Connect Jamf Pro

Agent markdown

Before you start

Jamf Pro uses customer client credentials (oauth2_client_credentials + customer_credentials). There is no Init platform OAuth app for this provider.

Connection admin/user creates a Jamf Pro API role and API client, generates a client secret, and submits the instance URL plus client credentials through Init Connect.

You need:

• A Jamf Pro administrator who can create API roles and API clients.
• A Jamf Cloud instance hostname under *.jamfcloud.com.
• Access to Init Connect for the tenant that will own the connection.

Configure the provider

Create an API role and API client (Connection admin/user)

1. In Jamf Pro, open Settings → API roles and clients (labels vary slightly by Jamf Pro version).
2. Create an API role with only the privileges needed for the Init actions you will run (computers, mobile devices, packages, patch, conditional access as applicable). Avoid FileVault recovery-key and other unused admin privileges.
3. Create an API client and assign that API role (or roles).
4. Generate a client secret. Copy it once; Jamf shows the secret only at creation time.
5. Note the client ID and the HTTPS instance origin (for example https://example.jamfcloud.com with no path).

There is no one-time Init platform Jamf registration.

Connect to Init

Connection admin/user starts a Jamf Pro Connect session and submits only these contract fields:

Use inert placeholders in docs only, such as example-token-not-valid. Never embed a real client secret.

Init exchanges the client ID and secret at {instance_url}/api/v1/oauth/token using the client-credentials grant, then probes API compatibility for the connection.

Permissions

API role privileges control which Jamf Classic / Jamf Pro API endpoints the client can call. Match privileges to the generated action requirements; do not grant unused admin privileges.

If you later expand Init actions, update the API role in Jamf and reconnect so a fresh token is minted under the new privileges.

Verify the connection

1. Complete Connect and confirm the connection is active.
2. Run Init’s connection test or a safe read such as listing computers or mobile devices.
3. Success looks like Jamf returning inventory data without 401 token errors or privilege denials.

Rotate or revoke access

1. Generate a new client secret for the API client in Jamf Pro (or create a replacement client).
2. Reconnect in Init with the same instance_url / client_id (or the new client ID) and the new client_secret.
3. Invalidate the previous secret or disable the old API client after cutover.

If a secret is exposed, rotate or disable the API client immediately in Jamf, then reconnect.

Troubleshooting