Configuring Role-based Account Creation in Jamf Connect

Technical Articles
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

You can map Jamf Connect's user role settings to the app roles in Entra ID for account creation. Keep the following in mind:

  • The OIDCAdminAttribute setting must be set to roles.

  • The OIDCAdmin setting specifies which user roles (or groups) configured in Entra ID become local administrators during account creation. This must match your app role's Value field.

In a Jamf Connect login window configuration profile, add the following two settings to specify which app roles in Entra ID should be used to create local administrator accounts:
<key>OIDCAdminAttribute</key>
<string>roles</string>
<key>OIDCAdmin</key>
  <array>
    <string>administrator</string>
  </array>

When a user assigned to an administrator role logs in to a Mac computer via the Jamf Connect login window, their local account is now created as a a local administrator. Users that are not assigned an administrator role are created as standard users on computers.

To disable all role-based account creation with Jamf Connect, you can use the Ignore Roles (OIDCIgnoreAdmin) setting.