Skip to content

Security FAQ

Jump to bottom
MDM Magic edited this page Oct 22, 2026 · 5 revisions

Security FAQ

Answers to the questions security teams usually ask when approving MDM Reporting Tool for use. Everything here is based on how the app is built today; if something changes in a future release, this page will be updated.

Contents

Does the app use TLS, and which version?

Yes. All connections to Jamf Pro, Microsoft Graph / Entra ID and Iru use Apple's standard networking stack (URLSession) with App Transport Security (ATS) enabled and no exceptions configured.

  • Only HTTPS is allowed; plain HTTP is blocked. A Jamf Pro URL entered with http:// is changed to https:// before anything is sent.
  • TLS 1.2 is the minimum, and TLS 1.3 is used wherever the server supports it (Jamf Cloud, Microsoft Graph and Iru all do).
  • Certificates are validated against the macOS system trust store. There is no certificate pinning and no option to bypass validation — an invalid certificate stops the connection.

Email for scheduled reports is sent over SMTP with TLS always required (STARTTLS). If the mail server can't negotiate TLS, the email isn't sent; there is no setting to send it unencrypted. The SMTP password is never passed on a command line — it's written to a temporary file readable only by the current user (permissions 0600) and deleted straight after sending.

How is data encrypted at rest?

What How it's protected
Credentials — Jamf username/password or API client secret, Intune client secret, Iru API token Saved only if the user ticks Save to Keychain (off by default). Stored in the macOS login Keychain, encrypted, readable only by this app, and never synced to iCloud or other devices. They're protected by the login keychain's lock.
Scheduled report secrets — webhook URLs, SMTP passwords, upload auth headers, agent-specific credentials Always stored in the Keychain, never in the app's preferences. Older plain-text copies are moved into the Keychain automatically on first launch of 1.0.2.
Report files — HTML, PDF, DOCX Written as normal files and not encrypted by the app. They rely on FileVault full-disk encryption. Secrets found in profiles and scripts are redacted before they're written. See Report Sections.
Data pulled from the MDM APIs Held in memory only while the report is being built.

Where is the data stored?

Only on the Mac running the app.

  • Reports go to the folder the user chooses, or by default the Desktop (falling back to a JamfReport folder in Documents). This applies to Jamf Pro, Intune and Iru reports.
  • App settings and the list of saved Jamf servers (URL, display name and username / client ID — no secrets) are kept in the app's preferences.
  • Activity log — logs.json in the app's Application Support folder, capped at 2,000 entries. It records server URLs, API endpoint names and short error messages. It never records passwords, secrets or tokens: each message is length-capped, and anything that looks like a bearer token, password or client secret is replaced with [REDACTED] before it's stored.

Are any cloud services involved that store data?

No MDM or device data is sent to, or stored by, the vendor or any third-party cloud.

The app does make a few outbound connections:

Licence check

  • Contacts a licence server hosted on Cloudflare Workers: mdmreportingtoollicenses.mdmmagic.workers.dev. If your network uses a firewall or proxy allow-list, allow outbound HTTPS to it.
  • Sends the licence key and a random ID (a UUID) the app creates on first launch and keeps in the Keychain, used to tie the licence to one machine. No serial number or other hardware ID is sent.
  • The server stores the key, that ID and the activation date.
  • To detect copied licences, the server also keeps a list of the network addresses each key is used from. Addresses are stored only as salted, truncated SHA-256 hashes, at most 30 per key, and dropped after 30 days. A key used from many addresses in a week is flagged for review, never blocked automatically.
  • Requests are rate-limited.
  • Versions released before September 2026 sent the Mac's serial number instead. The first time an updated version runs, it replaces the serial with a random ID on the licence server, so the serial is no longer stored.

Public reference lookups — download public data only:

  • Apple's software update catalog, for current XProtect versions.
  • NIST's macOS Security Compliance Project baselines on GitHub.
  • The Homebrew API, for the latest app versions. The names of the apps being version-checked are included in the request URL; no device or user data is sent.

Optional destinations — off unless configured by the user:

  • Teams or Slack webhook — a summary only: report title, instance URL, platform version, counts of sections and API calls, and for Jamf Pro, counts of policies, profiles and unused items. Must be an https:// URL.
  • Email (always over TLS) or HTTP upload (HTTPS only, e.g. an S3 presigned URL or WebDAV) for scheduled reports — these send the full report to the configured destination.

What level of access does the app need?

The app is read-only. Every request it sends to an MDM reads data, apart from the requests that obtain, refresh or invalidate its own session token. It cannot change anything in Jamf Pro, Intune or Iru.

Jamf Pro — 19 read-only privileges. The app checks these at sign-in and warns if any are missing. An API Client with a dedicated read-only API Role is recommended over username/password.

Full list of Jamf Pro privileges
  • Read Jamf Pro User Accounts
  • Read Computers
  • Read Mobile Devices
  • Read Policies
  • Read Scripts
  • Read Packages
  • Read Configuration Profiles
  • Read macOS Configuration Profiles
  • Read Mobile Device Configuration Profiles
  • Read Categories
  • Read Departments
  • Read Buildings
  • Read Sites
  • Read Computer Extension Attributes
  • Read Mobile Device Extension Attributes
  • Read API Roles
  • Read API Integrations
  • Read SMTP Server
  • Read SSO Settings

Microsoft Intune — an Entra app registration with these application permissions (all read-only, admin consent required):

  • DeviceManagementConfiguration.Read.All
  • DeviceManagementManagedDevices.Read.All
  • DeviceManagementApps.Read.All
  • Group.Read.All — used to show group names in assignment columns
  • Directory.Read.All — optional. If granted, group names are looked up in a single request for just the groups the report references, instead of reading the whole group list

Iru — an API token. Because the app only reads, the token can be scoped to read-only.

On the Mac

  • Runs as a standard user; no admin rights needed.
  • Built with the App Sandbox and Hardened Runtime.
  • Entitlements: outgoing network connections only (no incoming), read/write access to files and folders the user picks, and app-scoped bookmarks so a chosen save folder can still be written after a restart.
  • No access to the camera, microphone, location, contacts, calendars, USB or Bluetooth.

What happens to the data once a report is finished?

With debug mode off (the default):

  • API responses are held in memory only while the report runs and are discarded when the run ends. None are written to disk.
  • The only thing kept is the finished report (HTML, plus PDF/DOCX if chosen) in the output folder. If a run is cancelled, any files it had already written are deleted.
  • Passwords, shared secrets, SCEP challenges and certificate identities in configuration profiles, and likely credentials in scripts, are replaced with [REDACTED] before they reach the report. Script detection is heuristic, so review scripts before sharing a report outside your organisation.
  • Reports stay there until someone deletes them. They contain configuration details, so handle them under your organisation's data-handling policy.

Are API tokens destroyed after use?

Jamf Pro — yes. Whenever the app signs in to Jamf, it calls Jamf's invalidate-token endpoint when the task ends — whether it succeeded or failed — and clears the token from memory. This covers:

  • report runs
  • the permission check at sign-in
  • the connection test for scheduled reports
  • app-version checks
  • compliance-baseline detection

During long runs the token is refreshed shortly before it expires. It is never written to disk or to any log.

Intune — the Entra access token is kept in memory only and expires on its own (normally about 60–90 minutes). Entra doesn't provide a way for a client to revoke these tokens.

Iru — uses a long-lived API token created in the Iru console. It's only stored if Save to Keychain is ticked, and can be revoked or rotated in Iru at any time.

Client secrets and passwords are never logged. If they weren't saved to the Keychain, they're gone when the app quits.

What does debug mode change?

There are two separate debug options, both off by default:

Option Where What it writes
Debug mode Per report / per scheduled report Raw API responses, saved in a debug-<timestamp> folder in the app's Application Support folder (MDM Reporting Tool/DebugLogs/), never next to the report
Write a debug log file Preferences › Diagnostics A text log of each run (MDMTool_debug.txt) in the app's Application Support folder

Neither option saves credentials or tokens, including the responses to sign-in requests. Raw API responses can include device and configuration details, so treat a debug folder like the report itself and delete it when you're finished troubleshooting. Debug folders are readable only by the current user, and the app deletes any older than 14 days.

What else should a security team know?

  • Local-only processing. There is no vendor backend holding customer data.
  • No telemetry. No analytics or tracking. The app's Apple privacy manifest declares no tracking. The only data type it declares is a device ID: the random licence ID described above, used for app functionality.
  • Self-contained reports. Generated reports don't load any external scripts, fonts or images, and carry a Content Security Policy that blocks external scripts and styles.

Recommended controls

  • Use a dedicated, read-only Jamf API client / Entra app registration / Iru token for the tool.
  • Rotate its secrets on a regular schedule.
  • Require FileVault on any Mac that runs the tool.
  • Save reports to an approved, access-controlled location.
  • For scheduled reports, allow only approved webhook, email and upload destinations.

MDM Reporting Tool — internal edition · mdmmagic.au · Log issues & feature requests

MDM Reporting Tool

Home

Setup

Reporting

Automation

App

Security

Clone this wiki locally