Jamf for Apple Device Management: Enrollment to Security

Jamf

Jamf is the most widely used management platform built specifically for Apple devices. Jamf Pro manages Macs, iPhones, iPads, and Apple TVs in businesses; Jamf School serves education; and companion products add identity integration and endpoint security. Built on Apple's mobile device management (MDM) framework, Jamf lets IT teams enroll devices automatically, configure settings and security, deploy apps, enforce OS updates, collect inventory, and respond to lost or compromised devices.

Apple device management has its own concepts — Automated Device Enrollment, supervision, configuration profiles, declarative device management, Apps and Books licensing — and Apple changes them every year. Running Jamf well means designing enrollment and scoping carefully, testing changes on pilot groups, keeping security baselines and OS updates current, and automating with smart groups and the API rather than clicking through hundreds of devices.

TL;DR

Connect Apple Business Manager (or Apple School Manager) to Jamf for Automated Device Enrollment of company-owned devices, which are supervised.
Use account-driven User Enrollment for personal (BYOD) devices, which separates work and personal data.
Configure devices with configuration profiles and, increasingly, declarative device management (DDM).
Deploy apps through Apps and Books licenses, the App Store, or packages; enforce OS updates with declarative software update settings.
Target everything with smart groups built from inventory and extension attributes; automate with policies and the Jamf Pro API.
Apply a security baseline (FileVault, firewall, updates, compliance checks), integrate identity (Platform SSO), test changes in pilot groups, and renew the APNs certificate yearly.

Quick Example

Querying inventory with the Jamf Pro API using an API client's credentials:

An extension attribute script that reports FileVault status into inventory, usable as smart group criteria:

A smart group such as "FileVault Disabled" can then scope a remediation policy and report compliance.

Core Concepts

Enrollment and Ownership

Purchase devices through Apple or authorized resellers so they appear in Apple Business Manager and enroll automatically on first boot. See OS Deployment and Provisioning.

Configuration Profiles and Declarative Management

Configuration profiles carry payloads for Wi-Fi, VPN, certificates (SCEP or ACME), restrictions, privacy permissions for apps (PPPC), system extensions, login items, and more. Declarative device management shifts devices from polling for commands to applying declarations and reporting status autonomously; Apple is moving more capabilities — including software update enforcement — to declarations, so plan configuration with both models in mind.

Apps and Updates

Deploy App Store apps with Apps and Books licenses assigned to devices, internal or third-party Mac software as packages, and keep common apps patched with Jamf's app catalog and patch management features. Enforce OS updates with deadlines and deferrals using declarative software update settings, and stage them through pilot groups.

Inventory, Smart Groups, and Policies

Jamf collects inventory — hardware, OS version, apps, profiles, security state — supplemented by extension attributes (scripts that report custom values). Smart groups update membership automatically from inventory criteria and drive scoping: "Macs without FileVault", "iPads on iPadOS older than N", "Engineering laptops". Policies on Macs run packages, scripts, and maintenance tasks on triggers such as check-in, login, or enrollment. See IT Asset Management.

Security and Identity

Baseline: FileVault with escrowed recovery keys, firewall, Gatekeeper, automatic updates, screen lock, and removal of local admin rights where possible.
Compliance: benchmarks such as the macOS Security Compliance Project (mSCP) and CIS benchmarks, measured through extension attributes or endpoint security tools.
Identity: Platform SSO links macOS sign-in with the corporate identity provider; device compliance can feed conditional access. See Zero Trust and Identity Lifecycle Management.
Lost and offboarded devices: Lost Mode, remote lock and wipe, Activation Lock management, and removing access when employees leave.

Operations

See Unified Endpoint Management and Microsoft 365 and Google Workspace Administration.

Best Practices

Enroll Through Apple Business Manager

Buy through channels that register devices automatically, so every company device is supervised from first boot.

Scope With Smart Groups and Pilots

Target changes by inventory criteria and roll them out to pilot groups first.

Keep a Measurable Security Baseline

Define baseline settings, report compliance through inventory, and remediate automatically.

Automate Repeated Work

Use the Jamf Pro API and scripted workflows for reporting, onboarding, and bulk changes.

Common Mistakes

Manual Enrollment for Company Devices

Org-Wide Changes Without Testing

Forgetting the APNs Certificate

FAQ

What is Jamf used for?

Managing Apple devices in organizations: enrolling and configuring Macs, iPhones, and iPads, deploying apps and updates, enforcing security settings, collecting inventory, and handling lost or offboarded devices.

What is Automated Device Enrollment?

An Apple program, used through Apple Business Manager or Apple School Manager, that assigns company-owned devices to an MDM server so they enroll and become supervised automatically during setup.

What is a supervised device?

A company-owned Apple device enrolled with additional management capabilities, such as non-removable management, more restrictions, and silent app installation.

What is declarative device management?

Apple's newer device management model in which devices receive declarations of desired state and apply and report on them autonomously, reducing reliance on polling for commands.

Can Jamf manage personal devices?

Yes, through account-driven User Enrollment, which separates work data and limits what IT can see or control on personal devices.