Pre-Approval of the Jamf Management Framework

Technical Articles
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

Jamf Pro administrators can pre-approve the Jamf management framework with the Privacy Preferences Policy Control configuration profile. This profile will be automatically installed on Jamf Pro 10.7.1 or later.

Jamf Pro administrators can also create their own configuration profile with the information in the Privacy Preferences Policy Control pane of a configuration profile for computers.

General Requirements

To install the Privacy Preferences Policy Control profile on computers, the following requirements must be met:

  • User Approved MDM

  • Target computers with macOS 10.14 or later

  • Push notifications enabled

If installation is denied by a non-User Approved MDM system, the profile will stay queued and automatically attempt to re-install once the computer achieves User Approved MDM status. For more information about User Approved MDM and Jamf Pro, see the Managing User Approved MDM with Jamf Pro article.

Note:

If your organization only uses jamf binary without User Approved MDM for management, attempting to install this configuration profile using the profiles command or by manually clicking on the profile will not work. It must be pushed via MDM from a User Approved MDM server.

Privacy Preferences Policy Control Profile Contents

To approve the Jamf management framework with macOS 10.14 or later, the following three apps and processes must be approved with Systems Policy All Files service:

  • jamf binary

  • jamf.app

The following .mobileconfig file will approve these apps and processes and is the same as the configuration profile that will automatically install on computers with macOS 10.14 or later and Jamf Pro 10.7.1 or later.
Note:

If multiple payloads of this type are installed, the most restrictive settings between the payloads are used.

 <key>Services</key>
                        <dict>
                                <key>SystemPolicyAllFiles</key>
                                <array>
                                        <dict>
                                                <key>Comment</key>
                                                <string>Allow jamf binary to access all files</string>
                                                <key>Identifier</key>
                                                <string>/usr/local/jamf/bin/jamf</string>
                                                <key>IdentifierType</key>
                                                <string>path</string>
                                                <key>Allowed</key>
                                                <true/>
                                                <key>CodeRequirement</key>
                                                <string>identifier "com.jamfsoftware.jamf" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "483DWKW443"</string>
                                        </dict>
                                        <dict>
                                                <key>Comment</key>
                                                <string>Allow Jamf.app access to all files</string>
                                                <key>Identifier</key>
                                                <string>com.jamf.management.Jamf</string>
                                                <key>IdentifierType</key>
                                                <string>bundleID</string>
                                                <key>Allowed</key>
                                                <true/>
                                                <key>CodeRequirement</key>
                                                <string>identifier "com.jamf.management.Jamf" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "483DWKW443"</string>
                                        </dict>
                                </array>
                        </dict>

Automatically Install the Privacy Preferences Policy Control Profile

A configuration profile that pre-approves the Jamf management framework will automatically install in Jamf Pro 10.7.1 or later. The Automatically install a Privacy Preferences Policy Control profile (macOS 10.14 or later) option is enabled by default in the Security settings when upgrading to Jamf Pro 10.7.1 or later. To access this feature, navigate to Settings > Computer management > Security.

With this option enabled in Security settings, Jamf Pro 10.7.1 or later will automatically collect the macOS version of managed computers at login. This allows Jamf Pro to immediately detect when a computer has been upgraded to macOS 10.14 or later and initiate installation of the Privacy Preferences Policy Control profile. This auto-detection of OS version at login only applies when automatically installing the profile using the option in Security settings. This does not apply if manually deploying a custom configuration profile.

Create a Custom Configuration Profile

Starting with Jamf Pro 10.9, you can configure the Privacy Preferences Policy Control profile as a separate payload in computer configuration profiles. This payload allows you to configure settings to allow or deny access to applications and services within a target computer's Security & Privacy preferences pane (macOS 12 or earlier) or Privacy & Security pane (macOS 13 or later) . To navigate these settings, navigate to Computers > Configuration Profiles and use the Privacy Preferences Policy Control payload to manage these settings.
Note:

If the configuration profile is manually deployed on a computer with macOS 10.13 or earlier, the configuration profile will not be respected once the computer is upgraded to macOS 10.14. The configuration profile will need to be redeployed after upgrading to macOS 10.14 or later.