> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rad.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Jamf Pro

> Configure the Jamf Pro Endpoint Management integration with RAD Security to ingest device inventory and compliance findings, and trigger device remediation.

# Jamf Pro Endpoint Management Integration Setup

This guide walks you through integrating Jamf Pro with RAD Security to ingest managed-device inventory and device compliance findings, and to trigger remediation on a device from RAD.

Jamf Pro is an Apple device management platform. RAD Security connects to the Jamf Pro API using OAuth 2.0 client credentials (an API role and client) and pulls device inventory and compliance posture on a scheduled basis to correlate them with your runtime, cloud, and Kubernetes security data.

<Info>
  **Read-only ingestion, with one write action:** RAD only reads device inventory and compliance from Jamf Pro. The single exception is **device remediation** — RAD can trigger a remediation action on a device through Jamf Pro. That action is RBAC-gated (requires tenant write permission) and recorded as an OCSF Device Control Finding.
</Info>

## Prerequisites

Before you begin, ensure you have:

<Check>
  * A Jamf Pro instance with administrator access
  * Permission to create an API role and API client in Jamf Pro
  * Your **Jamf Pro URL** (your instance base URL)
  * Access to a RAD Security workspace with integration permissions
</Check>

## Understanding Integration Components

<AccordionGroup>
  <Accordion title="API Role" icon="shield-halved">
    Jamf Pro authorizes API access through **API roles**, which define the privileges granted to a client. Create a role with the privileges needed to read computer/device inventory and compliance (and to run remediation actions if used).
  </Accordion>

  <Accordion title="API Client (OAuth 2.0)" icon="key">
    An **API client** is assigned one or more API roles and issues OAuth 2.0 client credentials. You provide the **Client ID** and **Client Secret**, and RAD exchanges them for short-lived access tokens via the client-credentials grant.
  </Accordion>

  <Accordion title="Jamf Pro URL" icon="globe">
    The **Jamf Pro URL** is the base URL of your Jamf Pro instance (for example `https://yourcompany.jamfcloud.com`). It is required so RAD targets your instance.
  </Accordion>

  <Accordion title="Scheduled Polling" icon="clock">
    RAD Security ingests Jamf Pro device inventory and compliance via scheduled polling. Data arrives on RAD's polling cadence rather than being pushed by Jamf Pro.
  </Accordion>
</AccordionGroup>

***

## Step 1: Create an API Role and Client in Jamf Pro

<Steps>
  <Step title="Sign in to Jamf Pro">
    Log in to your Jamf Pro instance with an administrator account.
  </Step>

  <Step title="Create an API Role">
    Go to **Settings → System → API roles and clients → API Roles** and create a new role. Grant the privileges required to read inventory and compliance (and remediation privileges if you will use device remediation).
  </Step>

  <Step title="Create an API Client">
    On the **API Clients** tab, create a new client, assign the API role you created, and enable it. Note the **Client ID**.
  </Step>

  <Step title="Generate a Client Secret">
    Generate a **Client Secret** for the API client and copy its value.

    <Warning>
      Copy the **Client Secret** immediately — it is shown only once at generation time. Store it securely in a password manager or secrets vault.
    </Warning>
  </Step>

  <Step title="Note Your Jamf Pro URL">
    Record your **Jamf Pro URL** (your instance base URL, for example `https://yourcompany.jamfcloud.com`).
  </Step>
</Steps>

<Note>
  Exact console navigation, privilege names, and labels may vary across Jamf Pro versions. See the [Jamf Pro documentation](https://learn.jamf.com/en-US/bundle/jamf-pro-documentation-current/page/API_Roles_and_Clients.html) for current steps to create API roles and clients.
</Note>

***

## Configure in RAD Security

Navigate to your RAD Security workspace and configure the Jamf Pro integration with the following parameters:

### Required Parameters

| Parameter         | Required | Description                                          |
| ----------------- | -------- | ---------------------------------------------------- |
| **Client ID**     | Yes      | OAuth 2.0 Client ID of the Jamf Pro API client       |
| **Client Secret** | Yes      | OAuth 2.0 Client Secret generated for the API client |
| **Jamf Pro URL**  | Yes      | Base URL of your Jamf Pro instance                   |

***

## Verify Integration

<Steps>
  <Step title="Check Connection Status">
    1. Navigate to **Data Sources > Integrations > Endpoint Management** in RAD Security
    2. Locate your Jamf Pro integration
    3. Verify the connection status shows as **Connected**
  </Step>
</Steps>

<Check>
  Your Jamf Pro integration is now configured! RAD Security will ingest device inventory and compliance findings from Jamf Pro on a scheduled basis.
</Check>

## What Data is Synced

<AccordionGroup>
  <Accordion title="Device Inventory" icon="laptop">
    Jamf Pro managed devices, mapped to **OCSF Device Inventory Info (5001)** — hostname, OS, hardware, serial, owner, managed/compliant flags, risk, and first/last-seen timestamps.
  </Accordion>

  <Accordion title="Compliance Findings" icon="shield-exclamation">
    Device compliance posture, mapped to **OCSF Compliance Finding (2003)** and stored as security findings. Feeds unified posture analysis and RADBot.
  </Accordion>

  <Accordion title="Device Remediation" icon="screwdriver-wrench">
    The one write action — RAD can trigger a Jamf Pro remediation on a device. RBAC-gated (tenant write) and recorded as an **OCSF Device Control Finding**.
  </Accordion>
</AccordionGroup>

## Use Cases

<CardGroup cols={2}>
  <Card title="Compliance Management" icon="shield-check">
    Track device compliance gaps from discovery through remediation across your Jamf-managed Apple fleet.
  </Card>

  <Card title="Asset Visibility" icon="laptop">
    Use managed-device inventory to understand your endpoint estate and reduce attack surface.
  </Card>

  <Card title="Threat Response" icon="screwdriver-wrench">
    Trigger Jamf Pro remediation on a non-compliant or compromised device directly from RAD.
  </Card>

  <Card title="RADBot Prioritization" icon="robot">
    Leverage RADBot to prioritize Jamf Pro device findings by real-world impact.
  </Card>
</CardGroup>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Authentication Failed" icon="triangle-exclamation">
    **Possible causes:**

    * Incorrect Client ID or Client Secret
    * The API client was disabled or its secret rotated in Jamf Pro

    **Solution:**

    * Verify the Client ID and Client Secret are copied correctly (no extra spaces)
    * Confirm the API client is enabled in **API roles and clients**
    * Generate a new client secret and update it in RAD Security if needed
  </Accordion>

  <Accordion title="Insufficient Privileges" icon="lock">
    **Possible causes:**

    * The assigned API role lacks the required read or remediation privileges

    **Solution:**

    * Add the missing privileges to the API role assigned to the client
    * Reconnect after updating the role
  </Accordion>

  <Accordion title="Connection Refused / Not Found" icon="globe">
    **Possible causes:**

    * Incorrect or unreachable Jamf Pro URL

    **Solution:**

    * Verify the **Jamf Pro URL** matches your instance base URL
    * Confirm the URL is reachable and uses `https://`
  </Accordion>
</AccordionGroup>

## Security Best Practices

<CardGroup cols={2}>
  <Card title="Dedicated API Client" icon="user-gear">
    Use a dedicated API client and role for the RAD integration rather than sharing one with other tools.
  </Card>

  <Card title="Least Privilege" icon="shield-halved">
    Grant the API role only the privileges required for inventory, compliance, and remediation.
  </Card>

  <Card title="Rotate Credentials" icon="rotate">
    Rotate the client secret periodically according to your security policy.
  </Card>

  <Card title="Secure Secret Storage" icon="vault">
    Store the client secret in a secrets vault. Never commit it to version control.
  </Card>
</CardGroup>

## Additional Resources

<CardGroup cols={2}>
  <Card title="Jamf Pro Documentation" icon="book" href="https://learn.jamf.com/en-US/bundle/jamf-pro-documentation-current/page/API_Roles_and_Clients.html">
    Official Jamf Pro documentation on API roles and clients
  </Card>

  <Card title="Endpoint Management Overview" icon="laptop-mobile" href="/rad-security/integrations/endpoint-management/overview">
    Learn about RAD's endpoint management integrations
  </Card>
</CardGroup>

## Next Steps

<CardGroup cols={2}>
  <Card title="Endpoint Management Integrations" icon="laptop-mobile" href="/rad-security/integrations/endpoint-management/overview">
    Explore other endpoint management integration options
  </Card>

  <Card title="Data Sources" icon="database" href="/rad-security/integrations/data-sources">
    Connect additional security data sources
  </Card>

  <Card title="RADBot" icon="robot" href="/rad-security/getting-started/radbot">
    Learn how RADBot helps prioritize findings
  </Card>
</CardGroup>