Repository navigation
Automated Reports
Agents generate and deliver reports on a schedule.
Agents run while the app is open. This is an in-app scheduler, not a launch daemon. It starts when the app launches and checks for due agents every minute. Closing the window (⌘W) leaves the app and its scheduler running. Click the Dock icon to bring the window back. If the app isn't running, scheduled runs don't happen.
Agents need a licence once the 72-hour free trial has ended. After that, without an active licence, a due agent fails with "A valid licence is required to run automated reports." If an agent is due right after the app launches, it waits for the licence to be checked online first instead of failing. See Licensing.
| Field | Notes |
|---|---|
| Name | Also used for the default output folder name |
| MDM | Jamf Pro, Microsoft Intune, or Iru |
| Output | HTML Only, HTML + PDF, or HTML + DOCX |
| Debug Mode | Saves raw API responses in a debug-<timestamp> folder in the app's Application Support folder, not next to the report. See Troubleshooting
|
By default the agent uses the credentials saved in the app's Keychain for that platform. For Jamf Pro you can instead pick a saved server profile from the Server list, which shows each profile's display name. Turn on Use agent-specific credentials to give the agent its own credential set, stored separately in the Keychain.
This matters: an unattended run shouldn't depend on whatever happens to be typed into the app at the time.
Test Connection verifies the agent's own credentials before you save it:
| MDM | What's tested |
|---|---|
| Jamf Pro | Signs in and checks the 19 required privileges. If they can't be read, it says it couldn't verify them |
| Microsoft Intune | Gets a token, then reads a device configuration, to prove the Graph permissions work |
| Iru | Connects, then reads a device, to prove the token can read data |
If the saved server an agent uses is deleted, the agent shows Missing saved server with a warning, and it can't be saved or run until you choose another server. It never falls back to the app's own credentials, because that could send another customer's data to this agent's recipients. Deleting a saved server, or clicking Clear Saved on a sign-in screen, warns you first and names the agents that will be affected.
| Frequency | Behaviour |
|---|---|
| Every Hour | Interval-based |
| Every 6 Hours | Interval-based |
| Every 12 Hours | Interval-based |
| Daily | At a specific time of day |
| Weekly | At a specific time on a specific weekday |
A new interval agent first runs one interval after it's created, not the moment you save it. Editing an agent doesn't reset its schedule or trigger an extra run.
The same section picker as an interactive run, with every available section selected by default. Sections marked Coming Soon aren't offered. See Report Sections.
Agents produce the main report only. The Jamf-only extras (Security Audit, Application Version Check) aren't available in scheduled runs.
Click Choose… to pick a folder. The agent keeps access to it after the app restarts. Reset goes back to the default, ~/Desktop/AgentReports/<Agent_Name>/.
Agents created in an earlier version may show "Choose this folder again so the agent keeps access to it after the app restarts." Choose the same folder again to fix it. Until you do, the agent fails if it can't write to the folder.
Each agent can deliver its output through any combination of:
| Channel | Detail |
|---|---|
| Slack | Webhook summary on completion |
| Microsoft Teams | Webhook summary on completion. Both Teams Workflows (Power Automate) URLs and older connector URLs work. See Notifications |
| SMTP with host, port (default 587), username, password, from address and comma-separated recipients. The report is attached unless you turn off Attach report file | |
| HTTP upload |
PUT to any HTTPS destination that accepts a file — a presigned S3 URL, WebDAV, or an internal endpoint — with an optional auth header (e.g. Bearer <token>) |
Webhook URLs, SMTP passwords and upload auth headers are all stored in the Keychain, never in the agent's saved settings. Agents saved by earlier versions have their webhook URLs and auth headers moved into the Keychain automatically.
The webhook fields hide what you type. The upload auth header isn't shown again once saved. Leave it blank to keep it, or click Clear to remove it.
The agent can't be saved until its delivery settings make sense. A message under each one says what's wrong:
- Webhook and upload URLs must be valid
https://URLs. - Email needs an SMTP host, a port between 1 and 65535, a valid from address and at least one valid recipient.
Email is always sent over TLS (STARTTLS). There's no option to send without it, and if the server can't do TLS, the email isn't sent. The SMTP password is passed to curl in a temporary file only the current user can read (0600), never on the command line, and the file is deleted straight after sending. The connection times out after 15 seconds, and sending after 2 minutes. See the Security FAQ.
The report is always saved first. If an email, upload or webhook then fails, the agent's last run is marked as failed with "Report saved, but delivery failed: …" and the reason, such as the HTTP status the upload server returned. Hover over the red warning icon in the agents list to read it.
If the report ran but some data couldn't be fetched, the run succeeds with "Completed with warnings: …".
- Delete asks you to confirm. It removes the agent's schedule, delivery settings and saved credentials, and stops it if it's running.
- Quitting the app while an agent is running asks you to confirm first.
- If saved agents can't be read (for example, after a downgrade), the Agents window shows a warning. The original data is backed up to
AgentBackupsin the app's Application Support folder and is never overwritten.
The agent's own save folder if one is set, otherwise ~/Desktop/AgentReports/<Agent_Name>/. Filenames are timestamped, so a daily agent naturally builds a history you can diff — see Comparing Reports.