Repository navigation
Report Sections
Every section is opt-in, and all are selected by default (except sections marked Coming Soon, which can't be selected yet). Sections are grouped by area, with Select All / Select None across the lot and a Clear per group. The Customise Report panel overrides the report title and footer for this run only, and can add a customer logo to the report's top banner.
Once the 72-hour free trial has ended, only the Jamf Pro Settings sections are available without a licence. See Licensing.
Reports get emailed, attached to tickets and shared with customers, so anything that would grant access is removed before it's rendered. Redacted values show as [REDACTED].
| Where | What's redacted |
|---|---|
Configuration profile XML and .mobileconfig downloads (Jamf macOS and mobile profiles, Intune custom profiles, Iru custom profiles) |
Passwords, shared secrets, pre-shared keys, SCEP challenges, tokens, API and licence keys, PINs, and the contents of PKCS#12 and PEM certificate identity payloads. The downloaded profile is still a valid plist, but its secrets are placeholders, so don't deploy it. |
| Script bodies (Jamf scripts and extension attributes, Intune shell scripts and custom attributes, Iru custom scripts and custom app install scripts) | Likely hard-coded credentials: Authorization headers and bearer tokens, curl -u user:pass, assignments like API_TOKEN="…" or password=…, password flags, security, dscl and networksetup passwords, and <key>Password</key> values in embedded plists |
| Jamf SSO Failover | The failover URL's query string, which carries the failover key |
| Iru Blueprints | Enrollment codes, which let anyone enroll a device into the blueprint |
| Iru Custom Apps | Signed download URLs. The package links to the item in the Iru console instead |
Script redaction is heuristic, so review scripts before sharing a report. Variables, command substitutions and paths are left alone, because they can't be a literal secret.
Listings are paged, and there's a safety limit on how many pages the app reads for each one: 500 for Jamf Pro, 100 for Intune and Iru. If a listing is longer, or a fetch fails, the report never presents what it has as complete:
- An Incomplete data banner at the top of the report names each listing that couldn't be read in full.
- Sections built from a failed or partial fetch show a warning, or Couldn't verify for analysis results. An empty table under one of these warnings doesn't mean nothing was found.
- The completion screen and any webhook summary say the report is incomplete.
| Jamf Pro Version | Basic Jamf Pro Info | Cloud Instance Type |
| Inventory Information | Device Communication Settings | Computer Management Check-In |
| Reenrollment Settings | Onboarding Status | Log Flushing Settings |
| Accounts | API Integrations | API Roles |
| SSO Settings | SSO Failover Settings | SMTP Server Settings |
| LAPS Settings | APNs Certificate (coming soon) | Volume Purchasing Locations |
| Categories | Departments | Buildings |
| Sites | Distribution Points | Network Segments |
| Policies | Configuration Profiles | Scripts |
| Packages | Mac Applications | Computer Extension Attributes |
| Smart Computer Groups | Static Computer Groups | Computer Advanced Searches |
| Computer Prestages |
| Mobile Configuration Profiles | Mobile Device Apps | Mobile Device Extension Attributes |
| Smart Mobile Device Groups | Static Mobile Device Groups | Mobile Advanced Searches |
| Mobile Device Prestages |
Security Compliance checks every managed Mac's security settings in inventory and shows how many pass, fail or aren't reported for each:
| FileVault Enabled | Gatekeeper Enforced | System Integrity Protection |
| Firewall Enabled | Activation Lock Enabled | Recovery Lock Enabled |
| Remote Desktop Disabled | Auto Login Disabled | Bootstrap Token Allowed |
| Secure Boot (Full Security) | External Boot Disallowed |
It also includes XProtect Definitions, which compares each Mac's XProtect version with the three most recent versions in Apple's software update catalog. Apple releases XProtect updates gradually, so any of the three latest counts as up to date. If Apple's catalog can't be reached, the rest of the section still renders.
Two more checks look at deployed macOS configuration profiles instead of device inventory, because Jamf doesn't report these settings per Mac:
| Check | Result |
|---|---|
| Login Banner |
Configured if a deployed profile sets a login window banner (LoginwindowText), with the profile names. Otherwise Not Configured. Most compliance frameworks (CIS, STIG) require one. |
| Password Hint |
Disabled if a deployed profile sets RetriesUntilHint to 0, Enabled if one sets it above 0, otherwise Not Configured. |
Both read the com.apple.loginwindow settings, whether they're set with Jamf's Login Window payload or an Application & Custom Settings payload for that domain. A profile counts as deployed if it has a scope or if a Computer PreStage installs it.
If some inventory pages or profiles can't be fetched, the section says so, so you know the totals are incomplete. A partial inventory scan is never shown as Up to Date for XProtect.
This section is separate from the optional Security Audit, which reports on Jamf's Compliance Benchmarks.
Derived sections that cross-reference objects against each other rather than listing inventory.
| Section | Shows |
|---|---|
| Policy Relationships | What each policy actually touches: scripts, packages, and groups |
| Policies with Event Triggers | Policies driven by login, network state change, startup or enrollment complete triggers, in one place |
| Jamf Connect & Protect Deployment | Jamf Connect and Jamf Protect deployment posture, matched from configuration profile names |
Clean-up findings: objects that nothing references, that have no scope, or that can't match anything. This is where most of the clean-up value is. Every row links straight to the object in Jamf Pro.
In the section picker and in the report, these are split into Settings, Computers and Mobile Devices. Each part is only available when at least one section from the matching main group (⚙️ Settings, 🖥️ Computers or 📱 Mobile Devices) is selected. Otherwise its rows show Needs group selected and can't be ticked.
The report shows a warning at the top of this group: an item that isn't linked to anything in Jamf Pro might still be used by a third-party integration. Check before you delete anything.
| Section | Finds |
|---|---|
| Organizational Data Not Linked | Buildings, departments, categories and network segments that nothing references (see below) |
| Section | Finds |
|---|---|
| Scripts Not Linked | Scripts not referenced by any policy |
| Packages Not Linked | Packages not referenced by any policy or prestage, listed with their size so you can see what reclaiming them is worth |
| Computer Groups Not Linked | Groups not used in any policy or configuration profile scope or exclusion, and not used as a criterion by another smart group |
| Computer Extension Attributes Not Linked | Computer EAs whose names appear in no smart group or advanced search criteria |
| Policies Not Linked | Policies that are disabled or have no scope, so they can never run as configured |
| Configuration Profiles Not Linked | macOS profiles with no scope that no Computer PreStage installs, so they deploy to nothing |
| Empty Static Computer Groups Not Linked | Static computer groups with no members. Anything scoped only to one of these reaches no devices, even though the group counts as "in use" |
| Smart Computer Groups with No Criteria | Computer smart groups with no criteria configured |
| Mac Advanced Searches with No Criteria | Computer advanced searches with no criteria configured |
| Mac Applications Not Linked | App Store apps assigned through Jamf (Mac Apps) with no scope |
| Mac Dock Items Not Linked | Dock items not referenced by any policy's Dock Items payload |
| Mac Restricted Software Not Linked | Restricted software entries that apply to nothing |
| Section | Finds |
|---|---|
| Mobile Apps Not Linked | Mobile device apps with no scope |
| Mobile Configuration Profiles Not Linked | Mobile configuration profiles with no scope |
| Mobile Device Groups Not Linked | Smart and static mobile device groups not used in any mobile app or mobile configuration profile scope or exclusion, and not used as a criterion by another smart group |
| Mobile Device Extension Attributes Not Linked | Mobile device EAs whose names appear in no smart group or advanced search criteria |
| Empty Static Mobile Device Groups Not Linked | Static mobile device groups with no members |
| Smart Mobile Device Groups with No Criteria | Mobile device smart groups with no criteria configured |
| Mobile Advanced Searches with No Criteria | Mobile device advanced searches with no criteria configured |
What counts as scoped. A policy, profile or app targeted only by building, department, or LDAP user or user group still deploys, so it isn't flagged. Only objects with no targets at all are flagged. A macOS configuration profile that a Computer PreStage installs (its Installed Profiles list) is treated as linked even with no scope of its own.
Organizational Data Not Linked treats an item as linked when:
- Buildings / departments: a Mac is assigned to it, a network segment overrides to it, or any policy, profile, app or restricted software targets or excludes it. Mobile device assignments aren't checked, because Jamf Pro has no bulk API for them. A building or department used only by mobile devices can therefore show up here, so check it before you delete it.
- Categories: a policy, configuration profile, Mac app, mobile app, mobile profile, script or package uses it. Categories used only by printers or patch titles aren't checked, so they can show up here too.
- Network segments: the segment overrides to a real building or department, or it's used as a scope limitation or exclusion.
Empty static groups. A group's member count is read from the Jamf Pro API, falling back to the Classic API. If neither reports it, the group is treated as unknown, not empty, and the section is marked as incomplete.
Incomplete data. If any of the lists these sections are built from can't be fetched (a network error or a missing privilege, for example), the affected results are marked Couldn't verify and the report names what's missing. An empty table then doesn't mean nothing is unused, and items listed may actually be in use, so don't delete anything based on it. If an individual policy, profile or app can't be read, it's shown as an error row, never as a row with a blank scope.
These aren't section checkboxes. They're chosen on their own screens after the sections step and appear in the report as extra sections:
| Add-on | See |
|---|---|
| Application Version Check | Application Version Check |
| Security Audit | Security Audit |
Guidance Document (separate .docx) |
Coming soon. See The HTML Report |
| Tenant Status | Roles | Apple VPP Tokens |
| Apple MDM Push Certificate (coming soon) | Enrollment Program Tokens | Enrollment Types |
| Assignment Filters | Device Clean-up Rules |
| macOS Configuration Profiles | macOS Compliance Policies | macOS Scripts |
| macOS Custom Attributes | macOS Apps | macOS Updates (deprecated) |
| iOS Configuration Profiles | iOS Compliance Policies |
| iOS Apps | iOS Update Policies (deprecated) |
| App Categories | App Protection Policies | eBooks |
| Section | Shows |
|---|---|
| Unassigned Resources | macOS and iOS configuration profiles (including Settings Catalog), compliance policies, apps and shell scripts that reach no device or user: no assignments, or only exclusions. Each row links to the item in the Intune admin centre |
| Expiring Credentials | The Apple MDM push certificate, VPP tokens and enrolment program (ADE) tokens that expire within 60 days or have already expired, in one table, soonest first |
If one of the lists can't be fetched, both sections show a warning naming what's missing, so an empty table isn't mistaken for a clean result. Microsoft Graph only returns the Apple MDM push certificate to a signed-in user, not to an app registration, so Expiring Credentials will usually list it as missing. Check its expiry in the Intune admin centre under Devices → Enrollment → Apple → MDM Push Certificate.
Unassigned Resources leaves out items that are unassigned by design: VPP and Apple Business Manager store apps (they appear automatically when licences are bought) and the managed-app entries Intune creates for App Protection. Windows and Android objects are left out too. If Graph returns an item without its assignment data, it's listed separately as unchecked rather than called unassigned.
Other Intune changes worth knowing:
- Enrollment Types has a Restrictions column. Click a row to see its per-platform restrictions (platform and personal devices allowed or blocked) and any device limit per user. Built-in defaults show Default as their created date.
- Enrollment Program Tokens now show a real status (valid, expiring within 30 days, expired or error), worked out from the token's expiry date and last sync error.
- macOS and iOS Compliance Policies have a Scheduled Actions column: the number of non-compliance actions (block, notify, retire and so on), with the action types in a tooltip. If Graph won't return them, the column shows a dash, not 0.
- App Protection Policies also lists Windows Information Protection policies, labelled in the Type column, but doesn't include them in the count.
- Tenant Status reports an error, rather than an empty tenant, if nothing could be fetched.
- Dates across Intune sections are shown as
dd/MM/yyyy @ HH:mmin the Mac's local time zone, the same as the Jamf Pro and Iru reports.
APNs Certificate (Jamf Pro) and Apple MDM Push Certificate (Intune) are marked Coming Soon. They're shown greyed out with an ⏳ and can't be ticked, and Select All and the group toggles skip them. Microsoft Graph doesn't return the Intune push certificate to an app registration (application permissions), so that section can't be filled in through the API yet.
Sections marked (deprecated) reflect Microsoft's own deprecation of those Graph endpoints — they're kept so existing tenants still get the data while they have it.
| Integrations | Automated Device Enrollment Tokens | Directory Users |
| Self Service Categories | Tags |
| Blueprints | Library Items | Custom Apps |
| Custom Profiles | Custom Scripts | Auto Apps (App Store) |
| In-House Apps |
- Devices
| Threat Detections | Vulnerabilities |
Threat Detections includes threats that haven't been quarantined, since they're the ones that still need action. They're listed first, then quarantined, then released, newest first within each.
Vulnerabilities needs the Vulnerability Management add-on in your Iru plan. Without it, the section says so instead of showing an error.
Other Iru changes worth knowing:
- Sections for features your tenant doesn't have (threats, vulnerabilities, tags, in-house apps, integrations, ADE and others) show a neutral not available note, not an error. See Connecting to Iru.
- Blueprints mask the enrollment code.
- Devices shows Lost Mode from its own status, separately from whether the device is reported missing.
- Missing values show as a dash, never
<null>or a false ✗. - Dates are shown as
dd/MM/yyyy @ HH:mmin the Mac's local time zone.