> For the complete documentation index, see [llms.txt](https://docs.harmony.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.harmony.io/integrations/mdm/jamf.md).
# Jamf
Jamf Pro is the leading Apple device management platform for enterprises, providing comprehensive MDM (Mobile Device Management) for macOS, iOS, iPadOS, and tvOS devices. Connecting Jamf Pro to Harmony enables automated device provisioning, intelligent policy management, and streamlined Apple fleet operations.
### What the Jamf integration enables
| Capability | Description |
| ---------------------------- | -------------------------------------------------------------------------------- |
| Automated Device Enrollment | Trigger device setup and configuration workflows automatically |
| Device Compliance | Monitor and enforce security policies across devices |
| Inventory Management | Track device assignments, status, and health |
| Asset Purchase Tracking | Sync procurement, warranty, and vendor data for each managed device |
| Application Discovery | Automatically ingest installed software inventory into your Applications catalog |
| Custom Script Deployment | Deploy and manage scripts on macOS devices directly from Harmony |
| Building Location Visibility | Surface building name, city, and country for Jamf-managed assets |
| Automation Workflows | Build custom workflows using the Jamf Pro API |
Anything defined in the [Jamf Pro API](https://developer.jamf.com/jamf-pro/docs) can be accessed through Harmony workflows.
***
### Prerequisites
Before connecting Jamf to Harmony, ensure you have:
1. **Jamf Pro Administrator access**
2. **Permissions to create API users and roles**
3. **Your Jamf Pro URL** (e.g., `company.jamfcloud.com`)
4. **A Harmony account** with admin privileges
{% hint style="info" %}
Jamf Pro (not Jamf Now) is required for full API access and automation capabilities.
{% endhint %}
***
### Connect Jamf Pro to Harmony
#### Step 1: Create API Client in Jamf Pro
1. Log in to your Jamf Pro console
2. Click **Settings** (gear icon) in the top-right
3. Navigate to **System → API Roles and Clients**
4. Click the **API Clients** tab
5. Click **+ New** to create a new API client
6. Configure:
* **Display Name**: `Harmony Integration`
* Grant the following API permissions:
| Permission | Access |
| ----------------------------------------- | -------------------- |
| Advanced Mobile Device Searches | Read |
| Computer Enrollment Invitations | Read |
| Computer Extension Attributes | Read |
| Computer Inventory Collection | Read |
| Computer Inventory Collection Settings | Read |
| Computer PreStage Enrollments | Read |
| Computers | Read |
| Mobile Device App Maintenance Settings | Read |
| Mobile Device Enrollment Invitations | Read |
| Mobile Device Extension Attributes | Read |
| Mobile Device Inventory Collection | Read |
| Mobile Device Managed App Configurations | Read |
| Mobile Device Applications | Read |
| Mobile Device PreStage Enrollments | Read |
| Mobile Device Self Service | Read |
| Mobile Devices | Read |
| Smart Mobile Device Groups | Read |
| Policies | Read, Create, Update |
| Scripts | Read, Create, Update |
| View Disk Encryption Recovery Key | Read |
| Send Computer Remote Lock Command | Create |
| Send Mobile Device Remote Lock Command | Create |
| Send Computer Restart Command | Create |
| Send Mobile Device Restart Device Command | Create |
| View Computer Device Lock Pin | Read |
7. Click **Save**
8. Copy the **Client ID** and **Client Secret** (the secret cannot be retrieved later)
#### Step 2: Navigate to Integrations
1. Log into your Harmony dashboard
2. Navigate to **Settings → Integrations**
3. Find **Jamf Pro** under **MDM**
4. Click **Connect**
#### Step 3: Configure Connection
1. Enter an **Instance name** for your Jamf Pro connection
2. Enter your **Base URL** (e.g., `https://yourcompany.jamfcloud.com`)
3. Enter your **Client ID** (Jamf Pro OAuth client ID)
4. Enter your **Client secret** (Jamf Pro OAuth client secret)
{% hint style="info" %}
You can paste the full JSON credentials block copied from Jamf Pro directly into the **Client Secret** field. Harmony will automatically detect and extract the correct values, populating both the Client ID and Client Secret fields for you - no need to manually separate them. If the pasted content is not valid JSON or does not contain the expected fields, the form falls back to standard validation so manual entry continues to work as normal.
{% endhint %}
5. Click **Connect**
***
### What gets synced
Once connected, Harmony pulls comprehensive data from Jamf Pro and organises it across several areas of the platform.
#### Device inventory
Harmony automatically discovers and categorises your Apple device fleet with rich, structured detail:
* **Device type detection** - MacBooks, iMacs, iPhones, and other Apple hardware are automatically identified and categorised by model name
* **Hardware information** - device model, serial number, processor, memory, and storage
* **Compliance status** - each device is evaluated against FileVault encryption, supervision status, and security settings to surface compliance posture at a glance
* **Network interfaces** - primary and additional network adapters are captured
* **Security posture** - FileVault encryption status, battery health, and partition details
#### Purchase and procurement details
Harmony enriches each asset record with purchase data sourced directly from Jamf's computer inventory. The following details are captured and kept in sync:
* **Purchase number (PO number)** and **vendor** - giving you a clear procurement trail for every asset
* **Purchase price** - parsed from international formats
* **Warranty and lifecycle dates**
#### Building location
When a device has a building assigned in Jamf, the building name appears between the Location and Source fields on the asset detail page. This works even for devices that do not have a user assigned - as long as building data exists in Jamf, it is surfaced in Harmony. Building information includes the building's name, city, and country as configured in your Jamf environment.
#### Installed applications
Harmony automatically ingests software inventory data collected by Jamf and populates it into your Applications catalog, giving you a complete, up-to-date view of what is installed across your fleet. An ignore list is applied during ingestion to filter out noise and keep your application inventory clean and meaningful. Security and IT teams get accurate software visibility for Jamf-managed devices alongside any other sources already connected to Harmony.
***
### Device lock with auto-generated PIN
When triggering a device lock action through Jamf, Harmony can automatically generate a secure PIN on your behalf - removing the need to manually specify one. This streamlines the process for support agents handling lock requests directly from a ticket. Providing a custom PIN remains available as an optional parameter if preferred.
***
### Custom script deployment
You can deploy custom scripts to macOS devices managed through Jamf Pro directly from Harmony. When a custom script action is triggered, Harmony automatically creates and manages both the script and its associated policy in Jamf Pro, handling the full lifecycle so your devices stay in sync.
* **Script creation and updates** - scripts are created or updated in Jamf Pro via the modern JSON API, with content validation before deployment
* **Policy management** - a corresponding Jamf policy is automatically created and linked to the script, using a recurring check-in trigger so managed devices receive and execute the script reliably
***
### API version compatibility
The Jamf integration uses the current Jamf Pro v3 API for computer inventory and FileVault recovery key endpoints, ensuring uninterrupted data collection as Jamf retires older API versions. The v3 responses are fully compatible with existing data - no changes to your Jamf configuration or data are required.
For older Jamf Pro instances, Harmony automatically falls back to the previous API version if v3 is not available, ensuring compatibility across all supported Jamf Pro versions.
***
### Troubleshooting
Connection fails with authentication error
**Possible causes:**
* Incorrect Client ID or Secret
* API client has been disabled
* Jamf Pro URL incorrect
**Solutions:**
1. Verify Client ID and Secret were copied correctly
2. Check API client status in Jamf Pro
3. Confirm Jamf Pro URL includes `https://` and is accessible
4. Regenerate credentials if unsure
Device inventory not syncing
**Possible causes:**
* Missing read permissions for computers/mobile devices
* Devices haven't checked in recently
* API rate limits reached
**Solutions:**
1. Verify API client has inventory read privileges
2. Check device last check-in dates in Jamf Pro
3. For large fleets (5,000+ devices), contact support for optimization
Cannot deploy policies or profiles
**Possible causes:**
* Missing write permissions
* Target scope not defined
* Profile conflicts
**Solutions:**
1. Ensure API client has policy/profile management privileges
2. Verify smart group or static group scope is set
3. Check for conflicting profiles in Jamf Pro
Webhooks not triggering workflows
**Possible causes:**
* Webhooks not configured in Jamf Pro
* Network firewall blocking requests
* Workflow trigger conditions not met
**Solutions:**
1. Configure webhooks in Jamf Pro pointing to Harmony
2. Whitelist Harmony webhook URLs in firewall
3. Review workflow trigger conditions
***
### Best Practices
Use Smart Groups for Dynamic Assignment
Leverage Jamf Smart Groups for automated device management:
* Group by department, location, or role
* Auto-apply policies to matching devices
* Reduce manual device management
* Scale policies across fleet automatically
Stage Policies Before Enrollment
Prepare configurations before devices arrive:
* Pre-create smart groups for new hires
* Stage configuration profiles
* Test policies in pilot group first
* Ensure zero-touch enrollment experience
Monitor Compliance Continuously
Set up automated compliance monitoring:
* Daily checks for policy violations
* Alerts for critical security issues
* Automatic remediation workflows
* Regular compliance reporting
Implement Self-Service Options
Empower users with self-service capabilities:
* Allow users to request app installations
* Enable password reset workflows
* Provide troubleshooting guides
* Reduce IT support burden
***
Need help? Contact [**support@harmony.io**](mailto:support@harmony.io) for assistance with your Jamf integration.
***
### Data & Privacy
Key privacy principles
For information about how Harmony handles your data, see our [Privacy Policy](https://harmony.io/privacy).
* Jamf credentials are encrypted at rest and in transit
* Only necessary device data is synced
* User assignment data is handled securely
* API access is logged for audit compliance
* Integration can be revoked at any time
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.harmony.io/integrations/mdm/jamf.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.