Hosting Jamf Pro Enrollment Information on Your Jamf Pro Server for Account-Driven Enrollment Using the Jamf Pro API

Technical Articles

Solution

Application

Content Type

Technical Documentation

Utilities & Services

ft:locale

en-US

Starting with Jamf Pro 11.25.0, you can use the /v1/service-discovery-enrollment/well-known-settings endpoint in the Jamf Pro API to configure Jamf Pro to host enrollment information for use with account-driven enrollment methods. Previously, you needed to host the JSON files on your own service discovery infrastructure on the same verified domain as your Managed Apple Accounts. Jamf Pro can serve as the fallback service discovery if your organization cannot or prefers not to self-host these files.

After you have configured service discovery hosting in the Jamf Pro API and an end user initiates account-driven enrollment on an eligible computer or mobile device, the device queries the domain for a service discovery file as it would with earlier OS versions. However, the device will then query Apple to check for an alternate service discovery location. Enrolling devices are then redirected to Jamf Pro's hosted discovery file to begin the enrollment process. Apple redirects the device to Jamf Pro.

Note:

This feature is backward-compatible for existing service discovery configurations. If you are already self-hosting your service discovery file, devices will continue to use the existing infrastructure by default. You must decommission your current service discovery file if you want to migrate to the Jamf-hosted solution.

For more information, see Account-driven enrollment methods with Apple devices in Apple Platform Deployment.

Requirements

Unsupervised computers or mobile devices with the following operating systems:
- macOS 15.2 or later
- iOS 18.2 or later
- iPadOS 18.2 or later
- visionOS 2.2 or later
Either account-driven Device Enrollment or account-driven User Enrollment, or both, must be enabled in Jamf Pro's user-initiated enrollment settings according to the device types you want to enroll.

In Apple Business or Apple School Manager, configure your Jamf Pro server as the default MDM server (or device management service) for each device model family you want to enable service discovery for:
1. Navigate to Preferences > Management Assignment, and then next to Default Assignment, click Edit.
2. To enable service discovery, click the pop-up menu next to a device model family, and select your Jamf Pro server as the default device management service.
3. Click Save.
In the Jamf Pro web app, copy the Server UUID from the MDM server object that you chose for Default Assignment earlier. To accomplish this, do the following:
1. Navigate to Settings > Automated Device Enrollment.
2. View and copy the Server UUID value.
In the Jamf Pro API, enable service discovery hosting for specific Automated Device Enrollment tokens:
1. Under service-discovery-enrollment, make a PUT request to the /v1/service-discovery-enrollment/well-known-settings endpoint.
2. Define the gathered serverUuid value in the API call.
  For example, if you are enabling service discovery hosting for BYOD enrollment, your API message body would include the following, where the serverUUID value is replaced with your value:
```
{
  "wellKnownSettings": [
    {
      "orgName": "Acme Corporation",
      "serverUuid": "B99E99E22D5D4D0FB9382A627FEB0C5B",
      "enrollmentType": "mdm-byod"
    }
  ]
}
```
3. Specify the appropriate enrollment type for your organization's needs:
  - mdm-adde for account-driven Device Enrollment (corporate-managed devices)
  - mdm-byod for account-driven User Enrollment scenarios (personal devices)

When end users sign in to their devices using their Managed Apple Account credentials, devices will enroll with Jamf Pro using Jamf Pro's hosted service discovery.

You can test your configuration using the methods below.