Jamf Extension Attributes

Jamf Extension Attributes

Third Party Patcher ships a set of ready-to-use Jamf Pro Extension Attribute (EA) scripts that surface patch status in device inventory, smart groups, and dashboards. They live in the repo under MDM Examples/Jamf Extension Attributes/.

Each script shells out to patcherreport (mostly its get subcommand) and echoes a single <result> value. They use only tools present on a stock macOS install — no jq, python3, or other add-ons.

---

Available EAs

Script	Display name	Data type	Reports
tpp-last-scan.sh	TPP - Last Scan	Date	Last full Installomator scan (UTC)
tpp-last-apply.sh	TPP - Last Apply	Date	Last apply / install pass (UTC)
tpp-apps-requiring-update.sh	TPP - Apps Requiring Update	Integer	Managed apps found out of date
tpp-pending-updates.sh	TPP - Pending Updates	Integer	Updates staged and awaiting apply
tpp-oldest-pending-days.sh	TPP - Oldest Pending Update (Days)	Integer	Age of the oldest staged update
tpp-days-until-hard-deadline.sh	TPP - Days Until Hard Deadline	Integer	Days before deferrals are cut off
tpp-broken-labels.sh	TPP - Broken Labels	Integer	Scan-broken + stage-broken labels
tpp-deferrals-30-days.sh	TPP - Deferrals (Last 30 Days)	Integer	Dialog deferrals in the last 30 days
tpp-deadlines-forced.sh	TPP - Deadlines Forced (Lifetime)	Integer	Times a hard deadline forced an install
tpp-patching-mode.sh	TPP - Patching Mode	String	monthly or deadline
tpp-pending-update-labels.sh	TPP - Pending Update Labels	String	Comma-separated staged label list
tpp-patch-compliance-status.sh	TPP - Patch Compliance Status	String	Rollup verdict

Compliance status values

TPP - Patch Compliance Status returns one of, in priority order:

Value	Meaning
Not Installed	patcherreport is not present on the device
Overdue	A hard deadline has been reached
Deadline Approaching	Updates pending, hard deadline within 3 days
Pending	Updates staged, deadline not yet close
Updates Detected	Updates found but nothing staged yet
Compliant	Nothing outstanding

---

Adding an EA to Jamf Pro

1. Settings ▸ Computer Management ▸ Extension Attributes ▸ New
2. Display Name — use the name from the table (the TPP - prefix keeps them grouped).
3. Data Type — match the table (Integer / String / Date).
4. Input Type — Script, then paste the script contents.
5. Save. Values populate on each device's next inventory submission (jamf recon).

---

Example smart groups

Smart group	Criteria
Patching overdue	TPP - Patch Compliance Status is Overdue
Deadline approaching	TPP - Days Until Hard Deadline less than 3
Chronic deferrers	TPP - Deferrals (Last 30 Days) greater than 10
Stale scan	TPP - Last Scan before (today − 7 days)
Broken labels present	TPP - Broken Labels greater than 0
Never patched	TPP - Last Apply is (blank)

---

Notes

• Binary path. Scripts call /usr/local/bin/tpp/patcherreport. For the dev build (/usr/local/bin/tpp_dev/), edit the patcherreport= line.
• Dates are UTC. Jamf stores EA dates as YYYY-MM-DD hh:mm:ss in UTC; the date scripts convert patcherreport's ISO-8601 output accordingly.
• Freshness. Values are only as current as the last inventory submission.
• Roll your own. patcherreport get <dotted.key> [--from <report>] prints any scalar from the JSON payloads — see Reporting ▸ get.