Policy Audit

Policy Audit

See every policy scoped to a Mac, and how often a policy succeeds or fails across the Macs it's scoped to. Mostly read-only. ✏️ Remove from scope changes a policy.

Policy Audit has two tabs at the top: Policy Scope and Policy Failures.

Renamed: this tool used to be called Policy Scope. The old name Policy Scope still works in configuration profiles and Entra ID group mappings, but use Policy Audit in new profiles. Tool Lock and Favourites you'd set on Policy Scope carry over too.

---

Policy Scope

Pick a Mac and see every policy scoped to it, and how.

How to use it

1. Connect to Jamf Pro and click Connect & Check Permissions. The tool checks Read Computers, Read Policies and Update Policies. Update Policies is only needed for Remove from scope, so a read-only account can click Proceed Anyway →.
2. Under Search for a device, type a device name or serial number. Matching Macs are listed as you type. Pick a Mac, or click Search (if only one Mac matches, it's scanned straight away).
3. The tool reads the Mac's computer group memberships, then checks the scope of every policy.

Results

The Mac's groups are listed at the top. Each matching policy shows its name, category, trigger, execution frequency and whether it's enabled, plus how it reaches the Mac:

Scope	Meaning
All Computers	The policy is scoped to all computers
Direct	The Mac is in the policy's scope by name
Group	The Mac is in a computer group the policy is scoped to. Via: lists the groups

Filter the list with All Computers, Direct or Group. If nothing matches, you see No scoped policies found.

Exclusions are taken into account:

• If the Mac is excluded by name, the policy isn't listed.
• If the Mac is in an exclusion group, the policy is still listed, with Excluded via: and the group names in red, so you can see why it doesn't run.

Limitations (users, user groups, network segments, iBeacons) and building and department targets aren't checked. Disabled policies are listed too, marked as disabled.

Removing a Mac from a policy's scope

Policies that reach the Mac directly have a Remove from scope button. It asks first: Remove from ""? Click Remove from Scope to take the Mac out of that policy's scope straight away. The policy's other targets, exclusions and limitations aren't changed.

Afterwards, a banner shows Removed from: with the policy name, and the list is refreshed. To put the Mac back, add it to the policy in Jamf Pro.

This needs Update Policies.

Export

Export HTML saves PolicyScope_<server>.html with the device, its groups and the matching policies.

New Search looks up another Mac, and Reset goes back to the start.

---

Policy Failures

Pick a policy and see whether it completed, failed or hasn't run on the Macs it's scoped to.

How to use it

1. Connect to Jamf Pro and click Connect →. The tool checks Read Computers and Read Policies.
2. Under Select Policy, find the policy with Search policies… and click it.
3. Choose a Device Sample Size: 25, 50 (default), 100 or 200 Macs. Larger samples take longer, because each Mac's history is read separately.
4. Click Analyse Policy →.

Results

Counts at the top show Completed, Failed, Pending and Not Run, with the Pass Rate %. Each Mac shows its most recent run of the policy: status, time and user. Failed Macs are listed first.

Which Macs are sampled:

• For a policy scoped to All Computers, the first Macs in inventory, up to the sample size.
• Otherwise, Macs scoped to the policy directly, up to the sample size. Macs that get the policy only through a group aren't sampled.

If none of the sampled Macs has run history, you see No data found.

Permissions: Read Computers, Read Policies. Update Policies only if you use Remove from scope.