Jamf API Permissions

Jamf API Permissions

Magic Toolbox works with either a Jamf Pro API client (recommended) or a Jamf Pro user account. Give the account only the privileges for the tools you use.

At the start of each session, the app shows which privileges are Allowed and which are Denied. Usually you can click Proceed Anyway → if something is missing, but any action that needs it will fail. There are two exceptions:

• If the app can't read the account's own privileges (see below), you have to fix that first. You go back to the Connect step with a message that names the missing privilege.
• Profile uploads stop if Create macOS Configuration Profiles is missing, or if the app can't read the account's privileges.

Privilege names below match the ones in Jamf Pro → Settings → System → API Roles and Clients. Jamf sometimes renames privileges between versions. If a name doesn't match exactly, pick the nearest one.

Privileges every account needs

To show you the permission check, and before every profile upload, Magic Toolbox reads the account's own privileges. That needs:

Account type	Extra privilege needed
API client	Read API Integrations and Read API Roles
Username & password	Read Accounts

For an API client, the app finds the API client whose Client ID matches yours, then collects the privileges from every API role assigned to it. For a username and password, it finds the account with that username and reads its privileges.

If these privileges are missing, the app tells you which privilege to add and where to find it in Jamf Pro.

Username & password accounts: the check reads the privileges assigned to the account. If the account is set to Group Access, it also combines the privileges of every local Jamf Pro account group the account belongs to. Privileges that come from an LDAP group can't be read through the API, so the check stops with a message explaining that. Profile uploads can't skip this check, so they're refused. An API client avoids this.

The Compare tool is an exception. It tests access by making a read request to each endpoint it uses, so it doesn't need the extra privileges above. In Instances mode it only tests the first server. An unexpected error from a test request is shown as Denied, not Allowed.

---

By tool

Read-only tools

Tool	Privileges
Compare: Computers mode	Read Computers, Read Policies, Read macOS Configuration Profiles, Read Smart Computer Groups, Read Static Computer Groups
Compare: Mobile Devices mode	Read Mobile Devices, Read Mobile Device Applications, Read iOS Configuration Profiles, Read Smart Mobile Device Groups, Read Static Mobile Device Groups
Compare: Instances mode	Read Policies, Read macOS Configuration Profiles, Read Smart Computer Groups, Read Static Computer Groups, Read Scripts, Read Computer Extension Attributes, Read Packages (on each server)
Profile Conflicts	Read macOS Configuration Profiles, Read iOS Configuration Profiles
Smart Group Audit	Read Smart Computer Groups, Read Smart Mobile Device Groups
Account Audit	Read Accounts (accounts and account groups), Read API Integrations, Read API Roles
Cert & Token Expiry	Read access to Jamf Pro notifications (used for the push certificate warning), PKI (certificate authority), Automated Device Enrollment and Volume Purchasing Locations (or Volume Purchasing accounts in the Classic API, used if the Jamf Pro API list fails). There's no permission screen: anything it can't read shows as Unknown (the External CA row shows Could not fetch)
Downloader	Read Scripts, Read Computer Extension Attributes, Read Mobile Device Extension Attributes, Read macOS Configuration Profiles, Read iOS Configuration Profiles, Read Packages. To download package files from Jamf Cloud: Read Jamf Cloud Distribution Service Files
Icons: scan	Read Policies. Optional: read access to Self Service branding and Enrollment Customizations to include branding images

Tools that change Jamf Pro

Tool	Privileges
Clone: source server	Read for every object type you clone. The check lists all 18 types, so you can ignore Denied rows for types you don't clone
Clone: destination server(s)	Read, Create, Update for every object type you clone, plus Create for Categories, Scripts and Extension Attributes (created automatically as dependencies), Read Packages (to check for missing packages) and icon upload access (to copy Self Service icons)
Wipe	Read, Delete for every object type you plan to wipe. The check lists every type. The Computer Groups and Mobile Device Groups rows check the Smart group privileges only, so add the matching Static group privileges too if you wipe static groups. The App Installers row checks the Mac Applications privileges. Jamf Pro Accounts needs Read/Delete Accounts, and Jamf Users needs Read/Delete User (Jamf Pro names this privilege in the singular)
Disable	Read, Update for every type you disable: Policies, Accounts, macOS Configuration Profiles, iOS Configuration Profiles, Restricted Software, Mac Applications, Mobile Device Applications. For App Installers, any one of Read Mac Apps, Read Mac Applications or Read App Installers counts, and the same for Update. Undo needs the same Update privileges
Restore	Read, Create for every object type in the backup. In Update existing objects mode, Read, Update instead. The permission screen checks the ones for the mode you chose
Unused	Read for each category you scan: Packages, Scripts, Policies, macOS Configuration Profiles, Smart Computer Groups, Advanced Computer Searches, Advanced Mobile Device Searches, Mac Applications, Mobile Device Applications, Dock Items, Restricted Software, Buildings, Departments, Categories, Network Segments. Plus Read for everything those categories are checked against, for example policies, patch policies, patch software titles, PreStages, printers, smart groups and advanced searches. The permission screen lists all of these for the categories you switched on. If one can't be read, the affected categories are marked incomplete and can't be deleted from. Delete for the category itself, only if you delete items from the results

Profile builders (upload only)

PPPC Analyser, System Extensions, Web Content Filter, Notifications and Login Item Profiles only talk to Jamf Pro when you click Upload. They need:

• Create macOS Configuration Profiles
• Read macOS Configuration Profiles and Update macOS Configuration Profiles (used when a profile with the same name already exists and gets updated)
• the privileges to read the account's own permissions (see above). The upload checks for Create macOS Configuration Profiles first, and stops if it can't read the account's privileges.
• for Notifications and Login Item Profiles only: Read Categories, Read Smart Computer Groups and Read Static Computer Groups, for the Scan Instance step that lets you pick a category and scope.

Icons: uploads

The Extract from .app feature in Icons needs permission to upload icons. Attach to a Policy… also needs Read Policies and Update Policies.

No Jamf access needed

Inspector, Network Check, Profile Signer and Profile Unsigner don't connect to Jamf Pro. Neither does the analysis part of every profile builder.

---

Object types used by Clone, Wipe and Restore

Object type	Clone	Wipe	Restore
Categories	✅	✅	✅
Buildings	✅	✅	✅
Departments	✅	✅	✅
Sites	✅
Network Segments	✅
Scripts	✅	✅	✅
Computer Extension Attributes	✅	✅	✅
Mobile Device Extension Attributes	✅	✅	✅
Smart / Static Computer Groups	✅	✅	✅
Smart / Static Mobile Device Groups	✅	✅	✅
Policies	✅	✅	✅
macOS Configuration Profiles	✅	✅	✅
iOS (Mobile Device) Configuration Profiles	✅	✅	✅
Mac Applications (Mac App Store apps)	✅	✅	✅
Mobile Device Applications	✅	✅	✅
Restricted Software	✅	✅	✅
Advanced Computer Searches		✅	✅
Advanced Mobile Device Searches		✅	✅
Packages (records only)		✅	✅
Computer PreStage Enrollments		✅	✅
Mobile Device PreStage Enrollments		✅	✅
API Integrations		✅	✅
API Roles		✅	✅
App Installers		✅	❌ (can't be backed up)

Suggested roles

Role	Use for	Privileges
Magic Toolbox – Audit	Compare, Profile Conflicts, Smart Group Audit, Downloader, Icons, Unused (scan only)	All the Read privileges above, plus Read API Integrations and Read API Roles
Magic Toolbox – Profiles	Uploads from the profile builders	Read, Create and Update macOS Configuration Profiles, plus Read API Integrations and Read API Roles
Magic Toolbox – Admin	Clone destinations, Restore, Disable	Audit role, plus Create and Update for the object types you copy or disable
Magic Toolbox – DEV Wipe	Wipe, on DEV/TEST servers only	Read and Delete for the types you wipe. Never give this role to a client on a production server.