Jamf Connect Documentation

Solution
Application: Jamf Connect
Content Type: Technical Documentation
Utilities & Services
ft:locale: English

Jamf Connect Documentation
Jamf Connect
Capabilities Reference
System Requirements
Security Standards
Passwords
Keychain Usage
Active Directory Security
Certificates
Network Connections
Usage and Crash Analytics
User Space
Getting Started
Licensing Jamf Connect
Renewing Jamf Connect Licenses
Expired or Invalid Licenses
Identity Provider Integrations
Microsoft Entra ID
Creating a Jamf Connect App Registration in Microsoft Entra ID
Grant Admin Consent for API Calls
Modify App Authentication Settings
Configuring App Roles in Microsoft Entra ID
Assigning Users to Jamf Connect App Roles
Cloud Password Validation in Entra ID for Jamf Connect
Determining if Password Hash Sync is Enabled
Testing Password Hash Sync with Jamf Connect Configuration
Creating a Home Realm Discovery (HRD) Policy
Jamf Connect and Microsoft Entra ID Conditional Access
Exempting Jamf Connect from Login Restrictions without MFA
Creating a Custom Security Attribute for MFA Exceptions
Applying a Custom Security Attribute to Jamf Connect
Adding an Exemption for a Conditional Access policy
Removing Conditional Access Policies Applied to All Cloud Apps
Making Jamf Connect Compatible with Microsoft Conditional Access Polices
Creating an Application Registration with a Custom API
Creating an Application Registration to Call a Custom Scope
Creating a Custom Security Attribute for MFA Exceptions
Applying a Custom Security Attribute to Jamf Connect
Creating an Entra ID Conditional Access Policy
Applying an Exclusion Policy to Conditional Access Policies
Creating a Jamf Connect Configuration Profile with Conditional Access Settings
Okta
Configuring Okta Identity Engine with Jamf Connect
Add Groups Claim to OIDC Identity Tokens
Testing your Okta Identity Engine Configuration
Creating an Okta App Integration with OpenID Connect
Configuring Okta Identity Engine for OpenID Connect 2.0
Configuring Okta Classic Engine for OIDC
Add Groups Claim to OIDC Identity Tokens
Testing your Okta OIDC Configuration
Configuring Okta to use MFA at the Jamf Connect Login Window
Renaming your Jamf Connect Application
Creating a Second Jamf Connect Application for Multifactor Authentication during Login
Enforcing Multifactor Authentication at the macOS Login Window with Okta Identity Engine
Enforcing Multifactor Authentication at the macOS Login Window with Okta Classic Engine
Testing your Okta OIDC Configuration with Multifactor Authentication
Configuring Okta Classic Engine with Jamf Connect
Enabling Multifactor Authentication for Okta Classic Engine
Testing your Okta Classic Engine Configuration
Creating Applications for Limiting Access to Devices
Creating an Application for Limiting Access in Okta
Configuring an Authentication Policy with Okta Identity Engine to Limit Access
Configuring a Sign On Policy with Okta Classic Engine to Limit Access
Testing your Okta Configuration to Limit Access
Google
Creating an OpenID Connect Application Integration for the Login Window
Generating a PKCS12 (.p12) Keystore File from a Google Cloud LDAP Client
Deploying a .p12 Keystore File using Jamf Pro
Manually Installing a .p12 Keystore File
Deploying a .p12 Keystore File using Jamf School
Testing a .p12 Keystore File and Connection
IBM
OneLogin
PingFederate
RapidIdentity - Identity Automation
Creating a Federation Partner Integration with RapidIdentity
Create Identity Automation Configuration Profile
Saving Tenant and Federation Partner Definition Information
Creating and Testing your RapidIdentity Configuration Profile
Custom Identity Providers
Configuration Methods
Jamf Connect Configuration
Creating a Configuration Profile using Jamf Connect Configuration
Saving User Tokens from Jamf Connect Configuration
Creating Jamf Connect Configuration Profiles Using Jamf Pro
Configuring Enrollment-only Jamf Connect Settings
authchanger
authchanger Commands
authchanger Examples
Custom Branding
Packaging Jamf Connect Files and Images with Composer
Common Custom Branding Settings for Jamf Connect and Self Service+
Authentication Protocols Used in Jamf Connect
OpenID Connect
Authorization Code Grant
Authorization Code Grant and Resource Owner Password Grant (ROPG)
Okta Authentication Methods
Passthrough Authentication with Jamf Connect
Enabling Passthrough Authentication
Network and Local Authentication Restrictions
Multifactor Authentication
Multifactor Authentication by Identity Provider
Client Certificate Authentication
Configuring Offline Multifactor Authentication
Federated Integrations
Configuring Jamf Connect with AD FS
Authentication Settings
Minimum Authentication Settings by Identity Provider
Discovery URL Endpoints for OpenID Connect Authentication
Identity Provider Discovery Endpoints
macOS Account Management
macOS Account Management Requirements
Activating macOS Account Management Capabilities in Self Service+
macOS Account Management End User Experience
Offline Multifactor Authentication Experience
Password Syncing
Password Syncing with Google
Configuring Self Service+ for Google Cloud ID
Kerberos Integration
Certificates with Jamf Connect
Keychain Item Syncing
Privilege Elevation
Configuring macOS Privilege Elevation in Self Service+
Auditing Privilege Elevation with Logs
Elevate macOS Privileges for Users via Jamf Pro Policy
Custom Menu Bar Actions
Action Item Configuration Profile Example
Action Preference Key Reference
File Shares
File Share Options
Enabling File Shares with Self Service+
State Settings and User Status
Jamf Connect Extension Attributes
Self Service+ State Settings
Variables Used by Self Service+
URL Scheme
Settings Reference
Self Service+ Authentication Settings
Self Service+ Sign-in Settings
Self Service+ Custom Branding Settings
User Help Settings
Password Policy Settings
Kerberos Settings
Keychain Settings
Okta Web Browser Settings
Menu Item Customization Settings
Menu Item Display Settings
Self Service+ Script Settings
Privilege Elevation Settings
Certificate Settings
File Share Settings
Action Item Settings
macOS Login Window
macOS Login Window Requirements
FileVault Requirements
Network Authentication Requirements
macOS Login Window Deployment Planning
Deployment Methods
Jamf Connect Integration with Jamf Pro
Deploying Jamf Connect via Automated Device Enrollment
Deploying Jamf Connect using a Jamf Pro Policy
Managing Jamf Connect Login Window Updates
Account Creation
Initial Local Password Creation
User Roles for Local Accounts
Local Account Migration
Turning On FileVault with Jamf Connect
Privacy Preference Policy Control Payload on macOS 11 or Later
Deploying Privacy Preference Policy Control Settings with Jamf Pro
Uploading Privacy Preferences Policy Control Settings Manually
Disabling Automatic FileVault Login
User Experience and Security
FileVault Enablement with Jamf Connect by macOS Version
Custom Short Name
Acceptable Use Policy Screen
Notify Screen
Terminate the Notify Screen
Enable the Notify Screen
Disable the Notify Screen
Notify Script Commands
Best Practices
Sample Script
Pluggable Authentication Module with Jamf Connect
Enabling the Pluggable Authentication Module
Pluggable Authentication Module End User Experience
Adding a Login Script
Demobilizing and Unbinding Mobile Accounts with Jamf Connect and Jamf Pro
General Requirements
Demobilizing Accounts
Tracking Demobilized Accounts
(Optional) Unbinding Local Accounts
(Optional) Enabling Network Authentication with Jamf Connect
Enabling the Jamf Connect Login Window
Configuring Self Service+
End User Experience and Workflows
Local Account Creation Experience
Subsequent and Routine Logins
Logins with OpenID Connect Authentication
Logins with Okta
Local Logins
Logins on FileVault Encrypted Computers
Existing Local Account Migrations
Login Window Settings
Login Window Authentication Settings
Initial Password Settings
Local and Network Authentication Management Settings
Account Migration Settings
Login Window Custom Branding Settings
Login Window User Help Settings
Microsoft Entra ID Hybrid ID Settings
Universal User Role Settings
OpenID Connect User Role Settings
Okta User Role Settings
Okta Multifactor Authentication Settings
Advanced Login Authentication Settings
FileVault Settings
Acceptable Use Policy Settings
Login Script Settings
Pluggable Authentication Module (PAM) Settings
Advanced Update Settings
Troubleshooting
Jamf Connect Logs
Downloading Jamf Connect Logs from the Login Window or with Self Service+
Downloading Jamf Connect Logs from Terminal
Login Window Logs and Debugging in the Terminal App
Self Service+ Logs and Debugging in Terminal App
Logs in the Console Application
Preferences with the defaults Command-Line Tool
defaults Read
defaults write
Editing the macOS loginwindow Application
Enabling and Disabling the Jamf Connect Login Window
Restoring the Authorization Database
Reading the loginwindow Mechanisms
Testing Network Authentication
Testing Okta Authentication
Testing OpenID Connect Authentication
Testing Password Verification
Changing Identity Providers with Jamf Connect
Re-configuring the Jamf Connect Login Window with a new Identity Provider
Disable the Login Window
Remove Identity Provider Attributes from Computers
Deploy the Login Window Configuration with a new Identity Provider
Re-configuring Self Service+ with a new Identity Provider
Disabling the Jamf Connect Login Window
Disabling Jamf Connect using a Jamf Pro Policy
Disabling Jamf Connect in Recovery Mode
Microsoft Azure Active Directory Authentication Library Deprecation
Disabling Jamf Connect using a Jamf Pro Policy
Suppressing Google Consent Prompts in the Jamf Connect Login Window
Troubleshooting Deployments with Automated Device Enrollment
Verifying Local Account Creation
Uninstalling Jamf Connect
Uninstalling Using the Jamf Connect Uninstaller Package
Uninstalling the Login Window
Uninstalling the Account Management Capabilities in Self Service+
Re-enabling the Login Window After a Major macOS Upgrade
Unmigrating a Local Account
Zero Trust Network Access
Zero Trust Network Access Requirements
Known Issues and Limitations
Network Architecture
Endpoint Agent Traffic
Application Access with Zero Trust Network Access
Deploying Zero Trust Network Access
Creating an Activation Profile for Zero Trust Network Access
Distribution Methods for the Jamf Trust App
Distributing the Jamf Trust App Using a Shareable Link
Optimizing Zero Trust Network Access Deployment for Managed Devices
Bootstrapping Jamf Trust App Activation via Managed App Configuration
General Requirements
iOS and iPadOS
Android Enterprise
Windows
Pre-Authorizing VPN Installation
General Requirements
iOS and iPadOS
Android Enterprise
In-App Enterprise Single Sign-On
General Requirements
iOS and iPadOS
Windows
macOS
Access Policy
Adding a New Predefined Application
Adding a New Custom Application
App Discovery in Jamf Security Cloud
Adding Domains to an Access Policy from App Discovery
Encrypting Jamf Security Cloud Proxy Traffic
General Requirements
Configuring a Proxy Access Policy
Defining Fail Open/Close Behavior
Require Endpoint Security Software in Order to Use Zero Trust Network Access
Access Reports
Access Event Block Reasons
Per-App VPN
Per-Application ZTNA versus Per-App VPN
Apple
iOS and iPadOS
General Requirements
Configuring Per-App VPN on Your UEM Solution
Creating a Wildcard Access Policy for Per-App VPN
Deploying Per-App VPN on iOS and iPadOS Devices
Deploying Zero Trust Network Access into Per-App VPN Mode
Troubleshooting
macOS
General Requirements
Configuring Per-App VPN on Your UEM Solution
Creating a Wildcard Access Policy for Per-App VPN
Deploying Per-App VPN on macOS Devices
Deploying Zero Trust Network Access into Per-App VPN Mode
Troubleshooting
Android
Configuring Cloud Access Control
Amazon Web Services
General Requirements
Step 1: Configuring Jamf Security Cloud
Step 2: Configuring Amazon Web Services WAF
Configuring a Jamf IP Set
Configuring a Jamf Web ACL Rule
Step 3: Testing the Default Block Rule
Step 4: Testing the Configuration
Google: Restricting Login Access
General Requirements
Step 1: Configuring Jamf Security Cloud
Step 2: Configuring Google Workspace
Creating a Jamf Access Level
Assigning the Jamf Access Level to Apps
Helping Blocked Users Activate Zero Trust Network Access
Enabling Context-Aware Policies
Step 3: Testing the Configuration
Troubleshooting Google Access
Microsoft 365: Restricting Login Access
General Requirements
Step 1: Configuring Jamf Security Cloud
Step 2: Configuring Azure AD
Step 3: Configuring a Conditional Access Policy to Require Zero Trust Network Access
Step 4: Testing the Configuration
Troubleshooting Microsoft 365 Access
Microsoft Exchange: Restricting Login Access
General Requirements
Step 1: Configuring Jamf Security Cloud
Step 2: Configuring Exchange
Step 3: Testing the Configuration
Okta
General Requirements
Step 1: Configuring Jamf Security Cloud
Step 2: Configuring Okta
Creating a Jamf Network IP Zone
Requiring Zero Trust Network Access to Log In to Apps
Step 3: Testing the Configuration
Troubleshooting Okta Access
Bypassing MFA
Okta: Bypassing Multifactor Authentication
General Requirements
Step 1: Configuring Jamf Security Cloud
Step 2: Configuring Okta
Creating a Jamf Network IP Zone
Configuring Zero Trust Network Access as a Factor for Okta
Configuring Zero Trust Network Access as a Factor for SSO App Login
Step 3: Testing Okta Login with Jamf Trust as a Factor
Step 4: Testing SSO App Login with Jamf Trust as a Factor
Troubleshooting
Azure AD: Bypassing Multifactor Authentication
General Requirements
Step 1: Configuring Jamf Security Cloud
Step 2: Configuring Azure AD
Configuring Azure AD MFA Trusted IPs
Configuring a Conditional Access Jamf MFA Policy
Step 3: Testing the Configuration
Troubleshooting
Access Gateways
Network Gateway Types
Dedicated Gateways
Grouped Gateways
Shared Internet Gateways
Domain Name System (DNS) Integration
Shared Internet Gateway IP Addresses for Zero Trust Network Access
Creating a Quick Connect IPSec Gateway
General Requirements
Step 1: Adding a Quick Connect IPSec Gateway in Jamf Security Cloud
Step 2: Creating a Linux Virtual Machine
Step 3: Updating System Settings
Step 4: Installing then Configuring strongSwan VPN
Step 5: Configuring NAT Rules
Step 6: Configuring Your Network Firewall
Step 7: Verifying the VPN Tunnel
Creating a Custom IPSec Gateway
General Requirements
Vendor-Specific Integration Guides
Configuring a Generic IPSec Gateway in Jamf Security Cloud
Configuring Your VPN Appliance IPSec Site-to-Site Connection
Sample VPN Configuration (Strongswan)
Troubleshooting a Custom IPSec Gateway
Creating a Dedicated Internet Gateway
Troubleshooting a Dedicated Internet Gateway
Creating a Group of Gateways
Connecting to On-Premise Edge Infrastructure
Connecting to On-Premise Edge Infrastructure for Cisco IOS
General Requirements
Step 1: Creating a Custom IPSec Gateway in Jamf Security Cloud
Step 2: Configuring Cisco IOS
Step 3: Monitoring and Troubleshooting
Connecting to On-Premise Edge Infrastructure for SonicWall (Sonic OS)
General Requirements
Step 1: Creating a Custom IPSec Gateway in Jamf Security Cloud
Step 2: Configuring a SonicWall IPSec Tunnel
Connecting to On-Premise Edge Infrastructure for Palo Alto Networks
General Requirements
Step 1: Creating a Custom IPSec Gateway in Jamf Security Cloud
Step 2: Creating a Palo Alto IPSec Site-to-Site VPN Configuration
Step 3: Monitoring and Troubleshooting
Connecting to On-Premise Edge Infrastructure for Juniper
Step 1: Creating a Custom IPSec Gateway in Jamf Security Cloud
Step 2: Creating a Juniper IPSec Site-to-Site Tunnel
Connecting to Cloud Infrastructure
Connecting to Cloud Infrastructure for Google Cloud
General Requirements
Step 1: Configuring a Gateway in Jamf Security Cloud
Step 2: Configuring a Site-to-Site Interconnect for Google Cloud
Step 3: Updating the Google-Side IP Address in Jamf Security Cloud
Step 4: Verifying and Troubleshooting Connectivity
Connecting to Cloud Infrastructure for Amazon Web Services (AWS)
General Requirements
Step 1: Configuring an Interconnect in Jamf Security Cloud
Step 2: Configuring an Interconnect for AWS
Configuring a Customer Gateway
Configuring a Virtual Private Gateway
Creating a VPN Connection to Jamf
Updating the AWS-Side IP Address in Jamf Security Cloud
Attaching to a VPC and Configuring Routing (Virtual Private Gateway Only)
Configuring Routing (Transit Gateway Only)
Step 3: Verifying and Troubleshooting Connectivity
Connecting to Cloud Infrastructure for Azure Cloud
General Requirements
Step 1: Configuring an Interconnect in Jamf Security Cloud
Step 2: Configuring a Site-to-Site Interconnect for Azure
Creating a Virtual Network Gateway
Creating a Local Network Gateway
Creating a New Connection
Step 3: Updating the Azure-Side IP Address in Jamf Security Cloud
Step 4: Verifying and Troubleshooting Connectivity
Connecting to Cloud Infrastructure for Cloudflare
General Requirements
Step 1: Configuring an Interconnect in Jamf Security Cloud
Step 2: Configuring an Interconnect in Cloudflare
Step 3: Verifying and Troubleshooting Connectivity
Dead Gateway Detection
Disabling Dead Gateway Detection for Jamf Trust
Zero Trust Network Access (ZTNA) Events Data Stream in Jamf Connect
Access Events Stream Dictionary
Copyright and Trademarks

Back to home page