Repository navigation
Glossary
Canonical terms for jamf-reports-community and the wider Apple-fleet ecosystem it operates in. The Apple and Jamf vocabulary overlaps heavily between products and product generations; this file pins exact meanings so docs, code comments, and PR discussions stay consistent.
Entries are alphabetical within each section. Cross-references use
see also: <term>.
Apple's web consoles where organizations enroll devices, assign managed Apple IDs, and purchase apps for distribution. Pairs with MDM via the ADE token and VPP service tokens. ABM is for businesses; ASM is the equivalent for educational institutions (and what Jamf School integrates with).
Anti-theft mechanism tying a device to its Apple ID. On managed devices, MDM
can hold a bypass code so IT can recover from a lock state. Surfaces as a
field in the Security section of pro mobile-devices list.
Modern term for what was previously called DEP. Devices purchased through ABM/ASM auto-enroll into MDM on first setup, with the prestage profile controlling activation flow. see also: DEP.
Apple File System. Default macOS volume format since 10.13. Relevant because FileVault behavior, snapshots, and time-machine semantics differ from HFS+.
The transport Apple uses to wake managed devices for MDM commands. An MDM push is fire-and-forget; the device next polls the MDM server when it receives the notification. Pushes can silently fail without surfacing an error — one reason MDM commands are inherently asynchronous.
A per-device secret macOS escrows to MDM so the MDM server can authorize sensitive operations (FileVault, software updates on Apple silicon, MDM removal). "Bootstrap token missing" is a common compliance finding.
Apple's newer device-management protocol where the device autonomously applies declarations rather than reacting to push commands. Built around blueprints and declarations. Coexists with classic MDM commands on the same device. see also: Blueprint, MDM command vs declaration.
Legacy name for ADE. Apple retired the term but it still appears in older
docs, Jamf UI strings, and the dep-devices jamf-cli command. see also:
ADE.
macOS full-disk encryption. The compliance signal most fleets track first.
Statuses include Encrypted, Not Encrypted, and No Partitions Encrypted
(the canonical "off" value as of the JSS server enum, despite older docs
showing Not Encrypted).
macOS subsystem that verifies code signatures before allowing execution.
Enabled by default; reported by Jamf inventory as On / Off (despite
older docs showing Enabled / Disabled).
Apple's desktop operating system. The app requires macOS Sequoia 15 or later and runs on subsequent macOS releases.
The protocol Apple defines for remote device administration. Jamf Pro, Jamf School, and Jamf Protect are all MDM-adjacent products that speak this protocol. see also: DDM, MDM command vs declaration.
Two different Apple device-management primitives. MDM commands are
imperative, server-pushed, transient (InstallProfile, EraseDevice,
DeviceLock). Declarations are declarative, device-pulled, persistent
(activations, configurations, assets, management). DDM uses declarations;
classic MDM uses commands. Conflating the two leads to wrong API endpoints
and wrong field names.
Apple's enterprise SSO mechanism for macOS. An identity provider (Okta, Entra, Jamf Connect) issues tokens that satisfy Kerberos, password-sync, and login flows. Replaces older AD-bind for many use cases.
Apple's mechanism for shipping small security updates without a full
OS-version bump (e.g. 15.7.3 (a)). Surfaces as a separate inventory field
distinct from the major/minor OS version.
Apple silicon's boot integrity chain. Reported as Full / Medium / Off
in Jamf inventory; a fleet posture metric in mSCP baselines.
Kernel-enforced restrictions on what root can modify. Enabled by default; disabling it requires Recovery Mode access. mSCP and STIG baselines require SIP enabled.
A management state set during device enrollment that unlocks additional MDM capabilities (e.g. enforced auto-erase, supervised-only restrictions). Always true for ADE-enrolled devices; manual-enrolled devices may be unsupervised.
Apple's app-distribution mechanism for businesses and schools. Apps are purchased through ABM/ASM and assigned to devices or users. VPP service tokens have their own renewal cadence separate from MDM-push certificates.
Apple's built-in malware scanner. Definitions update silently in the background; "XProtect definitions current" is a common compliance signal.
The org.<your_org>_*.audit.plist files mSCP writes to
/Library/Managed Preferences/ containing per-rule pass/fail results.
JamfReports reads these via an Extension Attribute that greps for the
configured prefix. see also: mSCP, EA.
Center for Internet Security baselines. mSCP can generate CIS-aligned baselines for macOS. Less common in U.S. government deployments than NIST or STIG; more common in commercial enterprise.
JamfReports' bucketing of per-device failure counts into Pass / Low (1–10) / Med-Low (11–30) / Medium (31–50) / High (>50) / No Data tiers. Used in the Compliance Posture dashboard's donut chart. see also: Risk Score, Security Score.
Apple's open-source project for generating, deploying, and auditing security compliance baselines (NIST, STIG, CIS, custom). Outputs include config profiles, audit scripts that drop a results plist, and remediation scripts. JamfReports' compliance dashboards assume mSCP-style audit plists as the data source. Repo: github.com/usnistgov/macos_security.
National Institute of Standards and Technology Special Publication 800-53, a federal security-control framework. Revision 5 ("r5") is the current version. Tailored baselines (subset of controls applied to a tenant) are typical. mSCP can generate a baseline tied to a specific 800-53 control set.
DISA's hardening standard for DoD and federal systems. mSCP generates a DISA-compliant baseline for macOS. STIG audits typically produce a much larger compliance failure list than NIST baselines.
Identity/account management product. Synchronizes local macOS accounts with cloud IdPs and provides nFactor-style login experiences. Not used directly by JamfReports.
Jamf's primary MDM product, on-prem or SaaS. Provides classic MDM commands, the modern Platform API, policies, smart/static groups, patch management, Extension Attributes. JamfReports' primary data source.
Jamf's endpoint security product. Has its own GraphQL API (not REST), its
own OAuth2 credentials, and its own concepts (plans, insights, alerts,
analytics). The Protect dashboard in JamfReports reads cached snapshots
from protect overview / alerts / computers / insights.
Jamf's education-focused MDM (a separate product from Jamf Pro, not just a mode). Uses named-key envelope JSON shapes, API key auth (not OAuth2), and its own resource model. JamfReports' school reports cover devices, groups, users, classes, apps, profiles, and locations.
A DDM unit that bundles declarations (configurations, assets, activations) into a deployable package. Replaces config-profile-style imperative delivery for tenants on DDM. see also: Config Profile, DDM, Scope vs Target.
Jamf Pro's older XML-based REST API at /JSSResource/.... Authenticates
with HTTP Basic Auth (legacy) or a bearer token. Still required for some
endpoints not yet ported to the Pro API. see also: Pro API, Platform API.
A .mobileconfig payload describing settings to apply to a device.
Delivered via classic MDM InstallProfile commands. Distinct from
blueprint (DDM). see also: Blueprint.
A custom inventory field defined per-tenant. Can be populated by a script
run on the device during recon, by a value the admin sets, or by an LDAP
lookup. JamfReports' Custom EA dashboard sheets are driven entirely by
config.yaml mappings. see also: ea-results, recon.
The credential record behind a Platform API profile, created under Integrations in Jamf Account. It has one scope level, the environments or tenants it applies to, permissions picked per capability (for example Inventory > Devices: Read), and a client ID and secret. The secret is shown once, and an integration is valid for six months. Distinct from a Jamf Pro API client, whose access comes from an API role. see also: Platform API, Scope level.
A Jamf Pro automation that updates a software title across a scope on a schedule. Distinct from a patch title (the software) and a patch definition (the version metadata).
A software product Jamf knows how to patch (e.g. "Firefox", "Microsoft Edge"). Each title has versions; the latest version is what compliance percentages measure against.
Jamf's API gateway at https://{region}.api.jamfcloud.com (US, EU or APAC).
It authenticates with OAuth 2.0 client credentials from an integration created
in Jamf Account (auth-method = platform in jamf-cli profiles). It serves
Platform-only APIs and, when the integration's environment includes a Jamf Pro
tenant, that tenant's Pro and Classic APIs too — so one Platform API profile
can feed most reports without a direct Jamf Pro connection, given the right
permissions. Four JamfReports data sources are served only by this API —
compliance devices, compliance rules, DDM status and blueprint status — and
are skipped on a profile that authenticates any other way. see also:
Integration (Jamf Account), Platform environment, Scope level, Pro API,
Classic API, Refused by policy.
A group of tenants an organization has across Jamf products, defined in Jamf
Account. Compliance Benchmarks and blueprint status need an integration at
this level (DDM status also answers at tenant level), so it is the level to
create a JamfReports integration at. The ID travels in the
X-Environment-Id header; copy it by clicking the environment pill in the
integration's details panel in Jamf Account. see also: Scope level.
A Jamf Pro automated workflow that runs on devices (install a package, run a script, lock the screen, etc.) based on trigger + scope. Different from patch policy (a specialized policy for software updates).
Jamf Pro's REST/JSON API at /api/v2/... (and earlier /api/v1/...).
Authenticates with OAuth2 client credentials. The primary API JamfReports
uses through jamf-cli pro <subcommand>. see also: Classic API,
Platform API.
The jamf recon command devices run (manually or on a schedule) to push
their current inventory to Jamf Pro. EA scripts execute during recon. A
device that hasn't reconned in N days can be stale when inventory is in thresholds.stale_basis.
see also: stale device.
The level a Jamf Account integration is created at, which its credential is
locked to: organization (Jamf Account administration only, nothing
JamfReports reads), platform environment (recommended), or tenant (a
single tenant, the legacy level). An ID of the wrong kind fails every
request: an environment ID the gateway does not know answers 404
ENVIRONMENT_NOT_FOUND, and a tenant ID it will not accept answers 403
OWNERSHIP_FORBIDDEN. Unrelated to a policy's scope. see also: Platform
environment, Scope vs Target.
Two related but distinct Jamf concepts. Scope (Pro): who a policy or configuration profile applies to — a smart group, a static group, a site, or "all computers." Target (Platform / DDM): the device set a blueprint or declaration applies to. The fields have different schemas and different API endpoints; conflating them is a common bug. see also: Smart Group, Static Group, Site.
Jamf Pro's end-user macOS/iOS app where users opt into policies their admin has scoped to them. Self Service-scoped policies don't run automatically — they require user action.
Jamf Pro's tenant-subdivision mechanism. A multi-team Jamf deployment can partition policies, scope, and EAs by site so each team only sees its own resources. Distinct from building and department (organizational metadata fields on a device record).
Smart groups are dynamic — membership is computed from a criteria expression (e.g. "FileVault Status = Encrypted AND OS Version >= 15"). New devices that match the criteria join automatically. Static groups are manual lists of devices. JamfReports surfaces smart-group membership in several dashboards.
JSON output from a jamf-cli command saved to disk under
~/Jamf-Reports/<profile>/jamf-cli-data/<kind>/ so the GUI can render
without re-hitting the API. Most JamfReports dashboards read these
snapshots, not live data.
The pro report ea-results --all command output — a per-(device, EA)
table of values. Expensive to fetch: scales as O(devices × EAs), so
54,000 rows is common on mid-sized fleets. Collected on the Scan tier.
The Jamf-Concepts CLI for the Jamf Pro / Platform / Protect / School APIs. Open source at github.com/Jamf-Concepts/jamf-cli. The native engine that JamfReports composes for every API call.
A saved set of tenant credentials (URL, client ID, OAuth2 token) keyed by slug. Lives in jamf-cli's own keychain entry. JamfReports' "profile" maps 1:1 to a jamf-cli profile. see also: Profile slug.
jamf-cli's subcommand groups: pro (Jamf Pro), protect (Jamf Protect),
school (Jamf School), classic (legacy classic-API endpoints).
JamfReports' CoreDashboard consumes pro and protect;
SchoolDashboard consumes school (both are internal engine modules, not sidebar
screens).
jamf-cli exit code 8 (v1.28.0+): the command was invoked correctly but is
outside what the profile's API publishes — a Jamf Pro or Classic command on a
Platform gateway profile, or a Platform-only command on an instance profile.
The remedy is a different profile, never a retry, so JamfReports keeps the
source visible in the health strip but never re-collects it automatically.
jamf-cli commands -o json lists the refusals for the binary in hand.
The Overview's insight card, which turns the current daily-summary digest into a plain-language headline and severity-tagged findings using Apple's on-device Foundation Model. Opt-in, off by default, and hidden entirely below macOS 27. Trends, Audit, Security Posture and Compliance Posture have their own insight cards, alongside the Run History failure explainer and the report executive-summary narrative.
The one macOS SMAppService agent (2.8.0) the app ships inside its own signed bundle —
shown as "JamfReports" under Login Items → Allow in the Background. It wakes every
five minutes (JamfReports --tick) and runs whatever managed or hand-built schedule is
due, catching up a missed fire on the next wake. Replaces the legacy per-schedule
LaunchAgent (historical) mechanism. see also: LaunchAgent (historical), Dead-man
switch.
A short lease a run publishes to a shared workspace
(automation/.workspace-claim.json) naming the host, the operation and an
expiry, so another Mac can see one is already working. Advisory, not a lock
— sync is eventual, so two machines starting seconds apart can both proceed;
nothing is corrupted when they do. An expired claim is taken over, which is what
stops a Mac that slept mid-run wedging the folder. see also: Shared workspace,
Stand-down.
One of three per-report cadence tiers — Refresh, Inventory, and
Scan — modeled by CollectionTier. Each report is assigned a tier, and the tier
sets how often it is re-fetched: Refresh every 12 hours, Inventory every 2 days, Scan
every 7 days. These are fixed cloud cadences — the On-prem/Cloud/Custom preset picker was
removed in 2.3.0. see also: Refresh tier, Inventory tier, Scan tier.
config.yaml.bak-<date-time>: the copy the app makes beside config.yaml before
onboarding, jamf-reports scaffold --out or a Config screen save drops comments
or unreadable lines from it. The newest five are kept.
A Mac whose Last Contact (any contact, MDM included) is current while its Last Check-in, or its
Last Inventory Update, is more than thresholds.contact_gap_days (default 14) behind it: MDM
reaches the Mac and the Jamf binary does not, or does not for inventory. Measured from Last
Contact, not from today. see also: stale device.
A custom_eas: config entry that drives a dedicated sheet in generated
reports. Five EA types: boolean, percentage, version, text, date.
see also: EA.
A screen in the app sidebar. Screens are grouped into Reports, Posture, Operations, Fleet, Automation, Configuration, and System. Each non-core screen is toggleable in Settings → Sidebar Visibility; the core screens (Overview, Devices, Data Sources, Settings) cannot be hidden.
For a patch title, the number of days from its release date to the first day its
adoption was actually observed crossing 50% / 90% in the fleet's patch-status history.
Nil, never estimated, when the recorded series never crossed the threshold or started
above it already. see also: Patch velocity.
The automation-health check that treats a missing scheduled run as the signal, not just a failed one. A schedule that should have fired (past its expected time plus a 60-minute grace window) with no recorded run is flagged overdue; a schedule that ran but reported failure is flagged failing. Surfaces on the Overview banner and the Automation screen's Automation Health section.
A per-kind indicator (Patch Compliance, Security Posture, OS Updates, Devices) showing the age of the newest on-disk snapshot for a raw jamf-cli kind that screen reads. A kind the screen expects but has never collected shows a distinct red "never" chip rather than silently vanishing.
The Config screen's read-only tab listing the settings no other tab edits, the keys the app does not read, and the lines of config.yaml it skipped. see also: Config Doctor.
A Mac whose internal volume is encrypted by hardware: any Apple silicon Mac, or an Intel Mac with the T2 chip. With FileVault off it still encrypts, and unlocks without a password. The security policy can treat FileVault off on such a Mac as a warning or not count it. see also: Security policy, FileVault.
The banner above every screen reporting data sources that are failing (two or more consecutive collect failures) or stale (past three times their tier cadence), plus any overdue or failing schedule. Offers Collect now for the tiers behind, and re-evaluates after any manual refresh. The twin of the dead-man switch: that asks whether the schedule fired, this asks whether the data landed. see also: Dead-man switch, Freshness chip.
The mid-cost collection tier — device lists, configuration profiles, apps, and EA coverage. Pageable bulk queries; tens of seconds per run. see also: Collection tier.
Before 2.8.0, a macOS user-scoped scheduled job the app wrote, one per schedule, at the
legacy path ~/Library/LaunchAgents/com.github.tonyyo11.jamf-reports-community.*.plist.
2.8.0 replaced these with the single bundled Background item (ticker); a
legacy plist found on first launch of that version is imported once into a schedule
record, then archived when the operator retires it. Never installed system-wide
LaunchDaemons or requested sudo, and still doesn't. see also: Background item
(ticker).
An opt-in alerts: config rule that compares a daily-summary metric (e.g. patch_pct,
stale_count) against a threshold using below, above, or drops_more_than, and
posts a webhook card the first time it trips in a day. A malformed rule is dropped and
flagged in Config Doctor rather than breaking the config.
Support for charting more than one mSCP/STIG compliance.baselines entry
independently — one compliance-band series per baseline, never summed across
frameworks. The Trends screen shows a baseline picker only when more than one baseline
is configured. see also: mSCP, Compliance Band.
The notify.detail config setting (full | minimal) controlling how much a webhook
card reveals. full (default) includes metric names/values, error text, and schedule
names; minimal reduces every card to event facts — counts and statuses only — for
headless or high-security deployments.
Per-title patch-adoption speed, built from every dated patch-status snapshot on disk:
an adoption-over-time series, days-behind-latest, and the observed days-to-50/90-percent
crossings. see also: Days-to-50 / Days-to-90.
A workbook covering a window rather than a moment: a start figure, an end figure and the change for each selected metric, generated from the Generated screen. Windows are rolling (4/12/26/52 weeks) or calendar (last full month, last full quarter, custom dates). Every figure carries the date the snapshot actually came from, percentage changes are in percentage points, and extension attributes are opt-in. see also: summary.json, TrendStore.
A logical tenant within JamfReports. Each profile gets its own
~/Jamf-Reports/<slug>/ directory, its own jamf-cli profile, its own
config.yaml, and its own cached snapshots. Switching profiles in the
sidebar re-routes every screen.
The string identifier for a profile: its jamf-cli profile name, used exactly as jamf-cli
spells it. Any name jamf-cli accepts works except one that is empty, has a control
character, starts or ends with a space, or is very long. Folders, file names and schedule
labels use an encoded form, so no name can reach outside the workspace root (security
invariant). Examples: prod, Dev, Acme Prod.
The cheapest, most frequent collection tier — the overview, security,
and policy-status summary endpoints, seconds per run. A snapshot-only
scheduled run collects this tier only. see also: Collection tier.
The native Swift engine that generates XLSX, HTML, and PDF reports from cached jamf-cli JSON.
A per-device multi-factor weighted score producing a Critical / High / Medium / Low / Clean band. Factors configurable in Config → Scoring. see also: Security Score, Stability Index, Compliance Band.
A snapshot recovered from a truncated jamf-cli JSON file by keeping only its last complete top-level array element. A salvaged day is excluded from EA coverage-drift comparisons in Config Doctor so a partial day is never misread as a real coverage change.
The security_policy block of a workspace's config.yaml: for each of FileVault,
SIP, Firewall and Gatekeeper, whether being off is a failure, a warning or not
counted, plus the hardware-encrypted FileVault level, the Security Score
weights and the words your own data uses for on and off. Applies to every
screen, report and scheduled run of the workspace.
see also: Security Score, Hardware-encrypted Mac.
A fleet-level 0–100 weighted share of Macs passing each of a list of
factors: by default FileVault, SIP, Firewall, Gatekeeper, Secure Boot,
bootstrap token, macOS and XProtect currency, patch compliance and check-in,
plus mSCP and each security agent when configured. A factor with no data
drops out and the rest are rescaled. Configurable in Config → Scoring; the
list is saved in the workspace's security_policy.score_factors. see also: Risk Score, Stability
Index.
A workspace folder several Macs point at, so they build one pooled history
instead of a private copy each. Chosen per Mac in Settings → Workspace location;
what the machines must agree on lives in the workspace's own shared_workspace:
config. Coordination turns itself on when the folder is synced. Everyone with
folder access can read the raw device data it holds — that decision is the
operator's, not the app's. see also: Claim, Stand-down, Workspace.
The sibling manifest.json SHA-256 file written next to each collected snapshot when
jamf_cli.require_manifest: true, used to detect tampering between collect and
generate. Verification states are verified, mismatch, omitted, corrupt, and
absent.
A management-level health score derived from compliance, patch posture, and inverse stale-device pressure. Distinct from Risk and Security scores; it's a quick "is the fleet trending up or down" pulse. Appears in Trends.
A device with a date older than the configured stale threshold
(thresholds.stale_device_days in config.yaml, default 30). Which dates count is
thresholds.stale_basis: check_in (Last Check-in), inventory (Last Inventory Update) and
contact (Last Contact), default [check_in]. The device is stale when any listed date is more
than the threshold old, in whole days; a device at exactly the threshold is not stale. A date a
device has never had counts as older than any number of days, except Last Contact, which is
ignored when missing.
Outreach dashboard tiers further bucket by that stale age into Recent (0–30d) / Offline
(31–90d) / Inactive (91–180d) / Dormant (180d+). see also: contact gap, recon.
A scheduled collect declining to run because another Mac collected the same
shared workspace inside shared_workspace.min_collect_interval_hours. The run
log names which machine and when, and the run is recorded as partial — it does
not update Trends, send a success notification, or evaluate metric alerts,
because nothing new landed. Pressing Refresh in the app always collects
regardless. see also: Claim, Shared workspace.
A per-day snapshot file under ~/Jamf-Reports/<profile>/snapshots/computers/summaries/
containing aggregate metrics (date, total devices, compliance %, FV %,
patch %, etc.). TrendStore reads these to build historical trend charts.
Each generate/collect run emits one.
The @Observable Swift service that reads summary.json files for the
active profile and exposes the points the Trends and Overview dashboards
chart against. Range defaults to 4 weeks (configurable in Settings).
The most expensive collection tier — full device inventory and the
per-device failure scans (ea-results --all, patch-status --scan-failures, update-status --scan-failures, device-compliance).
Minutes on large fleets; schedule it overnight on rate-limited tenants.
see also: Collection tier.
The on-disk root for a profile at ~/Jamf-Reports/<slug>/. Contains
config.yaml, jamf-cli-data/, snapshots/, Generated Reports/,
automation/logs/, archive/. Path construction goes through
WorkspacePaths.dataDir(for:) — never raw string interpolation.
The bordered content section used as the building block for every screen.
Defined in Theme/Components.swift.
The small uppercased monospaced label above a title (e.g. "INVENTORY",
"POSTURE"). Used in PageHeader and SectionHeader.
The top-of-screen component bundling a kicker, optional breadcrumbs, title, subtitle, last-modified timestamp, and trailing actions. Every dashboard starts with one.
A small rounded label used for status/category (e.g. "Encrypted", "Stale",
"Critical"). Color-coded via Pill.Tone (gold / teal / muted / warn /
danger / ok).
The standard button primitive. Has style (neutral / gold / danger) and
size (sm / md) variants. Every button needs .accessibilityLabel and
.help.
The "Section title — trailing-text" pattern inside a Card. Supports a short trailing kicker for counts like "50 of 200 shown".
The app's navigation rail. Groups: Reports, Posture, Operations, Fleet, Automation, Configuration, System. Core screens (Overview, Devices, Data Sources, Settings) are pinned and cannot be hidden.
The KPI tile primitive. Label, value, sub-text, optional trend indicator. Used in every dashboard's KPI row.
A swiftDialog-based compliance UI for end-user-visible mSCP audit results. Developed by Dan Snelson (open source). Not part of JamfReports, but cross-referenced in some operational workflows where compliance findings drive user-facing prompts.
Open-source command-line tool for showing native macOS dialogs from scripts (Bart Reardon). Common building block for MHC-style end-user compliance UI.
- App Onboarding — the guided first run.
- Dashboards — every screen in the app.
-
docs/architecture/in the repository — design decisions and the threat model.