Account Audit

Account Audit

Review who can administer a Jamf Pro server: admin accounts and account groups, API roles and API clients, with broad-access clients flagged. Read-only.

How to use it

1. Connect to Jamf Pro and click Connect & Check Permissions. The tool checks Read for Jamf Pro Accounts, API Integrations and API Roles.
2. Click Continue → (or Proceed Anyway →). The scan reads every account, account group (local and LDAP), API role and API client.

Results

Counts at the top:

Count	Meaning
Accounts	Every Jamf Pro admin login account and account group
Enabled Admins	Enabled accounts with Full Access and the Administrator privilege set
Disabled	Accounts that are disabled
Broad-Access	API clients flagged as having broad access (see below)

Switch between two tables:

• Accounts: ID, name, real name, email, account type (Standard User, Directory User, Standard Group or Directory Group), access level, privilege level and status. Enabled administrators are marked Admin, and groups with full administrator access are marked Admin Group, since a directory group can make everyone in it an administrator. Disabled accounts are greyed out.
  • Accounts with a Custom privilege set that includes any of the critical privileges below are marked Critical. Hover over it to see which.
  • If an account's or group's details couldn't be read, its access level and status show Unknown rather than disabled, with the reason when you hover over it.
• API Roles & Clients: each API client with its status, assigned roles and total privilege count. Clients with broad access are marked Broad. If a client's privileges couldn't be read, its count shows Unknown.

Seeing exactly which privileges are granted

• Accounts: when an account's privilege level is Custom, it shows as a link with an ⓘ. Click it to see every privilege the account has, grouped the way Jamf Pro groups them (Jamf Pro Server Objects, Settings and Actions, plus Casper Admin, Casper Remote, Casper Imaging and Recon where used). Jamf's fixed sets (Administrator, Auditor, Enrollment Only) are shown as plain text.
• API clients: click the privilege count to see the full list of privileges the client gets from all its roles.

Administrator warning

If there's only one enabled full-access administrator user account, or none, a warning appears above the tables. With a single admin, losing access to that account could lock everyone out of Jamf Pro. The warning also mentions any accounts whose status is unknown, and any admin groups, which may give other people administrator access.

Incomplete results

If any accounts, groups, roles or clients couldn't be read, a banner says the results are incomplete and lists what's missing.

What counts as broad access

An API client (or role) is flagged Broad when it has more than 60 privileges, or any privilege that controls who can administer Jamf Pro:

• Create, Update or Delete Accounts
• Create, Update or Delete API Roles
• Create, Update or Delete API Integrations

A client's privileges are all the privileges from all its assigned roles combined.

Export

Export HTML saves AccountAudit_<server>.html with the counts (including Custom Accounts w/ Critical Privileges and Unknown, when there are any), an accounts table you can filter to Admins, Disabled, Critical or Unknown, and an API clients table you can filter to Broad Access. The report has the same columns as the app. Custom privilege levels and API client privilege counts expand to show the full privilege list. Scan Again returns to the start.

Tips

• Accounts that come from a directory service (LDAP) show as Directory User, and LDAP groups as Directory Group.
• To switch off accounts you no longer need, use Disable.

Permissions: Read Accounts (for accounts and account groups), Read API Integrations, Read API Roles.