End User Application
The end user application allows end users to enroll their devices, ensures device compliance, and notifies users about security issues and required updates.
- Jamf Trust
- An end-user application compatible with most configurations and platforms. Recommended for most deployments.
- Self Service+
- A unified application for end users. You must have Self Service+ installed on the target devices.
Service Capabilities
Available capabilities depend on which security products your organization subscribes to and may include all or some of the following:
- Network access
- Provides secure access to your organization's resources using Jamf Connect's Zero Trust Network Access
- Content controls
- Manages network activity using Jamf Protect's internet content filtering and usage controls
- Network security
- Protects your network connections from cyber threats
- Device identity
- Enables requirements that devices must meet to access the organizations resources. For more information, see Technical Paper: Integrating AWS Verified Access with Jamf Device Identity.
Traffic Vectoring
Traffic vectoring determines how data collected by enrolled devices is routed.
- Enable network compatibility mode
- Allows you to deploy the on-device content filter without Secure DNS.
Keep the following in mind:
- If you select Network access, WireGuard VPN is automatically used.
If you select both Network access and Content controls, per-site data usage MB reporting is only available with on-device content filtering.
If you select network access alone or alongside network security or content controls, you can use managed device attestation with network relay.
If you select Enable network compatibility mode, on-device content filtering will be active, but DNS-based threat prevention features (e.g., enforcement for Google Safe Search and YouTube Restricted Mode) will be disabled. Ensure your existing DNS security solutions provide adequate threat protection before using this option.
For more information about traffic vectoring concepts, see Traffic Vectoring Options with Jamf Security Cloud.
Authentication
Authentication settings determine how users authenticate with the Jamf Trust app and how they display in the Jamf Security Cloud portal.
- User credentials (SSO)
Users are prompted to sign in with your organization's cloud IdP. This option requires a linked identity provider in Jamf Security Cloud. If you are deploying Jamf Connect's Zero Trust Network Access or MAM-WE, IdP authentication is required.
- Managed device attestation
- Users enroll without authenticating with your organization's cloud IdP. Jamf recommends this option for the ease of deploying and activating Jamf Trust to your devices.
You can also choose between two different ways to create the device name for devices enrolled with the Jamf Security Cloud:
- Assign random identifier —
This method does not require user identification details. User profiles are generated using artificial and anonymous device details. These users can identify themselves using the About section in Jamf Trust.
- Ask user to submit name and email —
Users are prompted to submit a name, email, or both.
Note:If devices are managed with UEM or MDM solution that is synced via UEM Connect, these values are overwritten with inventory information from the UEM or MDM solution during the next UEM Connect sync.
- Assign random identifier —
Advanced settings
Advanced settings vary based on which service capabilities are selected in the activation profile.
- Display in-app secure DNS control
Determine if users are allowed to enable and disable secure DNS on their device in the Jamf Trust app. This setting applies to:
Devices with iOS, iPadOS, or Android operating systems
Activation profiles with the Network security service capability selected and secure DNS as the traffic vectoring option.
- Enable Jamf customizable block pages
- Displays the data block page to users when they attempt to access blocked content via an HTTP or HTTPS connection on their device.Important:
On Apple devices, the block page cannot display in Safari if iCloud Private Relay is enabled. To disable iCloud Private Relay using an MDM or UEM solution, see Restricting iCloud Private Relay for Supervised Apple Devices.
If you enable this setting, you must deploy the activation profile via a UEM or MDM solution. This ensures the root certificate, which is included in the activation profile when downloaded in .mobileconfig format, is also installed on target devices.
If you want to enable this setting on already enrolled devices, you can download the following configuration profile with only the certificate payload and deploy it via UEM or MDM solution: https://block.jamf.com/certificate/BlockPage.mobileconfig.
Alternatively, you can download the certificate file: https://block.jamf.com/certificate/JamfSecurityCA.crt.
- Expiration date
No expiration date allows an activation profile to be used indefinitely. Alternatively, use the date selector to choose when the activation profile expires. Jamf recommends setting an expiration date.
- Determine device location
Determine how a device's country information is collected. This setting applies to:
Devices with iOS, iPadOS, or Android operating systems
Activation profiles with the Content controls service capability selected
The following methods are available for determining location:
Setting Device Sensors Locale Deduction Best effort ❌ ✅ Location services ✅ ✅ Disabled ❌ ❌ The techniques used to determine a user's location at a country level work as follows:
- Device Sensors —
Uses the device's location services frameworks, which usually rely on location sensing technologies such GPS, Wi-Fi, and cellular tower triangulation.
Note:Access to location services requires user approval on most operating systems.
- Locale Deduction —
Uses metadata about the device to make a best-effort deduction of the device's location.
Note:If you choose to disable the location collection for an activation profile, Jamf Security Cloud will apply domestic policies and display the portal's home country as the current location for devices that are enrolled with the activation profile.
Naming and grouping
- Name
- The activation profile's name in Jamf Security Cloud portal.
- Device group
- The group in Jamf Security Cloud portal that devices are added to after they enroll. This allows you to control which Jamf Security Cloud policy settings are applied to devices at the group-level.Note:
If your UEM Connect is configured, this setting is overwritten during a the next UEM Connect sync. For more information about syncing groups with UEM Connect, see UEM Connect