Smart Group Audit

Smart Group Audit

Health-check every computer and mobile device smart group on a Jamf Pro server. Read-only.

Smart groups pile up over time. Some are empty, some are overly complicated, and a few are simply wrong. This tool finds them.

How to use it

1. Connect to Jamf Pro, click Connect & Check Permissions, then Continue →.

2. Options: under Checks to Run, choose the checks (all on by default):

   • Empty groups (0 members)
   • Over-complex criteria
   • Duplicate criteria
   • Conflicting criteria (logical AND)
   • Nested membership loops (cycles)

   Under Thresholds, set Over-complex if criteria count exceeds (2–50, default 5).

3. Click Run Audit.

The checks

Check	Severity	Flags a group when…
Empty Group	🟠 Warning	Jamf Pro reports 0 members. It may be unused or misconfigured.
Over-Complex	🟠 Warning	It has more criteria than your threshold.
Duplicate Criteria	🟠 Warning	The same field + operator + value appears more than once, whether joined by AND or OR.
Conflicting Criteria	🔴 Error	The same field uses the is operator with two different values, joined by AND, so the whole group can never match. For example Model is A and Model is B. No device can ever be a member.
Conflicting Criteria	🟠 Warning	The same contradiction, but only inside one OR branch. That branch never matches, but the group can still match through its other branches
Nested Loop	🔴 Error	The group refers to itself through a Computer Group or Mobile Device Group membership criterion. This can be direct, a pair (A → B → A) or a longer chain (A → B → C → A).
Couldn't Verify	🟠 Warning	The group's details couldn't be read, so it wasn't audited

Criteria joined by OR (Model is A or Model is B) are valid and aren't flagged as conflicting. Parentheses are taken into account, and AND is treated as binding before OR. If a group's parentheses don't balance, the structure-based checks are skipped for it.

Fields that can hold several values on one device, such as installed applications, printers, local accounts, profiles and group memberships, aren't checked for conflicts: Application Title is A and Application Title is B is perfectly possible.

Nested loops are matched on group names, with computer and mobile device groups kept separate. Criteria such as Directory Service Group or Group ID aren't treated as membership references.

Results

• Counts for Errors, Warnings and Clean. These count groups: a group with both an error and a warning counts in both.
• If anything couldn't be read (a group's details, or the whole mobile device list), a banner says the audit is incomplete. A clean result then doesn't mean the server is clean.
• Filter by All, Errors, Warnings or Clean, or Search groups… by name.
• Each group shows its platform (Mac / Mobile), member count, the issues found, and its criteria laid out as IF / AND / OR, including parentheses.
• Groups with errors are listed first.
• Start Over returns to the Connect screen.

Exports

Both exports ask where to save, and always include every group (filters and search don't apply).

Button	File	Contents
Export CSV	SmartGroupAudit_<server>.csv	Columns Group, Platform, Members, Severity, Check, Detail. One row per issue. Clean groups get one Clean row, and each fetch failure gets a Couldn't Verify row. Values that a spreadsheet would treat as a formula are made safe
Export HTML	SmartGroupAudit_<server>.html	Summary counts (with Fetch Failures, and Clean (incomplete) when the audit was incomplete), then Errors and Warnings sections with the issues and a criteria table for each group, and a Clean table (name, platform, members, number of criteria)

The HTML report uses your organisation name and logo if you've set them in Preferences.

Tips

• Empty groups aren't always a problem. Some groups (such as "Macs with outdated macOS") are meant to be empty most of the time.
• Smart group lists are read page by page, so there's no limit on how many groups are audited.
• If the mobile device group list can't be read, the audit carries on with computer groups only and says so.

Permissions: Read Smart Computer Groups, Read Smart Mobile Device Groups.