as the older connector URLs.
- Automated reports keep webhook URLs and upload auth headers in the Keychain, check email and upload settings before saving, and fail the run if delivery fails. See Automated Reports.
- Safer saved credentials: deleting a saved server or clicking Clear Saved asks first and names any automated reports that use it. Unticking Save to Keychain no longer deletes credentials that are already saved.
-
Save folders chosen in Preferences or for an agent keep working after the app restarts. With no save folder set, reports from all three platforms now go straight to the Desktop, named
JamfReport-<timestamp>,IntuneReport-<timestamp>orIruReport-<timestamp>. - Licensing: a 72-hour offline grace period, clearer status messages, and a confirmed Deactivate that no longer removes the licence silently when offline. See Licensing.
- Application Version Check handles auto-updating apps that Homebrew doesn't version, compares versions numerically, and warns when the fleet scan was incomplete.
- Quitting while a report or automated report is running now asks first. Closing the window leaves the app, and its scheduled agents, running.
- Throttled API requests (HTTP 429, 503, 504) are retried automatically.
| Page | What's on it |
|---|---|
| Getting Started | Requirements, installing the app, and a full walkthrough of the workflow |
| Connecting to Jamf Pro | Auth methods, saved servers, required privileges |
| Connecting to Microsoft Intune | Entra app registration, Graph scopes, saved tenants |
| Connecting to Iru | Tenant subdomain, API token, saved tenants |
| Report Sections | Everything each platform can report on |
| The HTML Report | What the generated report looks like and what it can do |
| Security Audit | The Jamf Compliance Benchmarks / mSCP audit pass |
| Application Version Check | Installed versions compared with Homebrew |
| Automated Reports | Scheduled agents and delivery options |
| Comparing Reports | Diffing two reports |
| Preferences | Appearance, branding, save paths |
| Troubleshooting | Diagnostics, debug mode, common failures |
| Licensing | The 72-hour free trial, what works without a licence, and activating a licence |
| Security FAQ | Answers for security teams approving the tool: TLS, storage, access, tokens |