Jamf Pro

Apple device management. The most capable MDM connector, and the only one that can populate a loan pool from a smart group.


Category	MDM
Authentication	OAuth client credentials
Reaches	`https://yourorg.jamfcloud.com` over the internet
Needs an agent	No
Demo mode	No

Capabilities

device.lookupBySerial, device.get, device.sendCommand, device.searchSerial, device.listGroup

Which lights up:

Device details on a repair, resolved from the serial.
The device page with live inventory.
Remote commands from the device page.
Serial autocomplete when registering a loan or lodging a repair.
Loan groups auto-populated from a Jamf smart or static group.

Getting the credentials from Jamf

Jamf’s modern API uses API roles and clients rather than a user account. This is better: the credential is scoped to what it can do, and it is not tied to a person who might leave.

In Jamf Pro, go to Settings, System, API roles and clients.

On the API Roles tab, click New.

Name it something like Plugboard read.

Grant these privileges:

Privilege	Needed for
Read Computers	Device lookup and inventory
Read Mobile Devices	iPads
Read Smart Computer Groups	Loan pool pull
Read Static Computer Groups	Loan pool pull
Send Computer Remote Command	Only if you want lock, wipe and similar

Grant the remote command privilege only if you intend to use it. A read-only client cannot do anything surprising.

Save the role.
On the API Clients tab, click New.
- Name it Plugboard.
- Assign the API role you just created.
- Set an access token lifetime. The default is fine.
- Enable the client.
Click Generate client secret. Copy it immediately. It is shown once.
Note the Client ID as well.

Configuring it in Plugboard

Admin, Connectors, Jamf Pro, Configure.

Settings

Field	Value
`baseUrl`	Your Jamf Pro URL, for example `https://yourorg.jamfcloud.com`

No trailing slash. If your Jamf is on-premises rather than Jamf Cloud, use its hostname. An on-premises Jamf that is not internet-reachable needs a connector agent on a managed deployment.

Credentials

Field	Value
`clientId`	The API Client ID from step 6
`clientSecret`	The client secret from step 5

Click Save and test. Success reports “Connected to Jamf Pro” with a latency.

Populating a loan pool from a smart group

The reason to prefer Jamf if you have a choice.

In Jamf, create a smart group whose criteria match your loan devices. Most schools use an asset tag prefix, a department, or a building.
In Plugboard, open Admin, Loan groups and edit the group.
Point it at the Jamf group by name.

Devices in the Jamf group are pulled in as available loans, and the pool stays in sync as devices are added and retired. A loan pool maintained by hand is wrong by the end of the first term.

Remote commands

With the remote command privilege granted, the device page offers the commands Jamf supports for that device: lock, wipe, restart, clear passcode, and pushing a profile or app.

Two things to be deliberate about:

Wipe destroys a student’s data and cannot be undone. The device.manage permission gates it. Give that permission to the people who should have it.
Every command is audited, with who sent it and to which device.

Troubleshooting

Symptom	Cause
`401` on test	Wrong client id or secret, or the client is not enabled in Jamf
Test passes, devices do not resolve	The API role lacks Read Computers, or the serial genuinely is not in Jamf
Loan group pull returns nothing	The smart group name does not match, or the role lacks Read Smart Computer Groups
Commands are missing from the device page	The role lacks Send Computer Remote Command, or your role lacks `device.manage`
Works for Macs, not iPads	Read Mobile Devices was not granted
Timeouts	An on-premises Jamf that the deployment cannot reach. Check with `curl` from the server

Alternatives

If you do not run Jamf: Intune, Kandji, Mosyle or Chrome Enterprise. All implement the same device capabilities, so the repairs screen does not change. Only Jamf implements device.listGroup for loan pool pull today.