Jamf

Jamf Pro is the leading Apple device management platform for enterprises, providing comprehensive MDM (Mobile Device Management) for macOS, iOS, iPadOS, and tvOS devices. Connecting Jamf Pro to Harmony enables automated device provisioning, intelligent policy management, and streamlined Apple fleet operations.

What the Jamf integration enables

Capability	Description
Automated Device Enrollment	Trigger device setup and configuration workflows automatically
Device Compliance	Monitor and enforce security policies across devices
Inventory Management	Track device assignments, status, and health
Asset Purchase Tracking	Sync procurement, warranty, and vendor data for each managed device
Application Discovery	Automatically ingest installed software inventory into your Applications catalog
Custom Script Deployment	Deploy and manage scripts on macOS devices directly from Harmony
Building Location Visibility	Surface building name, city, and country for Jamf-managed assets
Automation Workflows	Build custom workflows using the Jamf Pro API

Anything defined in the Jamf Pro API can be accessed through Harmony workflows.

---

Prerequisites

Before connecting Jamf to Harmony, ensure you have:

1. Jamf Pro Administrator access
2. Permissions to create API users and roles
3. Your Jamf Pro URL (e.g., company.jamfcloud.com)
4. A Harmony account with admin privileges

Jamf Pro (not Jamf Now) is required for full API access and automation capabilities.

---

Connect Jamf Pro to Harmony

Step 1: Create API Client in Jamf Pro

1. Log in to your Jamf Pro console
2. Click Settings (gear icon) in the top-right
3. Navigate to System → API Roles and Clients
4. Click the API Clients tab
5. Click + New to create a new API client
6. Configure:

   • Display Name: Harmony Integration
   • Grant the following API permissions:

Permission	Access
Advanced Mobile Device Searches	Read
Computer Enrollment Invitations	Read
Computer Extension Attributes	Read
Computer Inventory Collection	Read
Computer Inventory Collection Settings	Read
Computer PreStage Enrollments	Read
Computers	Read
Mobile Device App Maintenance Settings	Read
Mobile Device Enrollment Invitations	Read
Mobile Device Extension Attributes	Read
Mobile Device Inventory Collection	Read
Mobile Device Managed App Configurations	Read
Mobile Device Applications	Read
Mobile Device PreStage Enrollments	Read
Mobile Device Self Service	Read
Mobile Devices	Read
Smart Mobile Device Groups	Read
Policies	Read, Create, Update
Scripts	Read, Create, Update
View Disk Encryption Recovery Key	Read
Send Computer Remote Lock Command	Create
Send Mobile Device Remote Lock Command	Create
Send Computer Restart Command	Create
Send Mobile Device Restart Device Command	Create
View Computer Device Lock Pin	Read

1. Click Save
2. Copy the Client ID and Client Secret (the secret cannot be retrieved later)

Step 2: Navigate to Integrations

1. Log into your Harmony dashboard
2. Navigate to Settings → Integrations
3. Find Jamf Pro under MDM
4. Click Connect

Navigate to Jamf Pro integration in Harmony dashboard

Step 3: Configure Connection

1. Enter an Instance name for your Jamf Pro connection
2. Enter your Base URL (e.g., https://yourcompany.jamfcloud.com)
3. Enter your Client ID (Jamf Pro OAuth client ID)
4. Enter your Client secret (Jamf Pro OAuth client secret)

You can paste the full JSON credentials block copied from Jamf Pro directly into the Client Secret field. Harmony will automatically detect and extract the correct values, populating both the Client ID and Client Secret fields for you - no need to manually separate them. If the pasted content is not valid JSON or does not contain the expected fields, the form falls back to standard validation so manual entry continues to work as normal.

1. Click Connect

Configure Jamf Pro connection settings

---

What gets synced

Once connected, Harmony pulls comprehensive data from Jamf Pro and organises it across several areas of the platform.

Device inventory

Harmony automatically discovers and categorises your Apple device fleet with rich, structured detail:

• Device type detection - MacBooks, iMacs, iPhones, and other Apple hardware are automatically identified and categorised by model name
• Hardware information - device model, serial number, processor, memory, and storage
• Compliance status - each device is evaluated against FileVault encryption, supervision status, and security settings to surface compliance posture at a glance
• Network interfaces - primary and additional network adapters are captured
• Security posture - FileVault encryption status, battery health, and partition details

Purchase and procurement details

Harmony enriches each asset record with purchase data sourced directly from Jamf's computer inventory. The following details are captured and kept in sync:

• Purchase number (PO number) and vendor - giving you a clear procurement trail for every asset
• Purchase price - parsed from international formats
• Warranty and lifecycle dates

Building location

When a device has a building assigned in Jamf, the building name appears between the Location and Source fields on the asset detail page. This works even for devices that do not have a user assigned - as long as building data exists in Jamf, it is surfaced in Harmony. Building information includes the building's name, city, and country as configured in your Jamf environment.

Installed applications

Harmony automatically ingests software inventory data collected by Jamf and populates it into your Applications catalog, giving you a complete, up-to-date view of what is installed across your fleet. An ignore list is applied during ingestion to filter out noise and keep your application inventory clean and meaningful. Security and IT teams get accurate software visibility for Jamf-managed devices alongside any other sources already connected to Harmony.

---

Device lock with auto-generated PIN

When triggering a device lock action through Jamf, Harmony can automatically generate a secure PIN on your behalf - removing the need to manually specify one. This streamlines the process for support agents handling lock requests directly from a ticket. Providing a custom PIN remains available as an optional parameter if preferred.

---

Custom script deployment

You can deploy custom scripts to macOS devices managed through Jamf Pro directly from Harmony. When a custom script action is triggered, Harmony automatically creates and manages both the script and its associated policy in Jamf Pro, handling the full lifecycle so your devices stay in sync.

• Script creation and updates - scripts are created or updated in Jamf Pro via the modern JSON API, with content validation before deployment
• Policy management - a corresponding Jamf policy is automatically created and linked to the script, using a recurring check-in trigger so managed devices receive and execute the script reliably

---

API version compatibility

The Jamf integration uses the current Jamf Pro v3 API for computer inventory and FileVault recovery key endpoints, ensuring uninterrupted data collection as Jamf retires older API versions. The v3 responses are fully compatible with existing data - no changes to your Jamf configuration or data are required.

For older Jamf Pro instances, Harmony automatically falls back to the previous API version if v3 is not available, ensuring compatibility across all supported Jamf Pro versions.

---

Troubleshooting

Connection fails with authentication error

Possible causes:

• Incorrect Client ID or Secret
• API client has been disabled
• Jamf Pro URL incorrect

Solutions:

1. Verify Client ID and Secret were copied correctly
2. Check API client status in Jamf Pro
3. Confirm Jamf Pro URL includes https:// and is accessible
4. Regenerate credentials if unsure

Device inventory not syncing

Possible causes:

• Missing read permissions for computers/mobile devices
• Devices haven't checked in recently
• API rate limits reached

Solutions:

1. Verify API client has inventory read privileges
2. Check device last check-in dates in Jamf Pro
3. For large fleets (5,000+ devices), contact support for optimization

Cannot deploy policies or profiles

Possible causes:

• Missing write permissions
• Target scope not defined
• Profile conflicts

Solutions:

1. Ensure API client has policy/profile management privileges
2. Verify smart group or static group scope is set
3. Check for conflicting profiles in Jamf Pro

Webhooks not triggering workflows

Possible causes:

• Webhooks not configured in Jamf Pro
• Network firewall blocking requests
• Workflow trigger conditions not met

Solutions:

1. Configure webhooks in Jamf Pro pointing to Harmony
2. Whitelist Harmony webhook URLs in firewall
3. Review workflow trigger conditions

---

Best Practices

Use Smart Groups for Dynamic Assignment

Leverage Jamf Smart Groups for automated device management:

• Group by department, location, or role
• Auto-apply policies to matching devices
• Reduce manual device management
• Scale policies across fleet automatically

Stage Policies Before Enrollment

Prepare configurations before devices arrive:

• Pre-create smart groups for new hires
• Stage configuration profiles
• Test policies in pilot group first
• Ensure zero-touch enrollment experience

Monitor Compliance Continuously

Set up automated compliance monitoring:

• Daily checks for policy violations
• Alerts for critical security issues
• Automatic remediation workflows
• Regular compliance reporting

Implement Self-Service Options

Empower users with self-service capabilities:

• Allow users to request app installations
• Enable password reset workflows
• Provide troubleshooting guides
• Reduce IT support burden

---

Need help? Contact [e-mail] for assistance with your Jamf integration.

---

Data & Privacy

Key privacy principles

For information about how Harmony handles your data, see our Privacy Policy.

• Jamf credentials are encrypted at rest and in transit
• Only necessary device data is synced
• User assignment data is handled securely
• API access is logged for audit compliance
• Integration can be revoked at any time