Uploading Profiles

Uploading Generated Profiles

The five profile builders (PPPC Analyser, System Extensions, Web Content Filter, Notifications and Login Item Profiles) can each send their profile straight to Jamf Pro. The upload works the same way in all of them.

PPPC Analyser, System Extensions and Web Content Filter check the profile before it can be saved or uploaded, and list anything that needs fixing first. Saving a .mobileconfig follows the same rules as uploading, so a profile a device would reject is never produced.

How it works

1. Click Upload to Jamf… (or Upload to Jamf Pro…).
2. Pick a saved server or enter credentials, then click Upload Profile. Each builder can remember its own upload credentials with Save credentials to Keychain.
3. Magic Toolbox signs in and reads the account's privileges. If the account doesn't have Create macOS Configuration Profiles, the upload stops. It also stops if the app can't read the account's privileges (see Jamf API Permissions).
4. It creates a macOS Configuration Profile at Computer level, with the profile name and a short description from the tool.

Scope and category

Notifications and Login Item Profiles let you set the category and scope as part of the upload. Click Scan Instance under Scope & Category to read the server's categories and computer groups, then choose a Category and a Scope: All Computers, or one Computer Group. The upload button stays unavailable until the scan has run. The scan needs Read Categories and Read Computer Groups (Smart and Static).

The other builders (PPPC Analyser, System Extensions and Web Content Filter) create the profile with no scope, category or site. Open it in Jamf Pro, then set its category and scope before it's deployed anywhere.

No builder sets a site.

If a profile with the same name already exists

If Jamf Pro reports a conflict (409), Magic Toolbox looks for an existing macOS profile with the same name. If it finds one, it asks first: "A configuration profile named … already exists in Jamf Pro (ID N). Uploading will replace its payload." Click Overwrite to update that profile in place with the new payload ("Updated existing profile — Profile ID: N"), or Cancel to leave it alone.

Your answer applies to the profile you were shown. If a different profile has taken that name by the time the upload runs, you're asked again.

The update keeps the existing profile's payload UUIDs and identifiers, so Jamf Pro accepts it as the same profile. It sends the name, description, level and payload, plus the category and scope if you chose them in Notifications or Login Item Profiles (replacing the existing profile's). The other builders don't send a scope, category or site, so the existing profile's are kept.

If Jamf Pro refuses that update, a new profile with the same name is created instead, and the old one is left alone.

That means re-uploading is usually a quick way to update a profile you generated earlier. If you don't want to replace an existing profile, click Cancel and give the new one a different name, either in the tool or with a Profile Name Prefix.

Profile identifiers

Generated profiles get identifiers worked out from their name, rather than random ones. Saving or uploading a profile with the same name again produces the same identifiers, so devices treat it as an update to the profile they already have, not a second profile.

Some payload types can only exist in one profile per Jamf Pro server. If no profile has the same name, Magic Toolbox checks your macOS profiles for one that already has the same payload type. If it finds one, the message names that profile and its ID, and you'll need to update or delete it in Jamf Pro first. If it doesn't find one, the message explains that Jamf Pro also returns 409 when required fields are missing, for example a missing filter provider bundle ID in a web content filter.

Messages

Message	Meaning
Can't upload yet: …	Something in the tool needs fixing first, for example a missing code requirement in PPPC Analyser. The message says what
Uploaded successfully — Profile ID: N	A new profile was created
Updated existing profile — Profile ID: N	An existing profile with the same name was updated
Upload sent (could not parse returned ID)	Jamf Pro accepted the request, but the app couldn't read the new profile's ID. Check in Jamf Pro
Permission denied: …	The account lacks Create macOS Configuration Profiles
Permission check failed: … or Upload failed: Permission check blocked: …	The app couldn't read the account's privileges. The message names the privilege to add
Upload failed: HTTP 409: …	Jamf Pro rejected the profile. This usually means a required field is missing (see the tool's page) or a clash with an existing profile

Permissions: Create, Read and Update macOS Configuration Profiles (plus Read Categories and Read Computer Groups for the scope and category scan), plus the privileges that let the app read the account's own permissions (Read API Integrations and Read API Roles for an API client, Read Accounts for a username and password).