Repository navigation
Connecting to Jamf Pro
Accepts either a bare instance name (your-instance) or a full URL (https://your-instance.jamfcloud.com). A URL entered with http:// is changed to https://, so credentials and tokens are never sent unencrypted.
You can paste a URL copied from the browser. Trailing slashes, index.html, query strings and Jamf page or API paths (such as /computers.html, /view/…, /api/… or /JSSResource/…) are removed. A port and an on-premises context path are kept:
| You enter | Used as |
|---|---|
acme |
https://acme.jamfcloud.com |
https://acme.jamfcloud.com/computers.html?id=12 |
https://acme.jamfcloud.com |
jamf.example.com:8443 |
https://jamf.example.com:8443 |
https://jamf.example.com:8443/jamf/api/v1/… |
https://jamf.example.com:8443/jamf |
| Method | Credentials | Notes |
|---|---|---|
| Username & Password | Jamf Pro user account | Uses the Classic/Pro token exchange. Privileges are read from the matching account. |
| API Client | Client ID + client secret | OAuth client credentials. Privileges are read from the API role attached to the client. Needs a licence once the free trial has ended. Recommended: a dedicated client with a read-only API role. |
If you pick a saved API Client profile without a licence, the screen says that API Client authentication needs a licence and won't continue. Activate a licence or switch to Username & Password.
Tick Save to Keychain (needs a licence once the free trial has ended) to store the credentials in the macOS Keychain so they're filled in next time. Leaving it unticked doesn't delete credentials you saved before. Clear Saved removes them after you confirm, and warns you if any automated reports rely on them.
The Jamf session token is invalidated as soon as each task finishes and is never written to disk. During long runs it's refreshed before it expires. If Jamf throttles a request (HTTP 429) or is briefly unavailable (503, 504), the request is retried up to three times, waiting as long as the server's Retry-After header asks, up to 30 seconds. See the Security FAQ.
Check & Continue authenticates first — a wrong URL, expired secret, or disabled account fails here, not halfway through a report.
If you report on more than one instance, save each as a server profile and reconnect without retyping anything. Profiles are saved in the app's preferences, with their secrets in the Keychain.
Saved profiles can also be attached to a scheduled agent, so an unattended run never depends on whatever happens to be typed into the app — see Automated Reports.
- Adding a profile needs a server URL, a username or client ID, and the password or client secret.
- Editing a profile: leave the password or secret blank to keep the saved one. If you switch between Username & Password and API Client, you have to enter the new secret.
- Deleting a profile asks you to confirm. If any automated reports use it, they're named, because they'll fail until you choose another server for them.
After authenticating, the tool preflights the account (or API role) against the read privileges the report needs and shows exactly what's granted and what's missing.
The 19 checked privileges:
| Read Jamf Pro User Accounts | Read Computers |
| Read Mobile Devices | Read Policies |
| Read Scripts | Read Packages |
| Read Configuration Profiles | Read macOS Configuration Profiles |
| Read Mobile Device Configuration Profiles | Read Categories |
| Read Departments | Read Buildings |
| Read Sites | Read Computer Extension Attributes |
| Read Mobile Device Extension Attributes | Read API Roles |
| Read API Integrations | Read SMTP Server |
| Read SSO Settings |
Everything the tool needs is read-only — it never writes to your Jamf instance.
Some sections also read objects outside these 19, for example Read Mac Applications, Read Restricted Software, Read Dock Items and Read Network Segments for the Unused sections in Report Sections. The preflight doesn't check these. If one is missing, the section that needs it shows no data.
A missing privilege doesn't stop the run. You can Go Back and fix the role, or Proceed Anyway, in which case sections that need the missing privileges show no data.
If the app can't read the account's privileges at all (a network error, or an account that can't read user accounts or API roles), the sheet says Couldn't Verify Permissions and shows the unconfirmed privileges with a ? instead of a red ✗. You can still continue, but sections the account can't read may be missing data.
- Report Sections — what Jamf Pro can report on
- Security Audit: the Jamf-only Compliance Benchmarks audit
- Application Version Check: the Jamf-only installed-version check