Repository navigation
Troubleshooting
There are three levels of diagnostic detail, from least to most verbose.
Preferences → Diagnostics shows the activity log from report runs (API calls and section progress), with Copy All, Save to File, and Clear. The log is kept in logs.json in the app's Application Support folder, up to 2,000 entries. It never includes passwords, secrets or tokens.
An empty panel just means no report has been run yet, or the log has been cleared.
The Write a debug log file during report generation toggle (pref.enableDebugLog, off by default) writes a running step-by-step log to:
~/Library/Application Support/com.mdmmagic.MDMReportingTool/MDMTool_debug.txt
Useful when a run fails or hangs and you need to know which step it got to.
Save raw API responses to a debug folder, on the Options step of a run (or per-agent):
Every API response is written to a debug-<timestamp> folder in the app's Application Support folder (MDM Reporting Tool/DebugLogs/). It's kept away from the report folder so that zipping or sharing reports can't include raw inventory data by mistake. The completion screen has a Debug button that opens it. Sign-in responses, credentials and tokens are never saved. Debug folders older than 14 days are deleted automatically, so copy one somewhere else if you need to keep it. This is the first thing to enable when a section renders oddly — it tells you whether the API returned something unexpected or the tool parsed it wrong.
| Symptom | Likely cause |
|---|---|
| Auth fails at step 2 | Wrong URL/subdomain, expired secret, or a disabled account. The error names which. For Iru, an HTTP 401/403 means the token or the subdomain is wrong. |
| Jamf preflight says "Couldn't Verify Permissions" | The app couldn't read the account's privileges (a network error, or the account can't read user accounts or API roles). You can continue, but check the role — see Connecting to Jamf Pro. |
| "API Client authentication requires a license" | A saved API Client profile was chosen without a licence. Activate one, or use Username & Password. See Licensing. |
| A Jamf section is empty or partial | A missing read privilege. Re-run the preflight — see Connecting to Jamf Pro. |
| "Incomplete data" banner at the top of the report | A listing was longer than the page safety limit, or couldn't be read in full. The banner names each one. See Report Sections. |
| "Some data may be incomplete" on the completion screen | Something couldn't be fetched, a webhook failed, or licence-only options were skipped. The box lists what happened. |
| Intune assignments show bare GUIDs / "Group names couldn't be loaded" |
Group.Read.All hasn't been granted or consented — see Connecting to Microsoft Intune. |
| An Iru section says the feature isn't available | Your Iru plan or API token doesn't include that feature (Vulnerability Management, for example). This isn't an error. |
| Iru: HTTP 403 | The API token isn't allowed to read that data. Check its permissions in Iru Settings → Access → API Token. |
| Security audit finds no baselines | The Jamf instance has no Compliance Benchmarks configured, or uses a legacy mSCP scan method, which isn't supported — see Security Audit. |
| Security audit shows rule IDs instead of titles | GitHub was unreachable. The audit results are still valid. |
| XProtect shows "Could not determine the latest XProtect versions" | Apple's software update catalog was unreachable. The other Security Compliance checks are still valid. |
| App version check says "Not found on Homebrew" / Unknown | Homebrew doesn't have that app, or the name didn't match. Try the name as Homebrew lists it. See Application Version Check. |
| App version check shows "On Homebrew" / "Auto-updating" | Homebrew has the app but doesn't track its version, usually because the app updates itself. There's nothing to compare against. |
| App version check results disappeared | You changed the app names, the inventory age limit or the server, so the old results no longer apply. Click Check Versions again. |
| App version check matches the wrong app | The name matched more than one app. Click Check Versions and choose the right one when asked, or use a more specific name. |
| "Some data could not be fetched" warning above Unused sections | One or more Jamf lists failed to load (a network error or missing privilege). The warning names them. Results in the Unused group may be incomplete, so don't treat an empty table as clean. |
| "Couldn't fetch" warning in an Intune Analysis section | A Graph list failed to load, usually a missing permission. The results shown are incomplete. |
| Intune, Iru, PDF/DOCX, webhooks, Security Audit or Application Version Check are locked | These need a licence once the 72-hour trial has ended. See Licensing. |
| Teams notification failed | Check the webhook URL starts with https://. Both Teams Workflows (Power Automate) and older connector URLs work. See Notifications. |
| Scheduled agent didn't run | Agents only run while the app is open. Closing the window is fine; quitting isn't. See Automated Reports. |
| Agent failed: "A valid licence is required…" | Agents need an active licence. See Licensing. |
| Agent failed: "Report saved, but delivery failed…" | The report was generated, but an email, upload or webhook failed. The message gives the reason, such as the HTTP status from the upload server. |
| Agent failed: "The saved Jamf server this agent uses no longer exists" | The saved server was deleted. Edit the agent and choose another one. |
| Agent failed: "The agent's save folder can't be accessed" | The agent was set up in an earlier version. Edit it and choose the save folder again. |
| Agents window: "Saved agents could not be read" | The stored agents couldn't be read, for example after a downgrade. They've been backed up to AgentBackups in the app's Application Support folder. Re-create them, or contact support. |
| Report saved somewhere unexpected | The configured save path wasn't writable, so it fell back — see Where reports are saved. With no save folder set, reports now go straight to the Desktop rather than a JamfReport, IntuneReport or IruReport folder. |
| Licence window: "Working offline until …" | The licence server can't be reached. The licence keeps working until that time. Connect to the internet before then. See Licensing. |
| Licence: "Your Mac's clock appears to have been set back" | The licence must be confirmed online. Check the date and time, then connect to the internet. |
| Licence or trial: "Unlock your login keychain…" | The Keychain couldn't be read. Unlock the login keychain and reopen the app. |
| Deactivate fails with "Couldn't reach the licence server" | You need to be online to release the key. Try again online, or use Remove from This Mac Anyway. See Licensing. |
| "Couldn't Use Logo" | The file is larger than 20 MB, or isn't an image macOS can open. |
| App is licence-locked | See Licensing. |
Open an issue at MDM-Reporting-Tool/issues with the run's diagnostics log attached, and the debug-<timestamp> folder if the problem is a specific section. Redact instance URLs and any identifying data first — the raw API captures contain real inventory.