Required privileges

It is recommended to give the service account or API client only the permissions it needs to do its work. The account or client will need Create, Read, and Update privileges on some or all of the following, or even more than these, depending which processors you use:

• Jamf Pro Server Objects:
  • Categories
  • Cloud Distribution Point (only needs "Read")
  • Computer Extension Attributes
  • Smart Computer Groups
  • Static Computer Groups
  • File Share Distribution Points (if using a File Share Distribution Point - only needs "Read")
  • Jamf Content Distribution Server Files (if using JCDS)
  • Packages
  • Policies
  • Scripts
  • macOS Configuration Profiles
  • iOS Configuration Profiles
  • Mac Applications
  • Patch Policies
  • Patch Software Titles (required by JamfPatchUploader)

If you use either of the JamfPackageCleaner or JamfUnusedPackageCleaner processors, you will need to add Delete permissions to Packages.

If you use the JamfPolicyDeleter processor, you will need to add Delete permissions to Policies.

If you use the JamfPolicyLogFlusher processor, you will need to add Delete permissions to Policies and enable Flush Policy Logs in the Jamf Pro Server Actions.

If you use the JamfAccountUploader processor, it is recommended that you run this manually with a different account to normal AutoPkg runs, so that you are not giving your regular AutoPkg service account the privileges to create additional accounts. To do this, use the following arguments to override the normal credentials: --key API_USERNAME=someusername --key API_PASSWORD=somepassword